Windows – Why can I login to a box even if the AD Domain controller is down

active-directorydomain-controllerwindows

Scenario:

While my DC is running, I log into an arbitrary machine.
I stop the DC
I log off the arbitrary machine. Let's bounce it for good measure, too.
When the machine comes back up, I can still login with my domain credentials even though DC is down

Why and how?

Is there some sort of local credential cache in play on the "arbitrary" machine? My password was somehow hashed and stored for the future in CASE the DC blows up or is down?

Would the same process work if I attempted to login to a box that I had never logged into before while the DC is down?

Best Answer

By default, Windows will cache the last 10-25 users to log into a machine (depending on OS version). This behavior is configurable via GPO and is commonly turned off completely in instances where security is critical.

If you tried to log into a workstation or member server that you had never logged into while all of your DCs are unreachable, you would get an error stating There are currently no logon servers available to service the logon request

Related Solutions

Avoiding shared accounts on an Active Directory environment

You don't say which version of windows, but if it is for 2000 or 2k3 This technet article will tell you exactly how to do this. It doesn't seem there is a way to do this in 2k8 (at least not that i could find easily)

Windows – Set Windows 7 Default Login to a Non Domain Account

You can use Group Policy (local or domain) or edit the registry directly.

Direct registry edit seems to work best for us. We use a generic script to assign the local computer name, with the variable %COMPUTERNAME%, as the default domain for logon where needed. Run the following:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DefaultLogonDomain /t REG_SZ /d %COMPUTERNAME% /f

If using GP look under Computer Configuration, Administrative Templates, System, Logon. The setting is labeled "Assign a default domain for logon". However, entering %COMPUTERNAME% here does not appear to be correctly interpolated prior to the logon display.

Best Answer

Related Solutions

Avoiding shared accounts on an Active Directory environment

Windows – Set Windows 7 Default Login to a Non Domain Account

Related Topic