RE: Domain logon without network connection + group policies

> Through group policy, you can forbid logon without DC authentication.

Actually, the setting to which I believe you refer is for *unlocking*
machines, not logging into them in the first place.

(Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options\Interactive logon: Require Domain Controller
authentication to unlock workstation)

Additionally, one can be authenticated by a DC without pulling down
policies. Tricky timing, but authentication and group policy processing are
separate processes

> Under Security in GP "Number of previous logons to cache" 
> Change this to 0.

See above.
> *****word of warning though,
> if you have any laptop users, you will run into a rather big problem.
> They will not be able to use their system off the network.
> Another option if forcing a group policy refresh. The normal 
> operation is that every 90-120 minutes GP refreshes, but only 
> if the version number has changed (you've made a policy 
> change). You can force GP to refresh every X minutes 
> regardless. Under GP go to --- Computer Configuration --> 
> Administrative Templates --> System --> Group Policy, and 
> configure it there.

As the OP mentioned, this won't work if they've never gotten the policy in
the first place.


Laura


---------------------------------------------------------------------------
---------------------------------------------------------------------------