Member Avatar for Member #533276

Hi,

How can i prevent users to logon Windows domain
if they don't have a network connection? (30+ users)

GPO? if yes, how....?

Thanks in advance !

  • 2 Contributors
  • 3 Replies
  • 269 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by Member #533276

Dani AI

Generated

As noted, Windows will fall back to cached domain credentials when a DC is unavailable, and correctly found the Group Policy approach to change that behavior. That GPO route is the usual and simplest way to stop offline domain logons, but it has operational impact and must be planned and tested. (Interactive logon cached-logons policy)

Key planning points before you roll this out:

  • Pilot the change on a small OU or test machines first so you can validate outcomes and user messages.
  • Prepare a recovery path so helpdesk can access locked machines (a local administrator account, service desk image, or out‑of‑band access). Use an automated solution to manage those local admin passwords — e.g., Windows LAPS — rather than a shared static password. (Windows LAPS overview)

If you need users at a remote site to keep working when WAN connectivity is unreliable, consider alternatives instead of disabling caching for everyone. Deploying a Read‑Only Domain Controller (RODC) or providing a pre‑logon VPN solution lets authentication happen locally without broadly enabling cached credentials. Also evaluate moving away from full roaming profiles toward Folder Redirection + Offline Files (or primary‑computer roaming) so large profile downloads and unintended local copies are avoided. (RODC guidance, Folder Redirection & Roaming Profiles)

Quick checklist to finish: test the GPO change in a controlled OU, confirm helpdesk recovery procedures (and put LAPS in place), verify roaming/profile behavior on test clients, and make sure the profile share is not configured for Offline Files caching if that causes undesired local copies (see Microsoft KB guidance). Communicate the change and expected user impact before deployment. (KB on offline-caching and profile shares)

Member Avatar for m23perrault

if they are not connected they will use cached credentials and will not actually authenticate to the domain

Member Avatar for Member #533276

if they are not connected they will use cached credentials and will not actually authenticate to the domain

yes, i know.. since we are using roaming profles
XP will try to make a local copy of the profile, and that's
what i don't want ... i just want to prevent users to logon
the domain if they are not connected..

thanks for the reply !

Member Avatar for Member #533276

Hi,

You might be interested in the answer with the solution of the problem above...

Via GPO you can set the numbers of logons to cache.
Computer Configuration | Windows Settings |
Local Policies | Security Options | Interactive logon " Number of previous logons to cache (in case domain controller is not available"

The computer will get this message :
The system cannot log you on now because the domain <DOMAIN_NAME> is not available.

In this policy setting, a value of 0 disables logon caching.
Any value above 50 only caches 50 logon attempts.
Default: 10

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.