Fetching Group Membership Info of a User

hi,
 
can "group membership info" of user when he/she disconnected ad?

i have observed that user can login on machine because of cached credentials. however, unable fetch information of group user belongs in ad when disconnected.

is cached somewhere, or there setting in ad can provide when user offline or other solution?



thanks & regards,
dharmesh mehta
http://smartsecurity.blogspot.com

---

dharmesh m mehta

hello,

 

can "group membership info" of user when he/she disconnected ad?

i have observed that user can login on machine because of cached credentials. however, unable fetch information of group user belongs in ad when disconnected.

 

the cached credentials logon enable users used logon computer locally still able login when domain unavailable. because cached logon user doesn't been granted ticket domain when login, user allocate access local computer resources. expected group membership of user fetched because needs access domain (dc).

 

 

is cached somewhere, or there setting in ad can provide when user offline or other solution?

 

in windows 2000 , in later versions of windows, username , password not cached. instead, system stores encrypted verifier of password. verifier salted md4 hash computed 2 times. place think contains user membership information in user's access token. has information of sid of security groups user resides in. can use process explorer to indentify group membership in security tab of program runnign under user security context. however, when user logon computer cached credentials, sids of groups not resolved readable names until computer reconnects domain.

 

 

for information:

 

913485                   cached credentials security in windows server 2003, in windows xp, , in windows 2000

http://support.microsoft.com/kb/913485

 

172931          cached domain logon information

http://support.microsoft.com/kb/q172931/

 

hope helps.

Windows Server  >  Directory Services