16

Scenario:

  • While my DC is running, I log into an arbitrary machine.
  • I stop the DC
  • I log off the arbitrary machine. Let's bounce it for good measure, too.
  • When the machine comes back up, I can still login with my domain credentials even though DC is down

Why and how?

Is there some sort of local credential cache in play on the "arbitrary" machine? My password was somehow hashed and stored for the future in CASE the DC blows up or is down?

Would the same process work if I attempted to login to a box that I had never logged into before while the DC is down?

1
  • 1
    Just an interesting, related point: unplugging a network cable is one way to emulate "the DC being down". I'm not sure if this has changed in recent years, but since the user lockout policy is implemented by the DC, you can get infinite attempts at guessing the cached credentials by simply unplugging the network cable.
    – Daniel B
    May 22, 2014 at 9:09

3 Answers 3

34

By default, Windows will cache the last 10-25 users to log into a machine (depending on OS version). This behavior is configurable via GPO and is commonly turned off completely in instances where security is critical.

If you tried to log into a workstation or member server that you had never logged into while all of your DCs are unreachable, you would get an error stating There are currently no logon servers available to service the logon request

3
  • 3
    The credential caching is done for a variety of reasons, but among the most notable is the case of laptops. The CEO will be very unhappy if (s)he's unable to work while (s)he's in the air and unable to connect to your network, so the login is cached to allow him/her to still log in to their computer.
    – user24313
    May 21, 2014 at 21:57
  • 1
    It's common to need to login to the OS interactively prior to initiating a VPN connection. If login is impossible without live access to a DC, and a DC is only available via VPN and a VPN is only available after login, you have a nasty catch-22. Cached credentials is an effective solution to that.
    – Brandon
    May 22, 2014 at 0:58
  • @Brandon that they are. I wasn't recommending everyone disable it, I was simply noting that it is common where security is critical since it will prevent against an offline brute force attack. The solution to the VPN issue is to connect on startup using device certificates rather than post-logon with user/pass.
    – MDMarra
    May 22, 2014 at 1:00
3

Yes, your credentials are cached on each machine you log in to. If you had not logged in to a given machine before the DC went down, you would not be able to log in because your credentials would not be available.

2
  • 8
    This is done to avoid unnecessary network usage if you log in to a given machine frequently. - this is not true. If there are DCs available to authenticate the logon, they will regardless of whether that user's creds are cached or not on the local workstation or member server. Cached credentials are only used when the workstation or member server is unable to contact one or more domain controllers for authentication. Common scenarios where this happens include laptops being taken off-network, DCs being unreachable due to a network outage, or any other interruption to service.
    – MDMarra
    May 21, 2014 at 17:55
  • Ok, I've modified the answer to remove the incorrect information.
    – John
    May 21, 2014 at 18:03
-2

It is also worth noting that the DC and client box sync logins periodically as part of group policy operations, but only while they're both online.

For example, you might log into your workstation (Alice) and disconnect it from the network, then log into a second workstation (Bob) and change your login's AD password (via ctrl-alt-del) from Bob. The password is updated instantly on Bob and the DC (Charlie), but is still the old value (cached) on Alice.

If you reconnect Alice to the network, after a moment or two you'll likely get a taskbar bubble notification saying "Windows needs your current credentials". This is a result of Alice and Charlie doing the period group policy sync. Entering your new password will validate your entry against Charlie and update the cached credentials on Alice.

2
  • 3
    It is also worth noting that the DC and client box sync logins periodically as part of group policy operations, but only while they're both online. sigh this has nothing to do with Group Policy. As soon as you need access to a network resource and your cached credentials are in use, it will require you to authenticate. There is no "password sync" or anything like that, especially not from GPO. You likely see this right away because you have persistent drive mappings or an Exchange mailbox open, or something like that which needs your credentials almost immediately.
    – MDMarra
    May 21, 2014 at 18:15
  • 1
    Thank you for pointing out his flaw regarding Group Policy. I should also point out that it has very little to do with syncing passwords up with each other and more to do with new tickets/key pairs being requested/issued. See this if what I just said didn't make sense. msdn.microsoft.com/en-us/library/windows/desktop/… You likely had something like Outlook or the drive mappings open as MDMarra mentioned as these will immediately try to authenticate but since they have an old ticket/key pair, they will have to be granted a new one before they can proceed May 21, 2014 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .