samba - Mar 2010 - winbind offline logon = yes - stored credentials questions

If I set winbind offline logon = yes in my smb.conf file and I have my
Linux box authenticating directly against an AD controller, where, and
how, does samba store the user's credentials?   And are the
credentials encrypted?  If yes, use what scheme?  I could read more on
this, too, but for how long are they cached?

Thanks.

Scott