Domain Computer Account question. 1

[TheMisio]

Dear Techies,

I thought I know a lot about AD, however, I came across a situation that left me bedazzled. A workstation (member of our domain) had its account deleted from AD. Not a big deal, happened million times.
However, a user using that workstation was still able to log on to the domain. The workstation still though it was a member of the domain, as it wasn’t removed from it. Only the computer account was deleted.

Now my problem is with understanding the concept of a computer account in the domain. How can a workstation allow user to log on with a user domain account, if the computer account no longer exists? I can see an event in the System log on a DC stating that the session from a computer failed to authenticate. Access is denied.

But the user still logged on to the domain, run all scripts etc. Why? What is the purpose of a computer account then? I can’t find a definitive answer anywhere.

Cheers for any enlightenment.

 

[TechyMcSe2k]

Does the user get:
A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on may not be available.
If so read:

http://support.microsoft.com/kb/172931

Otherwise, how many domain controllers do you have in your environment? The deleted computer account may not have replicated to all domain controllers and therefore the computer account would still be valid and the user would still be able to log on.

A Computer Account is an account that is used to authenticate a client machine (rather than a user) to the domain controller server. The purpose of the computer account is to prevent a rogue user and domain controller from colluding to gain access to a domain member workstation.

The password of a Computer Account acts as the shared secret for secure communication with the domain controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from joining the domain, participating in domain security operations, and gaining access to domain user/group accounts. Windows 200x/XP/Vista/Win7 clients use machine trust accounts.

http://www.samtechconsulting.com

_______________________________________
Great knowledge can be obtained by mastering the Google algorithm.

 

[TheMisio]

TechyMcSe2k,

You are right! It was the replication. I have one DC with 3 hour replication latency (just in case someone does something stupid).

I got my sanity back.

Cheers.

Michael.