On Sat, 27 May 2006, Ansgar -59cobalt- Wiechers wrote:

> On 2006-05-25 feedb4ck (at) z4ck (dot) org [email concealed] wrote:
> > Although it is a well known fact that Windows desktops and servers
> > still use LM Hashes and cache the last ten userids and passwords
> > locally, just in-case an Active Directory, Domain, or NDS tree are not
> > available, has anyone thought about the consequences of this issue in
> > a hot-desking, or flexible working environment?
>
> That's why you use policies to disable use of LM hashes and caching of
> passwords in environments like that.
>

Exactly. You don't do caching on computers that won't ever come off the
network. i.e. don't do it on desktops. If you have that much of a problem
with AD being unavailable, you better look more closely at your AD
architecture.
You may do caching on laptops, and then i'd hope you don't have people
sharing laptops. If you do, well then, that's another story requiring
careful consideration, but a little off-topic.

--Tony
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._
.-
Anthony J. Biacco Systems/Network Administrator
thelittleprince (at) asteroid-b612 (dot) org [email concealed] http://www.asteroid-b612.org

"as I always say, why go Merlot, when you can call a Cab?"
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._
.-

[ reply ]