Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My active directory account just got locked out. On a whim I unplugged the ethernet cord and turned off the wifi radio switch and I was able to log into my account. I plugged the ethernet back in and then tried to RDP to another computer on the network and got the "your account is locked" message. So I ctrl+alt+del locked my active desktop session again and tried to log in. once again got the "your account is locked" message. Then I unplugged the ethernet cord again and was able to log in to my session.

Is this intended design of active directory?

share|improve this question
3  
I'm surprised that neither answer points out that there are ways to disable this behaviour, if you want to. –  Damien_The_Unbeliever Apr 24 at 6:35

2 Answers 2

up vote 9 down vote accepted

Yes. With network connectivity you'll attempt a login to the domain and fail because your account is locked out. Without network connectivity you'll log on to your computer with cached credentials.

This is by design.

share|improve this answer
    
+1 for beating me to the punch... simple straight answer though, I like it... –  Brad Bouchard Apr 24 at 4:56
2  
Even if the last time i tried to authenticate with an active network connection the response was "your account is locked"? –  qntmfred Apr 24 at 5:55
    
@qntmfred Yup, that's exactly how it works. –  Shane Madden Apr 24 at 6:12
1  
It is indeed surprising that the cache does not get renewed during the failed login attempt and I can not phantom why this is so. –  David Mulder Apr 24 at 10:34
    
So your account gets locked out. You unplug your Ethernet cable and log in. Then you plug your Ethernet cable back in. How many new Kerberos service tickets do you think you're going to get to access network resources? (Hint: Zero) (Also, +1, cool question and good answer.) –  Ryan Ries Apr 24 at 12:58

To add to joeqwerty's answer, this is by design for people who may travel or be away from the domain without any access, be it through VPN or other method, back to the local domain. It is also by design for several other reasons, but your credentials do get cached and then used in this instance. When you unplug your ethernet cable you probably noticed that it took a lot longer for the login to work because it first tries to go out to hit a DC; three times actually. Once it fails to reach a DC it logs on with cached credentials.

Something else to note that might be of help is that it will cache the last two sets of credentials, meaning you and one other AD account.

share|improve this answer
1  
The default is actually to cache the last TEN credentials used, not TWO (CachedLogonsCount) - blogs.technet.com/b/instan/archive/2011/12/06/… –  BlueCompute Apr 24 at 9:17
    
Thanks for the correction... I may have been going off of a GPO that we had set on our local machines at our office that was set to 2 and somehow put that in my head as default... –  Brad Bouchard Apr 24 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.