Interactive logon: Require Domain Controller authentication to unlock
Scenario: I was logged in to Windows 7 x64 Enterprise N SP1 domain joined desktop machine connected to corporate network using LAN cable. I tried changing my domain user ID password using Self service update web portal. It changed successfully. Then I locked computer using WIN+L key.
Since I did not login to computer using new password so new password was not cached. What happened, I was able to unlock computer using cached credential (old password) just once. I tried lock again and unable to unlock using cached credential (old password) further. It says user name or password is correct. Then it only allowed me to unlock computer using new password which authenticated by domain controller.
As per defined policy (please see attached screenshot), if this setting is enabled, a domain controller must authenticate the domain account that is being used to unlock the computer.
However, in my case policy setting is disabled. Still Windows used new domain credential and it contacted domain controller to authenticate domain account rather that using cached credential(if the setting is disabled) What is the reason and why Windows ignored to apply the correct action of policy?
Since it is local policy on this workstation, I thought it could be something enforced by group policy. So I ran RSOP.MSC and saw this policy settings was not even defined there. So it means it is not caused or enforced by domain group policy.