Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My active directory account just got locked out. On a whim I unplugged the ethernet cord and turned off the wifi radio switch and I was able to log into my account. I plugged the ethernet back in and then tried to RDP to another computer on the network and got the "your account is locked" message. So I ctrl+alt+del locked my active desktop session again and tried to log in. once again got the "your account is locked" message. Then I unplugged the ethernet cord again and was able to log in to my session.

Is this intended design of active directory?

share|improve this question
I'm surprised that neither answer points out that there are ways to disable this behaviour, if you want to. – Damien_The_Unbeliever Apr 24 '14 at 6:35
up vote 9 down vote accepted

Yes. With network connectivity you'll attempt a login to the domain and fail because your account is locked out. Without network connectivity you'll log on to your computer with cached credentials.

This is by design.

share|improve this answer
+1 for beating me to the punch... simple straight answer though, I like it... – Brad Bouchard Apr 24 '14 at 4:56
Even if the last time i tried to authenticate with an active network connection the response was "your account is locked"? – kenwarner Apr 24 '14 at 5:55
@qntmfred Yup, that's exactly how it works. – Shane Madden Apr 24 '14 at 6:12
It is indeed surprising that the cache does not get renewed during the failed login attempt and I can not phantom why this is so. – David Mulder Apr 24 '14 at 10:34
So your account gets locked out. You unplug your Ethernet cable and log in. Then you plug your Ethernet cable back in. How many new Kerberos service tickets do you think you're going to get to access network resources? (Hint: Zero) (Also, +1, cool question and good answer.) – Ryan Ries Apr 24 '14 at 12:58

To add to joeqwerty's answer, this is by design for people who may travel or be away from the domain without any access, be it through VPN or other method, back to the local domain. It is also by design for several other reasons, but your credentials do get cached and then used in this instance. When you unplug your ethernet cable you probably noticed that it took a lot longer for the login to work because it first tries to go out to hit a DC; three times actually. Once it fails to reach a DC it logs on with cached credentials.

Something else to note that might be of help is that it will cache the last two sets of credentials, meaning you and one other AD account.

share|improve this answer
The default is actually to cache the last TEN credentials used, not TWO (CachedLogonsCount) -… – BlueCompute Apr 24 '14 at 9:17
Thanks for the correction... I may have been going off of a GPO that we had set on our local machines at our office that was set to 2 and somehow put that in my head as default... – Brad Bouchard Apr 24 '14 at 14:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.