How to Disable Windows Cached Logons via Regedit

This guide explains how system administrators can enhance security on mobile domain-joined Windows endpoints by disabling remote credential caching using the Windows Registry Editor (Regedit). By setting the cached logons count to zero, you prevent Windows from saving authentication tokens locally, mitigating offline credential harvesting risks. The following sections provide step-by-step instructions for modifying the registry, alongside the operational impacts of enforcing direct Domain Controller authentication.

Registry Configuration Steps

To disable credential caching on a local endpoint, modify the CachedLogonsCount value within the Windows Registry:

1. Press Win + R, type regedit, and press Enter to open the Registry Editor (requires local administrative privileges).
2. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3. In the right pane, locate the CachedLogonsCount entry.
   • Note: If this value does not exist, right-click the Winlogon key, select New > String Value (REG_SZ), and name it CachedLogonsCount.
4. Double-click CachedLogonsCount, change the Value data to 0, and click OK.
5. Restart the endpoint for the configuration to take effect.

Operational Impact and Considerations

• Domain Controller Requirement: Setting CachedLogonsCount to 0 forces Windows to authenticate against an Active Directory Domain Controller for every login attempt. If the endpoint is disconnected from the corporate network or cannot reach a Domain Controller via a pre-logon VPN, domain users cannot log in.
• Alternative Deployment via GPO: For mass management across multiple domain devices, this configuration can also be deployed via Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Number of previous logons to cache.