Windows 2008r2 domain. windows 7 client. After locking user domain account, user can login domain pc with locked account once, at the same time user have no access to netwrok shares, only local files. I expected that after locking domain account user cann`t login domain pc


This is due to the client computer caching the user's credentials. With this setting enabled, the client computer stores X number of logons locally, and when the user tries to logon again, client computer checks the password against a locally-stored hash, rather than contacting a domain controller.

If you want to disable local credential caching, you can (and it's even advised as a best practice by Microsoft), but you better be sure you know the local Administrator credentials, and be aware of the implications of not caching credentials - particularly, users won't be able to logon to their computers unless they're already connected to a network where they can access a domain controller. So, for example, if you have remote or traveling employees who need to access the corporate network with a VPN client, you might want to leave credential caching in place for those users' machines.

  • I thought that the cache is used only if there is no connection with the domain controller. – Dreddko Jan 30 '14 at 7:05
  • I can not disable the caching because we have remote vpn network segments. Maybe you have a best practices how to block user accounts? – Dreddko Jan 30 '14 at 7:11
  • @Dreddko The way we do it (and the way I've always seen it done, FWIW) is to apply a different policy to the "Remote"/VPN users. Current workplace puts them in a different OU that has inheritance blocked (and contains VPN-specific policies), but anything that lets you filter GPOs is just fine. – HopelessN00b Jan 30 '14 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.