"local" and "remote" login credentails for Windows domain accounts

Question

After the first login with a domain account (in my case Win10 as client and WinServer2016 as domain controller) a profile will be created on the local PC. This way even I'm not connected to the domain controller I can log on with the same credentials.

Sometimes, I assume because there is a problem with the LAN connection, Windows seems to use the local credentials.

Is there a way to check if Windows logged in through the "local login credentials" or logged in through the domain controller? Preferably through the event log so I can see past logins as well but I take any solution. Thanks!

Answer 1

Run klist immediately after logon. If the system was able to reach a domain controller (KDC), you will have a Kerberos TGT (labelled Server: krbtgt/FOO in the list) and probably several per-service tickets.

Note that if network access returns sometime later, then Windows will automatically acquire a TGT whenever it is needed (as long as your logon password is still valid). So if you're inspecting a session that is no longer fresh, then the presence of a Kerberos TGT depends on whether it was used recently for authenticating connections and won't indicate anything about cached credentials.