I've been doing some penetration testing on our network and discovered that I could access Admin and Domain Admin accounts without passwords, by hacking Windows login cached credentials. I'm trying to discover.
- how to prevent Windows caching Admin credentials with Group Policy.?
- and then, remove all Windows cached credentials across the network to start fresh.
I don't want to apply a HKLM policy that will prevent all cached credentials as many users need to access machines from time to time when the DC isn't up/connected to their machines.