2

I have asked the admin sitting next to me to change my password and disable my account. He did that 15 minutes ago and I am still browsing the network shares. I haven't logged off yet, but I want to know how long I will be able to do what I am doing if I don't log off or lock my computer?

Also, our travelling sales people are out of the office for weeks at a time. Their machines are connected to the domain, but when they're out, they only connect to the network to access files occasionally using a Windows VPN connection - if we disable one of them, how long (or what needs to happen) until they are unable to logon to their machines while they're still on the road.

HR is not going to like this...

(Windows 7, Server 2008 R2)

1 Answer 1

0

In an AD environment, the servers hosting your file shares are actually accepting the Kerberos ticket that was issued to your session with all of its authorizations when you were authenticated on login. This way, file servers don't have to contact the domain controller every time for access to it. It trusts the ticket. The fact that there does not appear to be any enforcement of revocation of Kerberos tickets appears to be inherent to the way Kerberos works.

http://msdn.microsoft.com/en-us/library/cc233947.aspx

Also, this recent article written about it:

http://www.aorato.com/blog/windows-authentication-flaw-allows-deleteddisabled-accounts-access-corporate-data/

The tickets can remain valid for 10 hours and the workaround in the MSDN article seems to only prevent access to new resources after 20 minutes in the same domain.

As far as VPN users are concerned, in a normal use case, although it can depend on your VPN architecture, the Kerberos ticket would be issued upon authentication, so under normal circumstances, they wouldn't be allowed access if they weren't already connected to the domain in some way with a recently (few hours) issued ticket.

That second link to the blog article may have a hint of hype to it, and I'm pretty sure I've seen people lose access to stuff minutes after I've disabled them --- although their ticket may have been about to expire anyway. This does bother me though, because there have been a few times where I've been told to disable a user's access to everything yesterday, and in some environments, that's critical.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .