Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are running Windows Server 2008 with Active Directory and have 10 client PCs connected to a domain.

When the server is on, the user gets authentication from it, but when the server is off the users still get authentication to logon to the domain.

We don't have an additional Domain Controller in the network too, so how is it possible for the clients to get authentication when the DC is turned off?

share|improve this question

2 Answers 2

If a user has logged on to that machine previously then there credentials will have been cached locally, as khaled states. If that user has never logged on to that machine before or their cached credentials have expired, they will not be able to login without a DC to authenticate with.

share|improve this answer

The Windows client can still log you on (even when the DC is down) because it keeps a cache of the logon information.

You can try to disable the login cache by modifying registry entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
REG_SZ: cachedlogonscount
Value: 0
share|improve this answer
    
Do these cached credentials allow access to network resources (like a file share on a server that is not the Domain Controller)? It doesn't appear that the OP is using such resources, but it would be helpful information. –  poke Jan 29 '11 at 18:49
    
To the OP: don't do this on laptops, or they'll struggle to do anything useful when working remotely and the VPN won't work because there's no internet link :-) –  DutchUncle Jan 29 '11 at 23:29
    
You're also much better off if you manage these kinds of settings via a GPO. Then you don't have to worry about which workstations have had the registry entry set or not, and any new workstations you add to the network will get the same settings automatically. –  Ryan Fisher Feb 1 '11 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.