Windows 2008r2 domain. windows 7 client. After locking user domain account, user can login domain pc with locked account once, at the same time user have no access to netwrok shares, only local files. I expected that after locking domain account user cann`t login domain pc
This is due to the client computer caching the user's credentials. With this setting enabled, the client computer stores X number of logons locally, and when the user tries to logon again, client computer checks the password against a locally-stored hash, rather than contacting a domain controller.
If you want to disable local credential caching, you can (and it's even advised as a best practice by Microsoft), but you better be sure you know the local Administrator credentials, and be aware of the implications of not caching credentials - particularly, users won't be able to logon to their computers unless they're already connected to a network where they can access a domain controller. So, for example, if you have remote or traveling employees who need to access the corporate network with a VPN client, you might want to leave credential caching in place for those users' machines.