Kerberos: The Definitive Guide

Cached Login Credentials

Many Windows machines are mobile, and do not have a fixed network connection. For example, laptops can spend most of their time disconnected from a network; yet, end users expect the ability to log into their own computers, even when no network connection is present. Traditionally, systems that require successful Kerberos authentication for local access, as Active Directory does, require a stable network connection to operate, since communication with the KDC is required to authorize logon. Microsoft provides for disconnected login to domain accounts through a cached credentials feature.

When a user logs into a Windows 2000, XP, or 2003 host, the Local Security Authority (LSA) derives a password verifier and saves this verifier into the local machine’s registry. Later, if the user is disconnected from the network or the domain controller is otherwise unavailable, the local system will authorize access if the username and password match the saved credentials stored on the local disk.

The cached credentials are stored in the local machine’s registry inside of the HKEY_LOCAL_MACHINE\Security\Cache key, which contains sub-keys NL$1 to NL$10. The last 10 users’ login username and password verifier are stored as the values of each of these keys.

Notice that I have been referring to a password verifier , and not password or password hash. The password verifier is a hash of the password hash, so the password verifier cannot be used to derive either the original password ...