Autologin Domain User on DC while disconnected from Domain

[gwdrsmith]

I’m looking for a way to have a domain user, autologin to a domain controller in a remote site while the WAN link is down. The server runs 2 applications that cannot be setup as a service, but must be running at all times. I do not want the domain Admin doing autologin. I have several servers that have this requirement, with POS machines at those locations that must also be able to login during a WAN outage. The servers are DCs with a copy of the Global Catalog. Does anyone know of a method of accomplishing this? Is this a KDC issue? Can I create several KDC slaves?

Thanks.

 

[Ceez]

how funny, i was just reading something that might be what you're looking for.

Here's a link:

http://www.informit.com/articles/article.aspx?p=415792

You can also google Universal Group Membership Caching for more information.

If the user successfully logs in at this remote site while the WAN link is up it will cache the user credentials on his laptop/workstation. It caches for 8 days so if the link is down with no GC available to authenticate the cache authentication will allow the user to login for at least 8 days.

Hope this helps you out.

ceez

 

[Ceez]

I just re-read your post and understand that this user is login onto a domain controller and not a laptop/workstation.

Dont know if the Universal Caching would serve the same purpose when it comes to servers.

Good luck

 

[gwdrsmith]

Your 2nd read is correct. The user must be able to login to the DC with the WAN link down. It doews not cache the credentials by default. I have been unable to find a configuration setting that will allow this to happen.

Any other ideas?

 

[TechyMcSe2k]

in the domain controllers group policy, u can add the user in comp config/windows settings/security settings/local policies/user rights assignments - add the user account to log on locally. That way the GP will be on the DC when the WAN link goes down. As far as auto-logon after that, I am sure a reg hack could handle it....maybe

I may or may not have fully understood the question..

 

[gwdrsmith]

The user is already a member of a group that has been added to the default domain controllers GPO to allow log on locally. If anyone knows of a registry setting to allow this, I would appreciate the information. Currently the user can will auto login as long as the domain controller is able to communicate with the PDC emulator. If the WAN link is down and the server restarts, it will not allow the user to login. With the WAN link down, only the Administrator is able to login.

 

[gwdrsmith]

I found the information. For a user other than the Domain Administrator to autologon interactively on a remote Domain Controller with the WAN down, you have to add the following key to the registry.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

From the Edit menu, select New, String value.

Enter a name of AutoLogonCount, and press Enter.

Double-click the new value, and enter the number of times you want autologon to occur.