0

I've been learning AD and also troubleshoot a problem I'm having with AD. I'd like to be able to tell if a Windows 7 workstation is actively logged on to a domain or if it's logging into an account using locally cached credentials.
To test if this works I logged into a user account on a domain named grasstree.void. Then powered off the domain controller. I then restarted my Windows 7 machine and logged into the domain. I verified that Window computeres isn't on the network. It has IP 169.254.95.63 and the AD server is powered off. I then used the following methods, which gave me result that were indistinguishable from when the AD serer was on.

Control Panel > System

Shows me on glasstree.void

C:\Users\jonnytest>whoami

glasstree\jonnytest

C:\Users\jonnytest>set logon

LOGONSERVER=MASTERCONTROLLE

C:\Users\jonnytest>gpresult /r

...shows same as when on the domain controller.

So, how can I tell if I've logged in using the domain controller, or if I've logged in using the local cache.

1
  • Have you given any thought to disabling cached logons for stationary domain members? That may alleviate the need to even ask this question.
    – Semicolon
    Oct 18, 2019 at 15:26

1 Answer 1

2

You will need to query the security event log for the event id 4264 event, which includes the logon type. Type 11 is cached interactive logon. (This also implies auditing must be enabled).

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

1
  • Wow. So there's no way for an average user find that information in Control Panel or System? That seems ridiculous.
    – Frank
    Oct 19, 2019 at 4:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .