Do domain service accounts benefit from cached credentials

With Rackspace's (hosting this particular configuration) support, I now understand the situation.

The "net use *..." drive mapping example and the service example is an apples to oranges comparison. With the drive mapping case it's just an authentication that's happening. In the service case, I'm actually attempting to run a local process under domain credentials, which by definition isn't possible since the server isn't in the domain. Not in domain = can't execute under domain credentials. The drive mapping works because I'm not attempting to execute a process as the domain account - I'm simply passing the credentials.

This restriction applies to any type of process, regardless of it's interactive or service-based.

The best way to deal with this, short of firing and/or savagely beating all the users who are stupid enough to lock themselves out under such circumstances (and then disconnect and log off to make it worse) is to set up a local user account on the laptop they can log in with.

Worst case scenario, they can use that second account to work with if they're unable to get their laptop to update their domain account status, and best case, they can get the updated status down to their machine (probably with copious assistance from the helpdesk).

There's an older ServerFault question here with at least one method of syncing up the domain credentials with the computer's cached credentials - log in over VPN first.