However, when a user forgets the password and it is reset in Active Directory by the IT help desk, the cached domain credentials in the users machines are rendered inaccurate. The above allows a generic profile on a conf room PC to log in and access Teams and Office docs, but no employee O365 creds are saved as far as I could see. This cached credential makes it easy for users to log on to their Windows machines when they have no way of reaching the domain controller for authentication. 'If you are going to use the conf room PC, don't use Outlook' << This isn't typical.

I worry that after an Office update or a repair by another tech for another reason, outlook.exe will be available again, but this particular client is good about keeping their employees responsible for those kind of actions. There are other ways of locking this down I will try later.

I renamed Outlook.exe to to make it difficult/unable to open.

Set Browser to not offer to save any credentials and clear browser cache on exit.

I also recommended they just use the Teams Web App instead for hosting/attending Teams meetings. This did not save the Teams profile on the PC.

Walked employees through signing in to Teams with the 'No, sign in to this app only', then signing out when finished.

Also a ProPlus (O365 enterprise) license can be activated across an entire PC. If they had a stand-alone license I could have activated it for the PC instead using a monthly O365 business premium license.

Activate O365 office using a non-employee license they already had.

On the next screen, un-check everything but Passwords Note: For Windows 8 and 10, Internet Explorer also stores these credentials in the Credential Manager. They had a generic Office 365 business premium license which is the only thing that made this possible. To clear cached user credentials in Internet Explorer: Open Internet Explorer.

The following steps is what I did as a workaround.

Files in Excel and Outlook profiles could be opened without credentials).Ĭlearing the profile after each user signout was not acceptable to the client (i have my opinions about that, too), but absolutely would have been best practice. The issue was that employees would sign in to their O365 account which cached their account/creds in Windows 10 and if another employee used a community PC previously signed in O365 accounts would be accessible (Ex. I did not find a way to do exactly what the client wanted, but the following works for them.

Clear cached credentials windows 10