Symptoms
Symptoms may vary but can include the following:
Errors such as "Access denied" when attempting to access a particular resource or run certain commandsUnexpected prompts for a username and passwordAccount lockouts that appear to be randomErrors or warnings indicating authentication failures in the event logs of an affected system
If these symptoms arise shortly after a user's password is changed, stored credentials are a likely cause. In addition, the following warning in the System event log is a sure sign of a stored credential with invalid information:
Event ID: 14
Source: Security-Kerberos
Description:
The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer.
To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential .
Cause
A credential stored in Credential Manager has an invalid username or password.
Resolution
Credential Manager is an integrated password manager on Windows systems. To use it to determine whether a stored credential is causing the issue, perform the following steps:
Launch Credential Manager at an elevated command prompt from the control panel or by running the command:
rundll32 keymgr.dll,KRShowKeyMgr
If warning event 14 is present in the log, select the credential matching the credential specified in the event.If warning event 14 is not present, examine the stored credentials. Windows credentials are more likely to be relevant to the issue than Web credentials.Once you have selected a credential, click Remove to delete it or Edit to change it. When editing a credential, specify the correct username and password, then click Save to confirm.
Note: Credential Manager may not display all credentials stored on the system when run in a user context, even when using an administrative account. Running it in the SYSTEM context reveals all stored credentials. This is done using PsExec or an equivalent tool.
