0

Windows 2008r2 domain. windows 7 client. After locking user domain account, user can login domain pc with locked account once, at the same time user have no access to netwrok shares, only local files. I expected that after locking domain account user cann`t login domain pc

1

1 Answer 1

2

This is due to the client computer caching the user's credentials. With this setting enabled, the client computer stores X number of logons locally, and when the user tries to logon again, client computer checks the password against a locally-stored hash, rather than contacting a domain controller.

If you want to disable local credential caching, you can (and it's even advised as a best practice by Microsoft), but you better be sure you know the local Administrator credentials, and be aware of the implications of not caching credentials - particularly, users won't be able to logon to their computers unless they're already connected to a network where they can access a domain controller. So, for example, if you have remote or traveling employees who need to access the corporate network with a VPN client, you might want to leave credential caching in place for those users' machines.

3
  • I thought that the cache is used only if there is no connection with the domain controller.
    – Dreddko
    Jan 30, 2014 at 7:05
  • I can not disable the caching because we have remote vpn network segments. Maybe you have a best practices how to block user accounts?
    – Dreddko
    Jan 30, 2014 at 7:11
  • @Dreddko The way we do it (and the way I've always seen it done, FWIW) is to apply a different policy to the "Remote"/VPN users. Current workplace puts them in a different OU that has inheritance blocked (and contains VPN-specific policies), but anything that lets you filter GPOs is just fine. Jan 30, 2014 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .