One of our domains has two Windows 2008 r2 servers: a domain controller which also holds all the FSMO roles and member server. If I rename a domain user, then use Windows explorer to look at a file located on the DC to which the renamed user has rights, I see the new username right away. If I login to the member server and look at a file to which the renamed user has rights, at first I see the old name for the user. If I wait a couple of minutes, I then see the new name for the user.

It seems there must be some type of caching of usernames going on on the member server. Can anyone tell me what type of caching this is and if it can be disabled or have the paramaters changed. Or is it possible that something is not configured correctly or is corrupt and that is why I am seeing this behavior?

  • 2
    Why do you want this behavior changed? Access is granted based on the SID, which does not change during an account rename. Showing the name instead of the SID is just a convenience to the admin of the server. It shouldn't actually cause any problem. If every member server contacted a DC to get an updated display name every single time a file was enumerated, performance would be terrible. – MDMarra Jun 28 '13 at 19:03
  • First, please re-read the question. I did not ask that the display name be updated every time a file is enumerated. I asked to be able to configure that interval so that I might be able to choose the tradeoff. There are thousands of things that one might be able to configure on a windows server where one can choose to trade off speed for memory, etc. I wasn't asking if this was a good idea in general, but rather simply how to make that configuration change. Secondly, I wasn't concerned about the user's access to the file, but the display of that information. – Itsme2003 Sep 2 '14 at 1:24

Yes, domain members do cache SIDs that they perform lookups on.

Yes, you can reconfigure the timeouts.

Try HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaLookupCacheRefreshTime for instance. There are additional related registry values in the TechNet article I'll link to at the end.

Keep in mind that by reducing this caching, you're increasing the amount of SID lookups that your domain controller will be processing.

Honestly, I don't think there's any good reason to do this, but there you go.


  • I agree that in general cases there is no reason to do this. In this particular case, it will make double checking some network management scripting easier because I am using a third-party tool that only gives file ownership and security via the object name, not SID. – Itsme2003 Jul 1 '13 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.