7.1 KiB
title, description, ms.assetid, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author
| title | description | ms.assetid | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | author |
|---|---|---|---|---|---|---|---|
| Interactive logon Require Domain Controller authentication to unlock workstation (Windows 10) | Describes the best practices, location, values, policy management, and security considerations for the Interactive logon Require Domain Controller authentication to unlock workstation security policy setting. | 97618ed3-e946-47db-a212-b5e7a4fc6ffc | security | W10 | deploy | library | brianlic-msft |
Interactive logon: Require Domain Controller authentication to unlock workstation
Applies to
- Windows 10 Describes the best practices, location, values, policy management, and security considerations for the Interactive logon: Require Domain Controller authentication to unlock workstation security policy setting.
Reference
Unlocking a locked device requires logon information. For domain accounts, the Interactive logon: Require Domain Controller authentication to unlock workstation policy setting determines whether it is necessary to contact a domain controller to unlock a device. Enabling this policy setting requires a domain controller to authenticate the domain account that is being used to unlock the device. Disabling this policy setting allows a user to unlock the device without the computer verifying the logon information with a domain controller. However, if Interactive logon: Number of previous logons to cache (in case domain controller is not available) is set to a value greater than zero, the user's cached credentials will be used to unlock the system. The device caches (locally in memory) the credentials of any users who have been authenticated. The device uses these cached credentials to authenticate anyone who attempts to unlock the console. When cached credentials are used, any changes that have recently been made to the account (such as user rights assignments, account lockout, or the account being disabled) are not considered or applied after this authentication process. This means not only that user rights are not updated, but more importantly that disabled accounts are still able to unlock the console of the system. It is advisable to set Interactive logon: Require Domain Controller authentication to unlock workstation to Enabled and set Interactive logon: Number of previous logons to cache (in case domain controller is not available) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices.
Possible values
- Enabled
- Disabled
- Not defined
Best practices
- Set Interactive logon: Require Domain Controller authentication to unlock workstation to Enabled and set Interactive logon: Number of previous logons to cache (in case domain controller is not available) to 0. When the console of a device is locked by a user or automatically by a screen saver time-out, the console can only be unlocked if the user is able to re-authenticate to the domain controller. If no domain controller is available, users cannot unlock their devices.
Location
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Default values
The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
| Server type or GPO | Default value |
|---|---|
Default Domain Policy |
Not defined |
Default Domain Controller Policy |
Not defined |
Stand-Alone Server Default Settings |
Disabled |
DC Effective Default Settings |
Disabled |
Member Server Effective Default Settings |
Disabled |
Client Computer Effective Default Settings |
Disabled |