Best method to figure out if someone is using cached credentials?


I'm attempting to write a script that will figure out if a user is
using cached credentials.

What I figured to do is find the logon server, and see if it is the
hostname of the PC, or not. if so, they aren't authenticating to a DC;
if not, they are using cached credentials.

The only problem is this will affect local users, who are obviously
authenticating to the PC itself as well.

Any way to tell if a user is using cached credentials?



Dim objShell, strRegKey
Dim strLogonServer, strComputerName

Set objShell = CreateObject("Wscript.Shell")
Set objEnvProcess= objShell.Environment("PROCESS")

strLogonServer = Right(objEnvProcess.Item("LogonServer"),
len(objEnvProcess.Item("LogonServer"))) - 2)

strComputerName = objEnvProcess.Item("ComputerName")

if strLogonServer = strComputerName then

msgbox "logonserver is the same"


msgbox "You have logged on locally. You may be using cached

End If