Re: cached logons

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 07/08/05 

Date: Fri, 08 Jul 2005 18:03:40 +0200

pdx wrote:

> When tracking the the 10 cached logons, does XP count logons by the same user
> against the 10? I ask because a remote user who checked out one of our loaner
> laptops reports - from the road - that she can't logon with her credentials.
> She used this same laptop recently and 10 unique users definitely haven't
> logged onto the machine in the interim. A different user, who had the laptop
> in the interim, did log on at least ten times.
Hi,

The CachedLogonsCount is a number indicating for how many users
the computer should remember cached credentials for, and not
how many times a user can log on with cached credentials in a row
(because that is unlimited and cannot be changed)...

Windows will remember the 10 most *recent* logon attempts (for
different users), this way it is the oldest logon cache entries that
will be purged when the allowed number is surpassed.

More here:

Microsoft Windows 2000 Security Hardening Guide
Chapter 5 - Security Configuration
http://www.microsoft.com/technet/security/prodtech/win2000/win2khg/05sconfg.mspx

<quote>
Disable Caching of Logon Information

Security Objective: Windows 2000 has the capability to cache logon
information. If the Domain Controller cannot be found during logon
and the user has logged on to the system in the past, it can use
those credentials to log on. This is extremely useful, for example,
on portable computers, which need to be used when the user is away
from the network. The CachedLogonsCount Registry valued determines
how many user account entries Windows 2000 saves in the logon cache
on the local computer. The logon cache is a secured area of the
computer and the credentials are protected using the strongest form
of encryption available on the system. If the value of this entry
is 0, Windows 2000 does not save any user account data in the logon
cache. In that case, if the user's Domain Controller is not
available and a user tries to log on to a computer that does not
have the user's account information, Windows 2000 displays the
following message:

The system cannot log you on now because the domain <Domain-name>
is not available.

If the Administrator disables a user's domain account, the user
could still use the cache to log on by disconnecting the net cable.
To prevent this, Administrators may disable the caching of logon
information. The default setting allows caching of 10 sets of
credentials.

Recommendation: Set this to at least 2 to ensure that the system
is usable while the domain controllers are down or unavailable.
</quote> 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: Huh? "Login failure: the user has not been granted the requested logon type at this compute
    ... I'm a pretty experienced Windows user and programmer, ... the user has not been granted the requested logon type ... on the appropriate OU to see the Group Policy for that OU]. ... > administrators' group to the domain controller. ...
    (microsoft.public.security)
  • Re: Remote User Needs to Change PWD without connecting to domain
    ... On our windows NT machines users receive the no domain controller ... With Windows 2000 User DO NOT receive any notification. ... >> When they would take the laptop in the field they were unable to logon ...
    (microsoft.public.win2000.security)
  • Re: Domain authenticating non-domain accounts
    ... I limited the tests to Windows ... a machine running Windows 98 can still access file shares ... for a logon but were able to authenticate me as long as I entered the same ... it does not explain why this domain controller was LESS strict about ...
    (microsoft.public.platformsdk.security)
  • Re: Windows 2003 member server with Windows 2000 Domain Controller
    ... If anyone is having a Windows 2003 member server with a Windows 2000 ... Windows cannot obtain the domain controller name for your computer ... There are currently no logon servers available to service the logon ...
    (microsoft.public.win2000.security)
  • Re: How to force a logoff in a logon script?
    ... Windows has a registry key that governs which UI will be presented ... the unauthorized user cancels the logon dialog and goes away ... system, but complains that there was no cancel button, only an OK ...
    (microsoft.public.windows.server.scripting)