Power Users

D

Denis

We have a Windows 2003 Active Directory Domain.

We have PCs with Domain Users added to them as Power Users. Now, whenever
the DC is down, then also these guys are able to logon to their PCs with
their Domain Logon User IDs.

How do I restrict this?

Thanks in Advance.

Regards,
Denis Dudhia
 
S

Steve Riley [MSFT]

That they can log on when a DC is down has nothing to do with them being
Power Users. The default behavior for Windows is to create and store cached
credentials (containing password verifiers) on client workstations so that
users can log on when not connected to the network.

You can disable this functionality on clients
(http://support.microsoft.com/kb/172931/en-us), but I'd advise against it --
the default behavior allows your users to log on to their computers and
continue working even if a domain controller is unavailable. What security
risk do you perceive exists with this behavior?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

adding to user group after first time login 1
How deny power users that they can create accounts 2
Disable logon to XP without disabling or locking account? 1
Error "the local policy of this system does not permit.. 3
two of my systems seem to have a lask of security, please help! 1
Roaming profile / UHPClean 1
Shared PC Single-Sign On 1
Elevated Privilege Permission to Windows XP Client PC 1

Top