Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you have logged on to a Windows machine as a domain user at least once, you can logon to that machine again even if the machine no longer has a network connection.

How does this work? I assume Windows caches the password somewhere and then authenticates the user. If this is the case, does anyone know where its cached?

Isnt this insecure? Assuming the domain admin forced a password change or removed a user, this 'loophole' will still allow the user to logon to the machine.

share|improve this question
Windows store a hash of the password, or more precisely a hash of a hash of the password. Generally speaking, if you have physical access to a machine you can always bypass the logon security anyway, so it doesn't really matter. In the rare situations where it does, the administrator can disable the functionality as Mayank has already explained. – Harry Johnston Feb 28 '13 at 2:44
up vote 4 down vote accepted
  1. Windows will cache your account information locally once you login to the machine once.
  2. If the next time you try to login the DC can't be reached it will use the cached settings. This might be useful for laptops which might be needed to work off the network.
  3. About the security issues, when you logon to Windows by using cached logon information, if the domain controller is unavailable to validate your account, you cannot access network resources that require domain validation. However, you can access network resources that do not require domain validation.
  4. (for server 2k8) There is a GPO to control logon caching- Interactive logon: Number of previous logons to cache (in case domain controller is not available). You can find it under [Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options] 4.
share|improve this answer
You can also find this setting in the registry of the individual machine: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] CachedLogonsCount = 10. Change to zero to disable the feature (group policies may override this setting, I'm not sure). – Dan Mar 9 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .