Simone,
If your users are able to logon to the clients with a blank password when
you know that their domain user account has a password assigned to it, then
you probably have one of two issues:
1. Your users may be logging in locally to their workstations and not into
the domain. Maybe they have a local user account for themselves on their
workstation that has a blank password. You should never be able to logon to
the domain with a blank password if the user account has specific password
assigned to him/her. One way to know for certain if they are logging onto
the domain versus logging in locally is to go to a command prompt on the
machine that they are logged onto and type "set L". If this shows their
logon server as themselves, then they are logging on locally. If it gives
the name of one of your domain controllers, then they are logging on to a
DC.
2. If you are certain that your users are logging into the domain, then it
is possible that AD replication could be failing betweeen your domain
controllers. That could result in one DC having a different password for a
user than the other DC. If AD replication is failing, you should see errors
in your event logs. You could also run a dcdiag on each DC and it would
show you if AD replication is failing.
I hope this helps.
Ray Lava
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights
