Cached logon in custom GINA
Dmitriy Golubev
I found that standard MS Gina don't use Interactive logon type. Instead, it
use CachedInteractive logon type and if CachedInteractive logon is failed,
simple Interactive logon will be used instead. I'm readed in the MSDN that
CachedInteractive logon is perfomed without hitting the domain controller.
Does anybody known how to use this logon type? How MS Gina retrieves user
profile information in case then this information are updated on the Domain
Controller?
Thank you.
Kellie Fitton
The following weblinks should shed light on the subject:
http://msdn.microsoft.com/msdnmag/issues/05/05/SecurityBriefs/
http://msdn.microsoft.com/msdnmag/issues/05/06/SecurityBriefs/
http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/msgina.mspx
Hope these information helps,
Kellie.
Dmitriy Golubev
Unfortunately, I can't find answers for my questions in these links.
"Kellie Fitton" <KELLIE...@YAHOO.COM> wrote in message
news:1144681420....@e56g2000cwe.googlegroups.com...
Alex Fedotov
From what I know, MSGINA does not attempt to synchronize the user profile
with the domain controller in case of a cached logon. It just uses the
cached copy.
Having said that, when cached logon succeeds, MSGINA performs a true
Interactive logon on a background thread. If you enable audit of logon and
logoff events, you will see that a successful logon of type 11 (which is
CachedInteractive), is immediately followed by a logon type 2 (Interactive),
with the logon process set to GinaBkg. The profile resulting from this
second logon is apparently discarded, but I would assume that the local
profile cache gets updated as a side effect of doing a logon, so that the
next cached logon will pick up an updated profile.
-- Alex Fedotov
Dmitriy Golubev
One more question: I execute the following operations:
1. Logon to the workstation (jointed to Active Directory) using normal
domain user account (Domain Users).
2. Then perform Logoff
3. Next step I add this user as a member of second domain group (e.g.
SomeOtherDomain group).
4. After replication was done I logon to the same workstation as domain user
again, run command line utility WhoAmI.exe and check the results. I've
found, that my user included in second (SomeOtherDomain) group. I'm not
sure, but I believed that group memberships information should not be
present in SAM cache. Could you explain me how MSGINA got this information
during logon process?
Thank you again.
"Alex Fedotov" <m...@alexfedotov.com> wrote in message
news:N8ydnf6uRYV...@comcast.com...
