The short scenario: The help desk got a call from our senior accountant that her various drives were not mapping and she had to keep entering her login credentials.
Two things to also note: The cached credentials were to another account, not her domain login account, and this happened during COVID-19 when people were switching between working at home and at the office. In this case, she was in the office that day.
The help desk employee could not figure out why this was happening and contacted me and I was also off site. Not sure what was happening, I went back to the beginning. I started by making sure her Active Directory account had not changed because her 5 network drives are mapped via a batch script at log in. I then had the help desk make sure she was logging in with her domain account. We then followed that up by changing her password since I needed to rule out any possible mismatch that may have happened while she was working from home.
The key to solving this issue was that when she was prompted to provide her credentials to connect to the drive, the wrong account was presented, indicating that it had be entered incorrectly at some point and was being cached. The help desk also reported that one of the network drives connected at log in then disconnected prior to the prompt being displayed. In short – her AD account was functioning as it should but the computer was overriding the drive mapping.
The walk through. Open a command prompt as the logged in user. Verify the proper account:
whoami
What drives are mapped:
net use
Show the credentials that the computer has cached:
rundll32.exe keymgr.dll, KRShowKeyMgr
This popped up a window and we could see the server name and the incorrect user account. We deleted the server name entry and rebooted. All 5 network drives connected properly at user login.
While we didn’t test this, I believe we could have also gotten access to the stored credentials through windows settings by searching for “credentials”, credential manager, windows credentials.