Cached Domain Logons
How many domain logons are cached for offline sign-in, and where the verifiers sit.
Use it to judge how much offline-crackable domain credential material this host keeps.
- SOFTWARE
- Defence Evasion
What It Is
Windows caches the sign-in information of recent domain users, so they can still sign in when no domain controller can be reached. CachedLogonsCount, in the Winlogon key of the SOFTWARE hive, sets how many users' sign-ins are kept, and Windows keeps 10 by default. When the cache is full, the next new domain user replaces the oldest entry, and a count of 0 turns caching off. Windows encrypts the cached entries and keeps them in the registry apart from this count.
What It Proves
CachedLogonsCount sets how many domain logon verifiers Windows stores for offline sign-in. The verifiers live in the SECURITY hive and can be recovered from a host, so their presence means domain credentials could be exposed.
What It Does Not Prove
The count is a policy value, not proof anything was taken. The verifiers are salted hashes, slower to crack than LM or NTLM, and SECURITY is readable only as SYSTEM on a live host.
Where It Lives
Cached Domain Logons lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The count is the default, so up to ten domain logons are cached. On a kiosk or shared host, a lower number reduces how much is recoverable. |
| Far more verifiers than default are kept, enlarging the offline-crackable set. Check why it was raised and consider lowering it. |
| A filled cache slot holds one domain logon verifier that can be cracked offline. Unused slots are zeros. Preserve SECURITY and SYSTEM to decode whose it is. |
How to Read It
Read CachedLogonsCount under Winlogon. The default is 10, and 0 disables caching. The verifiers sit under SECURITY\Cache, one NL$ value per cached logon. Collect the SECURITY hive to preserve them. To reduce exposure, lower the count by policy on sensitive hosts, and parse the hive offline rather than reading it live.
- When Windows Writes It
- The count changes when Group Policy or an administrator sets it. A verifier is written at each cached interactive domain logon.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RegRipper (cachedump), RECmd
Hunt It
Microsoft does not list which registry values Defender records, so confirm CachedLogonsCount writes appear before relying on it. It never shows the verifiers in SECURITY\Cache, so collect the SECURITY hive for those.
// Cached logon count changedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Cached Domain Logons shows.
- Profiles on the HostLists the domain accounts with profiles here, the ones whose verifiers may be cached.
- Domain Logons, Security Event 4624Not in the RegistryShows which domain accounts signed in here, so which verifiers the host may hold.
Sources
The facts on this page come from these public pages, which say more on each point.