Where are Windows 10 default user credentials for network logins stored?

Question

When I try to access any file server in my network for the first time, Windows is always trying to connect automatically with a wrong username:

Please don't mind that the screenshots are in German. The dialog doesn't really contain much useful information, it basically just says that shown credentials are wrong.

The email address mail@example.org is an old account of mine but the wrong one here and I have no idea where it is coming from. It's neither my local account (which I use to login on my machine) nor my organizations Active Directory account (which I use to access other hosts). I would like Windows to stop using it.

In the credentials store there is an entry called *Session which has these wrong credentials:

The problem is, if I try to change the credentials, Windows still tries to log with these wrong credentials after a reboot.

I tried:

• Changing the credentials using the "Choose another account" option in the dialog and also checking "Save credentials".
• Changing the credentials by editing the Session* entry.
• Deleting the *Session entry. In this case no default credentials will be shown and I have to enter the user name manually.

It all works, but only until I restart.

I'm logged in with a local administrator account (which has no email accounts set up). I think I entered mail@example.org when setting up Windows at some point but I'm not sure where exactly.

So the question is, where are the default credentials coming from and how can I remove or change them?

---

I tried deleting all stored credentials, even ostensibly unrelated ones, as well as all network shares with net use * /delete. Additionally I verified with various other system tools, rundll32.exe keymgr.dll,KRShowKeyMgr, vaultcmd /listcredentials and cmdkey /list, that no credentials were stored anywhere, since some sources claimed that the credential manager may not show all entries in some cases. Unfortunately this didn't work and the Session* with the wrong username keeps coming back.

Answer 1

I had the same problem with one of our users and I solved the problem by using psexec from the sysinternals tools. You can use psexec to open a cmd with system user and as system user you can check and delete the stored credentials with cmdkey

Answer 2

Connecting to company Wifi with Windows Credentials is what creates the windows credential *Session entry... For example if you disable your Wifi card and connect through network cable only, this entry will not be created on the next reboot.