Skip to main content

Domain cached password

More
16 years 7 months ago #25497 by skepticals
I know that if I join a computer to a domain and take that computer off the network (by unplugging it) I can still use the domain username and password to login.

Is there a timeout period for this? I would think that the cached credentials would eventually expire and need to communicate with the domain controller eventually. Maybe not.

Thanks.
More
16 years 7 months ago #25500 by Banned
Replied by Banned on topic Re: Domain cached password

I know that if I join a computer to a domain and take that computer off the network (by unplugging it) I can still use the domain username and password to login.

Is there a timeout period for this? I would think that the cached credentials would eventually expire and need to communicate with the domain controller eventually. Maybe not.

Thanks.


Check Cached Credentials Security In Windows Server 2003, in Windows XP, and in Windows 2000
Cached Domain Logon Information

Notice:This User Has Been Banned From Accessing This Domain. Be Cautious And Risk On Your Own.
More
16 years 7 months ago #25501 by Smurf
Replied by Smurf on topic Re: Domain cached password
It can be controlled in Group Policies. i.e. disabled.

Wayne Murphy
Firewall.cx Team Member
www.firewall.cx

Now working for a Security Company called Sec-1 Ltd in the UK, for any
Penetration Testing work visit www.sec-1.com or PM me for details.
More
16 years 7 months ago #25504 by KiLLaBeE
Replied by KiLLaBeE on topic Re: Domain cached password
Computer configuration > Windows Settings > Security Settings > Local Policies > Security Options, and "Interactive logon: Number of previous logons to cache..."

I disable it in my home lab because it can mislead you in troubleshooting network issues.

Also note that if you leave the computer disconnected from the network for more than thirty days, that at one point you'll need to reconnect it and possibly reset the computer account so it could "resync" with the DC (or just drop and add it back onto the domain). Basically, computers maintain a secure password protected connection between themselves and the DC, when the communicate is broken (leaving a computer disconnected for too long), the communication path is broken.

That's just to continue your train of thought on the cache expiring idea.
More
16 years 7 months ago #25520 by S0lo
Replied by S0lo on topic Re: Domain cached password
It's very misleading and some times causes havoc when users are expected to login to multiple machines frequently. In my work place (University) students are expected to login to any PC in the lab.

Picture this, a student logs in to one PC and does some changes to one of his word documents. Logsoff saving his profile and document to the DC safely. The next day the student sits on another empty chair and logs-in, but the PC (for some reason) was disconnected say because of a pulled out UTP cable or switch port that was mis functioning. Eventually, he logs-in with an old cached profile (Not realizing it off course) and finds out that all the changes that he made yesterday was gone. He gets frustrated!!. He retypes his changes and adds more and more. Logsoff. Comes the next day to the first PC (which was connected), logs-in, and find out that he got back his old changes but not the changes that he made yesterday. :x :x :cry:

A very bad default behavior in my opinion.

Studying CCNP...

Ammar Muqaddas
Forum Moderator
www.firewall.cx
More
16 years 7 months ago #25521 by skepticals
Thanks for the information.

I see that the default is 10 previously used logins. Does this mean that a user could login cached forever? Or would even these 10 cached credentials expire?
Time to create page: 0.156 seconds