RE: Domain logon without network connection + group policies
From: Laura A. Robinson (larobins_at_bellatlantic.net)
Date: 01/29/05
- Previous message: Oliver Schneider: "RE: Preventing multiple logins in 2003"
- In reply to: Ghetti, Tim: "RE: Domain logon without network connection + group policies"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "'Ghetti, Tim'" <tghetti@air-worldwide.com>, "'Manuel Sousa'" <manuel.sousa@gmail.com>, <focus-ms@securityfocus.com> Date: Sat, 29 Jan 2005 14:23:46 -0500
> Through group policy, you can forbid logon without DC authentication.
Actually, the setting to which I believe you refer is for *unlocking*
machines, not logging into them in the first place.
(Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options\Interactive logon: Require Domain Controller
authentication to unlock workstation)
Additionally, one can be authenticated by a DC without pulling down
policies. Tricky timing, but authentication and group policy processing are
separate processes
> Under Security in GP "Number of previous logons to cache"
> Change this to 0.
See above.
>
> *****word of warning though,
> if you have any laptop users, you will run into a rather big problem.
> They will not be able to use their system off the network.
> Another option if forcing a group policy refresh. The normal
> operation is that every 90-120 minutes GP refreshes, but only
> if the version number has changed (you've made a policy
> change). You can force GP to refresh every X minutes
> regardless. Under GP go to --- Computer Configuration -->
> Administrative Templates --> System --> Group Policy, and
> configure it there.
As the OP mentioned, this won't work if they've never gotten the policy in
the first place.
Laura
---------------------------------------------------------------------------
---------------------------------------------------------------------------
- Previous message: Oliver Schneider: "RE: Preventing multiple logins in 2003"
- In reply to: Ghetti, Tim: "RE: Domain logon without network connection + group policies"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
