LSA Credential Caching Limit Registry Location

This guide details the exact Windows Registry location used to configure the Local Security Authority (LSA) credential caching limit. Below, you will find the specific registry path, the value name responsible for cached logons, the accepted data ranges, and the steps required to modify this setting using the Registry Editor (Regedit).

Registry Path and Key Information

In Windows, the Local Security Authority (LSA) caches logon credentials to allow users to log into domain accounts even when a domain controller is unreachable. The parameters governing this cache limit are stored in the following registry location:

• Registry Hive: HKEY_LOCAL_MACHINE
• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• Value Name: CachedLogonsCount
• Data Type: REG_SZ (String Value)

Value Settings and Behavior

The CachedLogonsCount entry controls the number of unique user logons that the operating system retains in the cache:

• Default Value: 10 (stores the credentials of the last 10 unique users)
• Valid Range: 0 to 50
• Disabling Caching: Setting the value to 0 completely disables credential caching. When set to 0, users cannot log into a domain account unless the system can establish a direct connection with a domain controller to authenticate the credentials.

How to Modify the Setting in Regedit

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3. In the right-hand pane, locate the CachedLogonsCount string value. (If the entry does not exist, right-click an empty area in the right pane, select New > String Value, and name it CachedLogonsCount.)
4. Double-click CachedLogonsCount.
5. In the Value data field, enter a number between 0 and 50.
6. Click OK and restart the computer for the changes to take effect.