Can’t get rid of cached credentials Internet Explorer

The other day I had a colleague call me with a pesky credential issue using Internet Explorer.  He was connecting to an internal only web server that uses Windows authentication to validate logins to a secure IIS site running in IIS 7.5.  He could not figure out why prepopulated credentials were coming up in the login box.  My first thought with this issue of course is browser cache – form data, user accounts, passwords, etc.  So I suggested that he clear the history including passwords from the browser.  Well, the first time he tried it it didn’t work, but then he realized he hadn’t selected t also clear the passwords, so I figured the resolution was still valid.

However, after clearing everything in the IE history including passwords, the login form was still populating, even after clearing and even closing out Internet Explorer.  Then I happened to remember about Credential Manager within Windows.  Credential manager will show you all cached credentials that Windows thinks that it has saved both for web as well as Windows authentication.

To get to Credential Manager, just navigate to control panel >> All control panel items >> credential manager.

Non intuitively, the login form credentials using Windows authentication in IIS is not stored in the Web Credentials but rather the Windows Credentials section of the manager application.  If you have a user account and password that is not clearing out as you expect even with clearing browser cache or resetting Internet Explorer settings, the Credential Manager is a powerful tool to take control of your cached user accounts and password management for a workstation.

In our case, sure enough we found the offending credential entry under Windows Credentails which IE was hanging onto trying to access the internal web server.  After removing the entry from credential manager, the browser once again correctly asked for the credentials without cached credentials prepopulated.

It is a very handy tool to use for troubleshooting cases like this when you see no other reason why a browser or the machine in general is holding onto a set of credentials.  Be the kung fu master of credentials with this powerful builtin manager.