0

I have a situation where a Windows 10 PC (named "A") apparently tried to connect every day to another Windows 10 PC (named "B") using stored Windows credentials. I know I manually connected myself from A to B using remote desktop some time ago, and I assume that's how the credentials of B got stored on A. The B's account is an Active Directory account.

Does Windows 10 do any automatic checks in the background with the stored credentials? Maybe when A starts, Windows on A tries see if thee stored credentials still work?

The problem was, suddenly B's AD account got locked out due to failed login attempts. After investigation with the network admin and also looking at the Windows Security local logs on A in Event Viewer, I found that each day there were attempts of A to connect to B. It cannot be a coincidence that B's AD account recently changed (the password was changed). I can only assume A tried to connect to B using old password and that's how in the end B's account got locked out.

For now, on A, I removed the stored credentials of B. I will keep an eye on the local logs on A to see if login attempts still appear.

However, in the meantime, I'm looking to understand how the login was initiated periodically on A to B. The process has id=4, which is the System process.

Improve this question

1 Answer 1

Reset to default
1

Does Windows 10 do any automatic checks in the background with the stored credentials

No. If you (or a script or batch file) attempt to log in to another computer using existing credentials, Windows will simply try to use the credentials. There is no prior background check. Credentials work or they don't

It cannot be a coincidence that B's AD account recently changed (the password was changed).

Correct. Change the password means the existing credentials do not work. I normally delete the credential and remake it in this case, or more simply, always supply the correct password.

I'm looking to understand how the login was initiated periodically on B.

That is up to your environment. It can happen through a mapped drive or folder that is Persistent. Persistence is normally ON (Default) for mapping folders or connecting to another machine.

Also Windows has had Cached Credentials so that a domain machine can conveniently work Off-Domain, and re-connect when it returns.

I hope this helps you.

Improve this answer
7
  • Thanks for reply. On A I don't have any folder mapping to a folder on B. In fact I don't have any folder mappings at all (In Windows Explorer, "This PC" shows all the folders, and there's none there)
    – Don Box
    Nov 1, 2020 at 12:24
  • If you connected up before to the machine, the connection may have been cached allowing this. I set my Insider machine to connect to my main machine and the connection is there until I restart and then I have to connect again. It depends on your environment.
    – John
    Nov 1, 2020 at 12:26
  • I don't connect to that machine. I only did it once though the remote desktop...
    – Don Box
    Nov 1, 2020 at 12:27
  • Interesting, the Frequent Folders in Windows Explorer has a mapping to a folder. I removed it by right click menu... 🤦‍♀️
    – Don Box
    Nov 1, 2020 at 12:43
  • 1
    Also there is another concept / name called "Cached Credentials" which I added to my answer. Most of this depends (at least in part) to individual environments. Frequent folders is like Persistence.
    – John
    Nov 1, 2020 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .