If one has a bunch of Windows machines which will be used remotely and off-domain (at first), is there a way to presynch the usernames and passwords from Active Directory so the users may login via cached credentials without having to use the domain first?

(We have users in remote areas and ship machines to them - and there's talk about using Active Directory and its domains rather than local credentials. These machines then eventually connect via cellular & VPN or over POTS dialup, but not initially, and certainly not at first log in, either - they often have to do work in a disconnected state first.)

  • Only with MDT and a script to reset the preconfigured password, would this be possible. This would also put that credential at risk it the system is intercepted.
    – Jim B
    Jun 22 '15 at 20:35
  • Hi Jim, thanks for the answer. Could you expand upon this a bit more? What preconfigured password and when is it reset, etc.? Jun 23 '15 at 12:43
  • I'll add in a mre detailed answer
    – Jim B
    Jun 24 '15 at 14:47

I'm not aware of a way to push cached credentials out, and that would mean the word "cached" was poorly chosen, if such a way existed.

What about putting LogMeIn or any other remote control software on each computer before it goes out the door and having each user remotely log on to their machine before you send it out?

In my experience, the best way to do this is to not join the remote machines to the domain, but instead make a local user account and a local admin account on each machine. IT documents the local admin password and gives the user the local user password. This scenario works best with VDI and/or cloud services. Another workaround is to ship out preconfigured hardware VPN endpoints with each computer so each computer is basically on the LAN when the user logs on.

One big issue with caching credentials on 100% remote computers is if you have any password expiration policy (which you should), it can become virtually impossible to keep the cached credentials synced with the current ones, after the first expiration comes around. Best case scenario is end-user confusion, worst is inability to authenticate.

  • Thanks for your information, Todd. "Cache" is how it was first described to me, and I realize after reading other things that is in fact a misnomer. I will raise the point about perhaps having users log in as the machine is set up for them. Jun 22 '15 at 19:34
  • 1
    Oh, funny, from my understanding of how it works, "cached" is a very good word to describe it. I only meant that if it were possible to push the credentials out without the user logging on once, then that would not be the same as caching them. Jun 22 '15 at 19:51

You would not want to push in a cached credential (which by it's very nature can't be pushed per se) however what you can do for new deployments is to have a post deployment script run that logs in as the user (potentially using a random password generated and set by the task sequence using the proper credentials). The new random password would be set to expire and transmitted separately so that it would be valid until the user connects to the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.