Windows: Difference between DisableDomainCreds and CachedLogonsCount

Question

How are the following settings, located under Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options, related:

• Interactive logon: Number of previous logons to cache (in case domain controller is not available)
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount

  determines whether a user can log on to a Windows domain by using cached account information

• Network access: Do not allow storage of passwords and credentials for network authentication
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds

  determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication

Is CachedLogonsCount just a more fine-grained policy, with DisableDomainCreds the same as setting CachedLogonsCount to 0?

Answer 1

CachedLogonsCount controls how many previous local logons are cached locally, so the user can sign-in to the machine in case the domain controller is unavailable. Very important difference: Windows does not cache the actual credentials, only a hash used to verify the password. This means even compromising the stored information does not give access to any domain credentials. Reference.

DisableDomainCreds controls if the actual credentials are cashed so a user can access domain resources without re-authenticating during their session. If you enable this policy, a user will be force to re-type their password every time they access a network resource, e.g. a network share. This functionality stores the actual credentials. Reference.

Two answer your question: No, these are two different mechanisms with different goals.