0

One of our domains has two Windows 2008 r2 servers: a domain controller which also holds all the FSMO roles and member server. If I rename a domain user, then use Windows explorer to look at a file located on the DC to which the renamed user has rights, I see the new username right away. If I login to the member server and look at a file to which the renamed user has rights, at first I see the old name for the user. If I wait a couple of minutes, I then see the new name for the user.

It seems there must be some type of caching of usernames going on on the member server. Can anyone tell me what type of caching this is and if it can be disabled or have the paramaters changed. Or is it possible that something is not configured correctly or is corrupt and that is why I am seeing this behavior?

Improve this question
2
  • 2
    Why do you want this behavior changed? Access is granted based on the SID, which does not change during an account rename. Showing the name instead of the SID is just a convenience to the admin of the server. It shouldn't actually cause any problem. If every member server contacted a DC to get an updated display name every single time a file was enumerated, performance would be terrible.
    – MDMarra
    Jun 28, 2013 at 19:03
  • First, please re-read the question. I did not ask that the display name be updated every time a file is enumerated. I asked to be able to configure that interval so that I might be able to choose the tradeoff. There are thousands of things that one might be able to configure on a windows server where one can choose to trade off speed for memory, etc. I wasn't asking if this was a good idea in general, but rather simply how to make that configuration change. Secondly, I wasn't concerned about the user's access to the file, but the display of that information.
    – Itsme2003
    Sep 2, 2014 at 1:24

1 Answer 1

Reset to default
4

Yes, domain members do cache SIDs that they perform lookups on.

Yes, you can reconfigure the timeouts.

Try HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaLookupCacheRefreshTime for instance. There are additional related registry values in the TechNet article I'll link to at the end.

Keep in mind that by reducing this caching, you're increasing the amount of SID lookups that your domain controller will be processing.

Honestly, I don't think there's any good reason to do this, but there you go.

http://technet.microsoft.com/en-us/library/ff428139(v=WS.10).aspx

Improve this answer
1
  • I agree that in general cases there is no reason to do this. In this particular case, it will make double checking some network management scripting easier because I am using a third-party tool that only gives file ownership and security via the object name, not SID.
    – Itsme2003
    Jul 1, 2013 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .