I am looking for a way to stop account locks from getting cached on laptops. Here is an example for clarification:

We had a user who was working remotely over VPN. While working remotely, he accidentally locked himself out of his account by entering incorrect credentials too many times. Because he was on the VPN when this happened, the account lock moved onto his laptop. When he disconnected from the VPN and logged out of his computer, the lockout was cached. He then could not log into his computer until it was physically connected to our network inside of our office.

We are looking for a preventive measure that would prevent this from happening as we have a lot of people traveling who cannot always make it to the office the next day to hookup to the network and unlock the computer.


The best way to deal with this, short of firing and/or savagely beating all the users who are stupid enough to lock themselves out under such circumstances (and then disconnect and log off to make it worse) is to set up a local user account on the laptop they can log in with.

Worst case scenario, they can use that second account to work with if they're unable to get their laptop to update their domain account status, and best case, they can get the updated status down to their machine (probably with copious assistance from the helpdesk).

There's an older ServerFault question here with at least one method of syncing up the domain credentials with the computer's cached credentials - log in over VPN first.

  • That's what I figured, thanks! I just wanted to get a second opinion before I went with my assumption. – adivis12 Jan 15 '13 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.