Our users work in terminal services domain environment. It happens sometimes that users are logged on multiple servers. When security policy forces user to change the password, he changes it on one server (one which would first find out that password has expired, usually when the user logs on new server), while the other sessions are still logged, but with already invalid credentials. From now, all other logged sessions will prevent this user from accessing network services - mapped drives are disconnected, network printers are disconnected. That's normal behaviour, and it's not the problem. But it's confusing for a user.
So i figured it out, it would be nice to inform a user, after he change it's password, that his other sessions are no longer valid and he should re-logon. I was thinking about a small helper process which would run with user privileges all the time, checking if ... And that's the problem.
I know, that something probably happens to access token when the user changed the password on other server. As far as i know access token is after logging only way to determine if a user has access to network ressources. But how to read this specific information? Access tokens have many information structures: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379626(v=vs.85).aspx Maybe somone has better experience with these structures?