What changes are applied to a client when it joins an AD domain?

How is a domain member supposed to behave when disconnected to the network? Are users able to login? Will domain user policies still apply when off network?

If you know of a comprehensive resource that provides a comprehensive introduction to Active Directory, please post them.


3 Answers 3


The reason you can still login is because your account is cached on the computer. It is in fact supposed to work that way. Otherwise you'd never be able to use a laptop off the network without having a local account on it. Which in an enterprise would be a nightmare.

When you log into the domain the first time a bunch of information about your account and it's privileges along with any Group Policy Objects (GPOs) get configured. That is why the first login takes so long.

Joining a computer to an AD domain creates an account in the domain for the computer. This allows the computer to exist as a controllable, configurable, authenticated, individual in the domain. This means you can force policies about everything from desktop appearance to windows updates to anything configurable in windows to the client, and it can be changed relative to the user logged into the client as well.

Here is Microsoft's documentation on how login works with 2003 technet article about login


When a computer is joined to a Windows domain, all sorts of things happen. The most important ones:

  • User accounts in the domain become valid users on the system and can logon to it (unless restrictions apply).
  • Domain administrators acquire administrative rights on the system.
  • The computer itself gets an account in the domain, and uses it to authenticate against other computers.
  • Local user accounts remain active and can stil be used to logon to the system; they're not recognized by any other computer in the domain.
  • The computer name gets registered in the domain DNS (if it supports dynamic updates, which it should).
  • Group Policies defined in the domain and targeted to computers affect the system.
  • Group policies defined in the domain and targeted to users affect any domain user who logs on to the computer.

When the computer is member of a domain but can't connect to a domain controller, it can't validate user credentials, so any domain logon is going to fail; the exception is the last logged on user, which is by default cached and remembered, and can still succesfully logon. So, if the last logged on user was DOMAIN\UserA, a disconnected logon with the same user account will succeed, but a logon with, say, DOMAIN\UserB will fail. (This behaviour is configurable via policy).

Group Policies remain applied even in a disconnected scenario.

  1. The client becomes a domain computer, rather than a standalone workgroup comptuer
  2. You can still log into a workstation when you pull the network cable out due to a setting imposed by Group Policy. This setting (Computer-Policies-Windows Settings-Local Policies-Security Options) called Interactive Logon: Number of previous logons to cache (in case domain controller is not available) causes this behaviour, and it is by design.
  3. When you unplug the cable, if a user logs in with a domain account that has previous logged into that workstation, the machine will restore the last set of Group Policies it had when the domain controller was available.
  4. Cached credentials security in Windows

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.