Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our remote users had his domain account password expire, so he logged onto a terminal server in the same site as the RRAS server he uses for RA VPN to reset his password. He stays connected 24/7 to RRAS, there are two DC's in the same site, and yet his PC still thinks his password is his old password - it has been several days and it still does not realize that his password has changed.

How can I force his PC to "get" the new password from the DC? I know that if he were to physically plug his PC into one of the domain networks it would be updated within minutes...

share|improve this question
up vote 1 down vote accepted

I am going to answer this without explaining kerberos, because it would make this rather long, but please read up on how it works and how windows uses it.

Workstations cache passwords indefinitely and use the cached passwords whenever they aren't able to get to AD, to make a long story short.

Locking a computer and unlocking it with the new password, while it is connected to the domain, will cause the cache to be updated (and the session to have a current "copy" of the authentication). This is useful when they remain logged in while domain connected, and the domain user's password is changed on another computer in the domain.

If the computer is not authenticating to the domain for whatever reason, it needs to do so directly and online.

The password is not "synced", and the DCs do not "push" them to workstations.

share|improve this answer
Brilliant - that worked. I'll read up on Kerberos. – tacos_tacos_tacos Dec 15 '13 at 7:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.