Interactive logon: Require Domain Controller authentication to unlock

enter image description here

Scenario: I was logged in to Windows 7 x64 Enterprise N SP1 domain joined desktop machine connected to corporate network using LAN cable. I tried changing my domain user ID password using Self service update web portal. It changed successfully. Then I locked computer using WIN+L key.

Since I did not login to computer using new password so new password was not cached. What happened, I was able to unlock computer using cached credential (old password) just once. I tried lock again and unable to unlock using cached credential (old password) further. It says user name or password is correct. Then it only allowed me to unlock computer using new password which authenticated by domain controller.

As per defined policy (please see attached screenshot), if this setting is enabled, a domain controller must authenticate the domain account that is being used to unlock the computer.

However, in my case policy setting is disabled. Still Windows used new domain credential and it contacted domain controller to authenticate domain account rather that using cached credential(if the setting is disabled) What is the reason and why Windows ignored to apply the correct action of policy?

Since it is local policy on this workstation, I thought it could be something enforced by group policy. So I ran RSOP.MSC and saw this policy settings was not even defined there. So it means it is not caused or enforced by domain group policy.

  • " So it means it is not caused or enforced by domain group policy." - This is only true if "not defined" means "disabled" is that the case? Update your question to indicate you have determined if the policy is enabled/disabled when it is "not defined". You didn't provide the policy from the AD, so your local machine group policy setting isn't really helpful. – Ramhound Oct 12 '17 at 16:45
  • Yes, I understand that. I was just saying the screenshot you provided isn't the output of RSOP.MSC. Provide the relevant output of gpresult /Scope User /v and gpresult /Scope Computer /v – Ramhound Oct 12 '17 at 17:07
  • I ran RSOP.MSC on local workstation. Navigated to Computer Configuration -> Policy -> Windows Settings -> Security Settings -> Local Policies -> Security Options Interactive logon: Require Domain Controller authentication to unlock Value: Not Defined As of now there is neither gpresult output nor RSOP.MSC screenshot. – G-1 Oct 12 '17 at 17:11
  • Have you tried to specifically disable it? then do a gpupdate /force? – Ramhound Oct 12 '17 at 17:15
  • 1
    .....You have to do it on the AD server obviously then gpupdate /force on the client. This cannot be fixed unless you are an Administrator on the domain. – Ramhound Oct 12 '17 at 17:22

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.