I have a situation where a Windows 10 PC (named "A") apparently tried to connect every day to another Windows 10 PC (named "B") using stored Windows credentials. I know I manually connected myself from A to B using remote desktop some time ago, and I assume that's how the credentials of B got stored on A. The B's account is an Active Directory account.
Does Windows 10 do any automatic checks in the background with the stored credentials? Maybe when A starts, Windows on A tries see if thee stored credentials still work?
The problem was, suddenly B's AD account got locked out due to failed login attempts. After investigation with the network admin and also looking at the Windows Security local logs on A in Event Viewer, I found that each day there were attempts of A to connect to B. It cannot be a coincidence that B's AD account recently changed (the password was changed). I can only assume A tried to connect to B using old password and that's how in the end B's account got locked out.
For now, on A, I removed the stored credentials of B. I will keep an eye on the local logs on A to see if login attempts still appear.
However, in the meantime, I'm looking to understand how the login was initiated periodically on A to B. The process has id=4, which is the System process.