A deleted/disabled domain user account still logs in locally

[B_Moulton05]

Hi,

We have an account that has been disabled on our domain controller for quite
some time, yet it still works locally on one of our lab workstations.

The user's profile has been deleted by going into My Computer >> Properties
I also checked C:\Documents and Settings\ and the username was not there.

I checked the PC's local accounts by right-clicking My Computer >> Manage,
under Local Users & Groups, and the account wasn't listed.

I went as far as going into regedit to look up SpecialAccounts to see if it
was a hidden account, and it wasn't.

Somehow, however, the account is still working on this computer, whether the
PC is connected to the network or not (even with the network cable unplugged).

How is this possible?

 

[B_Moulton05]

Just an update ... the account does *not* work while the network cable is
plugged in. It DOES work if there is no network connection, however, so
clearly something is being cached. I can't find out where the cached
information is for the life of me.

If I tried logging in while connected to the network, it properly displays
the message that the account has been disabled. The instant I unplug the
cable and try again, it lets me right in.

 

[Fuzzy Logic]

Hi,

We have an account that has been disabled on our domain controller for
quite some time, yet it still works locally on one of our lab
workstations.

The user's profile has been deleted by going into My Computer >>
Properties

I also checked C:\Documents and Settings\ and the username was not
there.

I checked the PC's local accounts by right-clicking My Computer >>
Manage, under Local Users & Groups, and the account wasn't listed.

I went as far as going into regedit to look up SpecialAccounts to see if
it was a hidden account, and it wasn't.

Somehow, however, the account is still working on this computer, whether
the PC is connected to the network or not (even with the network cable
unplugged).

How is this possible?

Cached credentials. Here is a tool to clear them:

http://support.microsoft.com/kb/823731