Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Business has issued Windows 7 laptops to users who are out in the field for long periods of time where the domain controller is not accessible. There may even be some users who never connect to the domain again since the day their laptop was issued. Would their Active Directory accounts ever expire?

There is an app in development that may require periodic reconnecting to the AD again but I am concerned is it possible AD credentials can expire?

share|improve this question
Do you mean whether user account become disabled automatically after certain time of inactivity? – Volodymyr M. Nov 15 '12 at 14:04
Mind explaining why you down voted my answer? – HostBits Nov 16 '12 at 11:02

User/computer passwords CAN expire, cached credentials - No (they will remain indefinitely, it doesn't matter at all if the user or computer account passwords are beyond their expiry date, as long as the credentials have been cached once, and there is no connection to a domain controller, they will never expire).

How long does Windows cache domain user passwords?

If you mean whether AD account can become disabled at some point of time in future automatically - the answer is NO, only due to some conditions listed here.

share|improve this answer

A disconnected computer or user will not "expire" unless you tell it to. A computer or user object will happily stay active in your AD forever if you let it.

Keep in mind that user accounts are subject to your domain's password policy, so a cached account's password might need to be updated when a disconnected user needs to connect to a network resource, but both the user and computer accounts themselves will be fine.

If you need a way to have a disconnected user update their AD password, and you don't have a VPN but you do have Exchange, I usually remind people that they can change their network passwords via OWA.

share|improve this answer

A user account that is expired and a user account that is disabled and a password that is expired are three very different things. A user account never expires without administrative action, whether the user is regularly logging on to the domain or not.

share|improve this answer

If the workstations won't connect to the physical LAN again, I don't see a need for having them on your domain in the first place. With that being said, when your user logs into their pc with their domain credentials when they are on the physical LAN and have access to the DCs, their credentials will be cached on the laptop. They would then be able to log into the laptop while off the domain with the cached credentials. To my knowledge, those cached credentials won't expire unless the workstation was able to communicate with a DC from the domain again and the user's current password had expired, was changed, or the account had expired, or was removed.

share|improve this answer
I didn't downvote, but I used to do this so that Bitlocker keys could be backed up to the AD object and recovered later by a domain admin if the disconnected user ever damaged the laptop and needed the recovery key. – MDMarra Nov 15 '12 at 14:27
@MDMarra I agree, that would be a use case where having them on the domain makes sense. As it stands with the current question though, a situation like that isn't mentioned. Haters gonna Hate. – HostBits Nov 15 '12 at 14:33
Just not to be a suspect: I didn't downvote without a reason as well. See my profile for the number of downvotes :). Perhaps, it can be trusted. – Volodymyr M. Nov 15 '12 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.