Re: Does the ability to use cached logon expire?

From: Admiral Q (Star_Fleet_Admiral_Q(NOSPAM)_at_(SPAMNOT)hotmail.com)
Date: 02/04/05 

Date: Thu, 3 Feb 2005 20:11:31 -0500

I be danged - I stand corrected - thanks. 

-- 
Star Fleet Admiral Q @ your service!
"Google is your Friend!"
www.google.com
***********************************************
"Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com> wrote in message
news:#DcwyjdCFHA.2232@TK2MSFTNGP14.phx.gbl...
> Admiral Q wrote:
>
> > Yes, once they've logged on 10 times with the "cached"
> > credentials, they need to log on to the Domain to reset it.
> Hi
>
> That is incorrect.
>
> Note that the CachedLogonsCount is a number indicating for how many
> users the computer should remember cached credentials for, and not
> how many times a user can log on with cached credentials in a row
> (because that is unlimited and cannot be changed)...
>
>
> More here:
>
> Microsoft Windows 2000 Security Hardening Guide
> Chapter 5 - Security Configuration
>
http://www.microsoft.com/technet/security/prodtech/win2000/win2khg/05sconfg.mspx
>
> <quote>
> Disable Caching of Logon Information
>
> Security Objective: Windows 2000 has the capability to cache logon
> information. If the Domain Controller cannot be found during logon
> and the user has logged on to the system in the past, it can use
> those credentials to log on. This is extremely useful, for example,
> on portable computers, which need to be used when the user is away
> from the network. The CachedLogonsCount Registry valued determines
> how many user account entries Windows 2000 saves in the logon cache
> on the local computer. The logon cache is a secured area of the
> computer and the credentials are protected using the strongest form
> of encryption available on the system. If the value of this entry
> is 0, Windows 2000 does not save any user account data in the logon
> cache. In that case, if the user's Domain Controller is not
> available and a user tries to log on to a computer that does not
> have the user's account information, Windows 2000 displays the
> following message:
>
> The system cannot log you on now because the domain <Domain-name>
> is not available.
>
> If the Administrator disables a user's domain account, the user
> could still use the cache to log on by disconnecting the net cable.
> To prevent this, Administrators may disable the caching of logon
> information. The default setting allows caching of 10 sets of
> credentials.
>
> Recommendation: Set this to at least 2 to ensure that the system
> is usable while the domain controllers are down or unavailable.
> </quote>
>
>
>
> -- 
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Problem with control hosted in IE
    ... The control is running on the client machine, so the default credentials are ... These will be the Windows logon from the ... > I logon to another machine using a local account (not one that the IIS ...
    (microsoft.public.dotnet.security)
  • Re: 2003 Web Edition logon errors
    ... > succesfully logon to the machines. ... > users to logon with credentials from domain A. When selecting Domain C ... Unable to obtain Terminal Server User Configuration. ... > the windows 2000 boxes allow users to logon using credentials from ...
    (microsoft.public.win2000.advanced_server)
  • Re: User credential management - system level vs. application level
    ... windows XP embedded, we then launch our application with an entry in the Run ... Switching Windows OS users is slow and causes our application to close ... We end up with two sets of username/password credentials, ... Ideally, we would like to manage logon credentials in one location, allow ...
    (microsoft.public.windowsxp.embedded)
  • Re: Local/Domain logon
    ... XP will cache the logon credentials. ... Pro and I do not use a roaming profile. ...
    (microsoft.public.win2000.general)
  • Re: Does the ability to use cached logon expire?
    ... > credentials, they need to log on to the Domain to reset it. ... Note that the CachedLogonsCount is a number indicating for how many ... Disable Caching of Logon Information ... Windows 2000 has the capability to cache logon ...
    (microsoft.public.windowsxp.security_admin)