3

We are running Windows Server 2008 with Active Directory and have 10 client PCs connected to a domain.

When the server is on, the user gets authentication from it, but when the server is off the users still get authentication to logon to the domain.

We don't have an additional Domain Controller in the network too, so how is it possible for the clients to get authentication when the DC is turned off?

2 Answers 2

7

The Windows client can still log you on (even when the DC is down) because it keeps a cache of the logon information.

You can try to disable the login cache by modifying registry entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
REG_SZ: cachedlogonscount
Value: 0
3
  • Do these cached credentials allow access to network resources (like a file share on a server that is not the Domain Controller)? It doesn't appear that the OP is using such resources, but it would be helpful information.
    – poke
    Jan 29, 2011 at 18:49
  • To the OP: don't do this on laptops, or they'll struggle to do anything useful when working remotely and the VPN won't work because there's no internet link :-)
    – DutchUncle
    Jan 29, 2011 at 23:29
  • You're also much better off if you manage these kinds of settings via a GPO. Then you don't have to worry about which workstations have had the registry entry set or not, and any new workstations you add to the network will get the same settings automatically. Feb 1, 2011 at 13:50
2

If a user has logged on to that machine previously then there credentials will have been cached locally, as khaled states. If that user has never logged on to that machine before or their cached credentials have expired, they will not be able to login without a DC to authenticate with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .