To disable cached credentials, you will need to modify the GPO settings which are being applied by the domain or organizational unit on the workstation:
Launch Control Panel, then select Administrative Tools, then select Local Security Policy.
In the left-hand pane of the console select Local Policies, and then select the appropriate folder for the option you wish to modify.
In the right-hand pane, right-click the policy you wish to modify and select Properties from the pop-up menu. The property sheet for that policy appears. Make changes as appropriate for the policy you are configuring.
Security Options
Security Options govern specific configuration options that are used to increase or decrease security on a given computer. These options are assigned to the computer, not users or groups, unlike User Rights Assignment. All users of this computer are subject to these policies. The following Security Options deal with authentication-related issues and are located in the Security Options folder under Local Security Policy. To modify a policy, double-click it and make the necessary changes.
Require domain controller authentication to unlock: Prevents a user from using cached credentials to log on to a computer that has been locked.
Setting that policy to ENFORCE will require a domain controller authentication before a workstation can be used. It can cause a laptop to be unusuable away from the office.
The cached credentials are stored under HKLM\Security, which by default the Administrators group does not have permissions for read access. Ususally only the SYSTEM account has full access.
