[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Cached credential and passwords expiration

Posted on 2007-11-21
6
Medium Priority
?
3,902 Views
Last Modified: 2012-01-09
Hi.

We would like to know what are the limitations to the use of cached credentials (number of consecutive logins, duration...) and how to modify them. Our AD will host some laptops users who won't be able to connect to it for months, and we want them to keep using their computers.
We also need to know what would happen in this case about the password expiration dates ? Would thoses users still be able to log in using the cache credentials event though the date has passed ?
And what about their return ? Will they be able to connect to the AD, using their old password and changing it at that point ?
Thanks for your support.
0
Comment
Question by:nxbp
6 Comments
 
LVL 70

Accepted Solution

by:
KCTS earned 2000 total points
ID: 20326651
There is no limit for the longevity of cached credentials - bey default credentials for up to 10 users are cached on each machine. If passwords expire on the domain, then cached credentails will continue to work - when the user next connects the the domainthey will be prompted to change the password in the normal way and the cached credentials will be updated.
0
 

Expert Comment

by:jaesoul
ID: 20469495
I thought the limit was 50? Can someone please verify this information
0
 
LVL 8

Expert Comment

by:MotoCrazy
ID: 20771676
Limit is 50, but default is 10. Value can be anything fro 0-50.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 70

Expert Comment

by:KCTS
ID: 20772244
As said, there is no limit to the duration of cached credentials, by default up to 10 different sets of credentials are cached, as MotoCrazy says - the max is 50.
0
 

Author Closing Comment

by:nxbp
ID: 31410330
Sorry for the delay, I'd forgotten to rate your answer. Thanks for the help
0
 
LVL 2

Expert Comment

by:MtnNtwks
ID: 24937315
Not to beat a closed issue to death, but feel it's necessary to point out the difference between "duration" and "succession"

If you log in using cached credentials, it doesn't throw you out of the login session...hence there is no "duration."

However, you ARE LIMITED to a maximum of login sessions!!  The default is 10, and can increase the default to a maximum of 50 using the following registry key:

Cached logon information is controlled by the following key:
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\

   ValueName: CachedLogonsCount
   Data Type: REG_SZ
   Values: 0 - 50

Value is 0 to 50. Anything over 50 still only caches for 50 logons.

Microsoft Articles that explain in detail:
http://support.microsoft.com/kb/913485
http://support.microsoft.com/kb/172931/

0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question