Cached Logon Script

Joshua

Updated: August 01, 2026 02:59

Objective

To provide an Automox Worklet that remotely modifies the Windows Cached Logons Count registry setting (CachedLogonsCount), allowing administrators to reduce or disable cached domain credential logons on off-network or terminated user endpoints.

Overview

Windows caches previous domain logon credentials locally so users can log in when the endpoint cannot establish a connection to an Active Directory Domain Controller.

In security scenarios—such as offboarding a terminated remote employee or hardening isolated devices—administrators may need to set CachedLogonsCount to 0 (or another specified threshold) to prevent unauthorized local logons using stale domain credentials.

Use Cases

Remote Employee Offboarding: Immediately prevent a terminated user from logging into an off-network laptop using cached domain credentials.
Security Hardening & Compliance: Enforce organizational security policies that restrict or disable cached interactive logons on sensitive endpoints.

Worklet Setup Instructions

1.Create a New Windows Worklet:

In the Automox console, navigate to Policies > Create Policy.
Select Worklet and set the OS target to Windows.
Enter a descriptive policy name (e.g., Windows - Set Cached Domain Logons Count to 0).

2.Configure Evaluation Code:

Paste the following PowerShell script into the Evaluation Code block. This script checks the current registry value and returns 0 if compliant or 1 if remediation is required:

PowerShell

# Automox Worklet Evaluation Code: Cached Logons Count

$scriptblock = {
    $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
    $regProperty = "CachedLogonsCount"
    $desiredValue = "0"

    # Retrieve current value for comparison
    $currentValue = (Get-ItemProperty -Path $regPath -Name $regProperty -ErrorAction SilentlyContinue).$regProperty

    # Exit 0 if compliant, Exit 1 if remediation needed
    if ($currentValue -eq $desiredValue) {
        exit 0
    } else {
        exit 1
    }
}

# Execute in 64-bit PowerShell context
& "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptblock

3.Configure Remediation Code:

Paste the following PowerShell script into the Remediation Code block to update the registry key to your desired value:

PowerShell

# Automox Worklet Remediation Code: Set Cached Logons Count

$scriptblock = {
    $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
    $regProperty = "CachedLogonsCount"
    $desiredValue = "0"

    try {
        Set-ItemProperty -Path $regPath -Name $regProperty -Value $desiredValue -ErrorAction Stop
        Write-Output "Successfully updated $regProperty to $desiredValue"
        exit 0
    } catch {
        Write-Error "Unable to update $regProperty: $_"
        exit 1
    }
}

# Execute in 64-bit PowerShell context
& "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command $scriptblock

4.Assign Device Groups & Execute:

Assign the Worklet policy to your target Windows Device Groups and run the policy manually or on a scheduled cycle.

Key Operational Considerations

64-bit Execution Wrapper: The code uses $env:SystemRoot\sysnative\... to ensure the registry modification occurs within the native 64-bit registry hive (HKLM:\SOFTWARE\...) rather than being redirected to the 32-bit WOW6432Node path.
Default Windows Value: The default Windows value for CachedLogonsCount is typically 10 (or 2 on older systems). Setting this value to 0 disables cached domain logons entirely.

Was this article helpful?

0 out of 0 found this helpful