Q: Does a Windows workstation contact the domain controller (DC) to authenticate a user's credentials when he or she attempts to unlock the workstation, or does Windows rely on information collected at the time the user originally logged on?
A: The Interactive logon: Require Domain Controller authentication to unlock policy is disabled by default. With that policy disabled, a Windows workstation uses cached credentials on the local workstation to authenticate the user. If you enable this policy, Windows won’t unlock the workstation until it contacts a DC to authenticate the user against the account’s current credentials that are stored on the DC. You’ll find the Interactive logon: Require Domain Controller authentication to unlock policy by running gpedit.msc, loading your local computer's Group Policy Object (GPO), and looking under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. . . .
Register
