Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If you have logged on to a Windows machine as a domain user at least once, you can logon to that machine again even if the machine no longer has a network connection.

How does this work? I assume Windows caches the password somewhere and then authenticates the user. If this is the case, does anyone know where its cached?

Isnt this insecure? Assuming the domain admin forced a password change or removed a user, this 'loophole' will still allow the user to logon to the machine.

share|improve this question
    
Windows store a hash of the password, or more precisely a hash of a hash of the password. Generally speaking, if you have physical access to a machine you can always bypass the logon security anyway, so it doesn't really matter. In the rare situations where it does, the administrator can disable the functionality as Mayank has already explained. –  Harry Johnston Feb 28 '13 at 2:44
add comment

1 Answer

up vote 2 down vote accepted
  1. Windows will cache your account information locally once you login to the machine once.
  2. If the next time you try to login the DC can't be reached it will use the cached settings. This might be useful for laptops which might be needed to work off the network.
  3. About the security issues, when you logon to Windows by using cached logon information, if the domain controller is unavailable to validate your account, you cannot access network resources that require domain validation. However, you can access network resources that do not require domain validation.
  4. (for server 2k8) There is a GPO to control logon caching- Interactive logon: Number of previous logons to cache (in case domain controller is not available). You can find it under [Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options] 4.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.