Cached credentials in ActiveDirectory and setting up machines

Solution 1:

I'm not aware of a way to push cached credentials out, and that would mean the word "cached" was poorly chosen, if such a way existed.

What about putting LogMeIn or any other remote control software on each computer before it goes out the door and having each user remotely log on to their machine before you send it out?

In my experience, the best way to do this is to not join the remote machines to the domain, but instead make a local user account and a local admin account on each machine. IT documents the local admin password and gives the user the local user password. This scenario works best with VDI and/or cloud services. Another workaround is to ship out preconfigured hardware VPN endpoints with each computer so each computer is basically on the LAN when the user logs on.

One big issue with caching credentials on 100% remote computers is if you have any password expiration policy (which you should), it can become virtually impossible to keep the cached credentials synced with the current ones, after the first expiration comes around. Best case scenario is end-user confusion, worst is inability to authenticate.