Windows Authentication Over The Network

Question

Hello,

I'm planning to enable the "Deny access to this computer from the network" GPO setting on our client computers and specify "NT Authority\Local Account". I had a specific question I'd like to find the answer to. This setting would force the use of domain accounts in a local admin group when accessing a computer's C$ share or remotely opening the Computer Management console.

Are network logins in these examples cached similar to how local logins are?

Answer 1

Hi Richard,

This setting would force the use of domain accounts in a local admin group when accessing a computer's C$ share or remotely opening the Computer Management console.

Yes, I would expect only domain accounts in the local administrators would be able to access the admin shares (C$, D$, etc), as for the remote management you would need to verify this as there might be cases where 'Deny access to this computer from the network' might not apply.

Are network logins in these examples cached similar to how local logins are?

I'm not completely sure about the context of your question. Credentials are cache on the client machine rather than the server. When a user connects to a share, they present their credentials to the server as part of the authentication process. Normally, if there is an open connection or session to the server, then the credentials will not be required again, until all sessions are closed or the server is rebooted.

Gary.