2

I have researched this thoroughly, and cannot find the answer I am looking for.

A company I recently left is going through a bankruptcy. They have already auctioned off most the IT equipment, including the server that was the domain controller. However, they still have the client workstations set up in the office. These computers have no network access and will not be able to reach the domain controller, but still belong to the domain. There are not local accounts set up aside from the local administrator account, and they do not know the password. They are wanting to know if they can still log in and access local files, quickbooks, etc...

Would someone still be able to log in using the last cached domain credentials? If so, is there a limit on how long those credentials will stay working?

The client workstations are running Windows 7 Pro, or Windows 8.1 Pro. The server that was once there, was running Active Directory 2008, not sure if that matters.

Thanks for the help.

4
  • I don't know the actual situation of the company (which seems dire indeed)... but they could at least have reset the local admin passwords using a domain admin account, before getting rid of the domain controller! – Massimo Mar 23 '16 at 16:07
  • Anyway, there are lots of tools around which you can use to reset the local Administrator password on a Windows machine; I suggest you use one of them ASAP, because users can get locked out of those machines if the domain is not available anymore. – Massimo Mar 23 '16 at 16:09
  • Yeah I just got a call from the owner today. I used to work in their IT department so he was trying to get my help. Apparently there was nothing he could to prevent them from selling the equipment before having a chance to get in and reset passwords and check stuff. – Alex Chance Mar 23 '16 at 18:19
  • This guy is not very tech savvy at all. So most likely he will end up wanting me or somebody else to go there and get into the machines, reset the passwords, or whatever it takes. It's a big mess though, so not sure if I even want to get into it.... Thanks for the info. – Alex Chance Mar 23 '16 at 18:19
4

My experience is the same as what others have said - if you have a PC with cached credentials and it can't connect to a Domain Controller, those credentials don't expire.

But...

An exception could be if they set a security policy to disable or limit credential caching. The default is to cache 10 sets of credentials, but this could be overridden. If it was set to 0, then they wouldn't be able to use cached credentials, or if it was set to a low #, e.g. 2, then only the last 2 accounts to log in would have their credentials cached.

And as one of the comments said, whoever is providing support to this company should use one of the many tools or tutorials to create a local admin account with a known password. By default, the Administrator account is only accessible in Safe Mode and is blank, so they could try that if they haven't already (although getting to safe mode in Win8 requires a tutorial of its own...).

2
  • Yeah I knew there were tools available for resetting the local admin password if it comes to that. I used to work in the IT department for them, but they currently don't have any IT staff or anybody that is technologically sound. I was trying my best to just give them advice and guide them without having to get my hands dirty. – Alex Chance Mar 23 '16 at 18:21
  • I told him to see if his cached credentials would work, and if they did to create a local account. He doesn't even know how to set up a local account, but I can probably guide him through it. I also wonder if the group policies that were in place are still in affect? Guess I can post another question in regards to that. – Alex Chance Mar 23 '16 at 18:22
0

Q: Would someone still be able to log in using the last cached domain credentials?

A: Yes.

Q: If so, is there a limit on how long those credentials will stay working?

A: Not that I'm aware of.

0

I don't know if (and i don't think that) cached credentials will be removed after some time.

Your problem will be the machine account password - this is refreshed periodicaly when the computer connects to the domain controler. If this password was not changed for over 30 days (default value), domain accounts - even with cached credentials - won't be able to login.

You can change the maximum password age e.g. via GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

As far as i read, the maximum you can put there is 999 days.

Here you can read more about machine account passwords.

2
  • Your problem will be the machine account password - this is refreshed periodicaly when the computer connects to the domain controler. If this password was not changed for over 30 days (default value), domain accounts - even with cached credentials - won't be able to login - That's not technically accurate. If the DC is no longer running and is not contactable by the computers then the users will continue to be able to log on with cached credentials. - blogs.technet.microsoft.com/askds/2009/02/15/… – joeqwerty Mar 23 '16 at 16:58
  • Yes, the DC is no longer running. It has already been removed from the site. They have also gutted all the network equipment, but the workstations were left there. I'm guessing he is just wanting to try to pull any data they may have been left on the machines. I suggested just pulling the hard drives if they would allow him to do that. Bankruptcy attorney is trying to ensure he can gather up as much data just in case some is needed in the future. – Alex Chance Mar 23 '16 at 18:25
0

for your windows 7 and 8 PCs you can use this tool to change or remove the local admin password , that will let you log into the pc's and do whatever you want in it. http://pogostick.net/~pnh/ntpasswd/ for the Server i dont know, but i can tell you that AD servers do not have a local admin account that can be reset/changed.

1
  • Thank you. The server is no longer on site, they were just trying to get access to the workstations that were still there. There are likely some workstations that this particular user had never logged into, and basically all the employees are gone already, so the best option would probably be to just reset the local admin. – Alex Chance Mar 23 '16 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.