how the deleted user profile able to login via offline

Question

HI ,

I deleted user profile from admin account and tested login the delete user ID with offline login. The user profile manage to login without network. how's its work? suppose the deleted profile shouldn't able to login unless connected with LAN. Any explanations?

Answer 1

Hello,

This is because the user has a cached logon into that computer.

There are 2 options:

1. The inmediate one, would be to delete the cached logons into that specific computer, thus disabling the offline logon of the user. For this, you will need to delete (backup first, just in case) the keys at HKEY_LOCAL_MACHINE\SECURITY\CACHE that start with NLS$<number> (NLS$Control should remain).
2. To prevent this in the future, it will be required to propagate a GPO to prevent number of cached logons into the computers using the Policy "Interactive logon: Number of previous logons to cache" and setting the value to "0"

Reference: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available

---------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--