Sorry I took so long to get back to you.

They use cached domain credentials to logon to their systems.