If I disable a computer account in AD, am I not supposed to be able to login to the domain using this computer?

I tested this, I have a computer joined to the domain (Windows 10), I disabled the computer account and I rebooted the client machine and then I attempted to login to the computer with a domain user account, it worked.

My thinking is, I shouldn't be allowed to login using the disabled computer even if I am logging in with valid user credentials because the computer account is disabled.

I can understand if the computer was not on the network, it wouldn't be able to contact the AD for updated information and as such I would still be able to login as a domain user because of cached credentials, etc.

I tried rebooting the computer, resetting the computer account, disabling/enabling it, etc.. somehow I am still able to login to the domain using this computer!!

What I want is if the computer account is disabled that NO ONE can login using that computer to the domain.

The idea is, I want to clean up our Active Directory computers by disabling those that have a LastLogin date older than 90 days.. with some assurance that if I do this and those disabled computers were plugged back into the network that they cannot login even if you are trying to login with valid domain user credentials because the actual computer account is disabled.

  • 1
    How long did you wait between disabling the computer and trying to log in? Jan 20, 2016 at 21:51
  • Initially I tried after a few minutes, then after 20 minutes again and no go.
    – user146882
    Jan 20, 2016 at 21:54
  • 2
    Disable cached credentials, reboot the computer and see if that changes the result.
    – Ryan Ries
    Jan 20, 2016 at 22:36
  • Hey Ryan, how do we disable cached credentials? Not sure what you mean.
    – user146882
    Jan 20, 2016 at 22:47
  • Hi, it's a Group Policy setting - see answer below or itprotoday.com/security/domain-credential-caching
    – Minkus
    Mar 6, 2020 at 10:49

1 Answer 1


When you disable a computer in Active Directory, you're basically disabling the computer account. I suspect that the computer is passing authentication requests to a domain controller other than the one you disabled it on, and that information hasn't replicated yet.

It's also possible that you have some kind of larger replication problem in Active Directory itself, but it's hard to say based on the information in your post.

Edit: Ryan's suggestion to disable cached credentials. This is an option in group policy:

Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Interactive logon: Number of previous logons to cache.

enter image description here

(You might have to reboot or gpupdate /force to get that to take effect.)

  • Our replication is healthy, we are a small shop with 3 DC servers (2 local and 1 remote), the disabled status shows on all 3. I suspect some kind of caching is in place but I am not sure how to verify.
    – user146882
    Jan 20, 2016 at 22:47
  • 1
    I think Ryan is right that it's cached credentials. I've updated the answer to reflect that. Jan 20, 2016 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy