Re: Local Caching

Tech-Archive recommends: Speed Up your PC by fixing your registry

"Keith" <Keith@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:938C26B0-F765-4A73-B0B6-82A4133857D3@xxxxxxxxxxxxxxxx 
Where is the user's password cached when you have a GPO setting on
Interactive logon: Number of previous logons to cache (in case domain
controller is not available)? Is it store in LSASS secrets?

If we set our server to not store local cache of user's password what
application or other things will break? I u nderstand that if you turn that
off and there is no domain controller available that you will be unable to
logon to that server in that domain...But what other hidden gotchas are out
there that I might not be thinking of?


Hello Keith,

it's stored in the local credential cache - the Data Protection API stores the credentials in non-reversible encryption (the same place where EFS-Certificates are stored). This is secure against breaking it, but not secure against brute force attacks (so it's still important that your users are educated to use good and long enough passwords). It's stored with the profile data, and the policy you mention keeps the whole profile of the user. If you use roaming profiles you don't have anything to loose but being able to log on with the cached credentials, meaning that a DC and GC must be available when trying to log in.

Sincerely,

Ulf B. Simon-Weidner 

.

Relevant Pages

  • Re: Local Caching
    ... Number of previous logons to cache (in case domain ... > If we set our server to not store local cache of user's password what ... > logon to that server in that domain...But what other hidden gotchas are ...
    (microsoft.public.security)
  • Cache expiration
    ... i like to store some data in the Cache on the server. ... Because the data should be reloaded into the Cache ... reloads the data. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Enhancing ASP.NET Framework
    ... On the server side, the logical container for this would be ... Session and Cache are the two built in mechanisms to keep state on the ... The state information is bounced between client and server. ... >Its a good idea to store small non-critical objects in a ViewState. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Cache expiration
    ... Steffen Loringer wrote: ... > i like to store some data in the Cache on the server. ... Because the data should be reloaded into the Cache ... When I store things in the Cache, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Local Caching
    ... Interactive logon: Number of previous logons to cache (in case domain ... If we set our server to not store local cache of user's password what ... off and there is no domain controller available that you will be unable to ...
    (microsoft.public.windows.server.active_directory)