When a domain user successfully logs on to a domain-joined computer, the user's domain credentials are cached so that the user can logon again if the domain controller is unavailable (eg the computer is disconnected from the network).

If the domain-joined computer is running a Windows service as a domain service account and the computer restarts, will the service start if there is no domain controller available?

Secondly, if the afore mentioned service attempts to authenticate to and communinicate with a second local service, will it succeed?


I'm 90% certain that cached credentials apply only to interactive logins.

  • My experience as well, like MSSQL or Exchange services in domain user context not starting if there're no DCs around at all on bootup... though YMMV – Oskar Duveborn Aug 23 '10 at 19:31
  • I'm 99.9% certain it's interactive logins only. – Chris S Aug 23 '10 at 19:52
  • @Oskar: all Exchange services usually run as LocalSystem, LocalService or NetworkService; they don't start if there's no DC around because Exchange relies quite heavily on Active Directory, not due to authentication failures. Just wanted to point this out :-) – Massimo Aug 23 '10 at 19:56
  • Yeah I was gonna remove the Exchange mentioning from the comment and then forgot... ^^ – Oskar Duveborn Aug 24 '10 at 7:17

It is for interactive logons only. See the MS KB.


Cached credentials applies to services as well.

Source: https://technet.microsoft.com/en-us/library/hh994565(v=ws.10).aspx


As per https://technet.microsoft.com/en-us/library/hh994565(v=ws.10).aspx it is only for "Account passwords for Windows services that are configured on the computer". Not for all applications.

LSA secrets on the hard disk drive

A Local Security Authority (LSA) secret is a secret piece of data that is accessible only to SYSTEM account processes. Some of these secrets are credentials that must persist after reboot, and they are stored in encrypted form on the hard disk drive. Credentials stored as LSA secrets might include:

Account password for the computer’s AD DS account

Account passwords for Windows services that are configured on the computer

Account passwords for configured scheduled tasks

Account passwords for IIS application pools and websites

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.