Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I have a PC running Windows 7, and use domain profiles for login.
The group policies are set to remember the last user who logged on.
The problem I am having is that the login screen always shows username "xx001", when the last user was "yy001". User "xx001" has left the company a month ago.
Is there way to flush out the previous users on a PC, or is there a setting somewhere that overrides what it considers to be the 'last' user?
Thanks
Yes, to both.
The cached login credentials are stored in the registry, under: HKLM\Security\Cache, and are numbered N1$, N2$, N3$, etc. If you were feeling bold, you could certainly delete those entries, or zero them out. To zero them out, use the following hex value (and note that it's not all 0's - there's an 04 and an 01 in there):
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
Disclaimer: these entries control more than just cached domain logins, and directly editing or deleting them is not an advisable way to flush this cache, though taking a peek at what's in there might be useful. Keep reading for a better way to flush these records.
The number of cached users is controlled by the key at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\, which is a REG_SZ data type, with a value between 0 and 50. The advisable way to flush this cache is to set this value to 0, reboot, log back in, and then set it to... something else and reboot again. The cache will be cleared, and the system will remember how ever many logins you set it to.
Note that a low value, such as 1, will probably cause problems with logging on offline, so bear that in mind if logging in offline is an applicable functionality here.
And, for the sake of completeness, if you can still use the old user account, running the Key Manager dialogue under that account's user context on the computer in question will give you a GUI you can use to clear cached credentials. It includes credential types other than login credentials, but you can find the login credentials in it. You can get it through the control Panel, somehow, or run the following from a cmd or PowerShell prompt: rundll32.exe keymgr.dll, KRShowKeyMgr. It looks like:
Is that user possibly still logged in? That would cause the user to show up on the login screen when all other users are logged off.
Resolved the issue myself, and putting my solution here for anyone else who has the same problem.
The registry key that holds the last logged in user is at: HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
It looks like this key wasn't being updated when a new user logged in (not sure why not). I updated the key manually to the correct user, which resolved the problem.
