Windows 2000 Logon When Domain Controller Is Down

This article explains how Microsoft Windows 2000 processes domain user authentication when no domain controller is reachable on the network. When communication with an Active Directory domain controller fails, the operating system bypasses network authentication by falling back to locally cached credentials, allowing authorized users to access local system resources with restricted domain functionality.

The Domain Discovery Failure

When a user submits their domain credentials (Username, Password, and Domain) at the Windows 2000 logon prompt (Winlogon), the operating system's Net Logon service attempts to locate a domain controller (DC). It queries DNS and WINS, or sends NetBIOS broadcasts, to discover a responsive DC hosting Active Directory.

If the network connection is severed, or if all designated domain controllers are offline, the discovery process times out. Once the Net Logon service confirms that no DC is available to handle the Kerberos or NTLM authentication request, the operating system initiates its offline fallback procedure.

Cached Credential Verification

When the DC cannot be reached, the Local Security Authority Subsystem Service (LSASS) steps in to authenticate the interactive logon locally:

  1. Cache Lookup: LSASS queries the local system registry under the protected HKEY_LOCAL_MACHINE\SECURITY\Cache hive to locate previously cached user information.
  2. Hash Comparison: During previous successful network logons, Windows 2000 stores a cryptographic representation of the user’s credentials. LSASS computes a salted hash of the submitted password and compares it against the stored hash in the local cache.
  3. Session Initialization: If the hashes match, the user is authenticated. Windows displays a notification indicating that a domain controller could not be contacted and that the user was logged on using cached account information.

If the user has never logged on to that specific machine previously, or if the stored hash does not match the entered password, the logon attempt fails completely.

System Configuration and Default Limits

The cached logon mechanism in Windows 2000 is governed by local and domain security policies:

  • Default Capacity: By default, Windows 2000 retains the credentials of the last 10 unique domain users who have logged on interactively.
  • FIFO Management: When the cache limit is reached and a new user logs on while connected to a DC, the oldest cached entry is discarded (First-In, First-Out).
  • Policy Customization: Administrators can adjust this behavior using the CachedLogonsCount registry value or the Group Policy setting Interactive logon: Number of previous logons to cache. Setting this value to 0 disables offline logons entirely.

Limitations of Offline Logon Sessions

Logging on with cached credentials grants interactive access strictly to the local computer. Because the Kerberos Key Distribution Center (KDC) resides on the domain controller, the system cannot obtain Ticket-Granting Tickets (TGT) or service tickets. Consequently:

  • Access to network shares, shared printers, and domain-joined servers is unavailable.
  • Active Directory objects and domain group policies cannot be queried or updated.
  • Any changes made to user permissions, group memberships, or account disablement on the DC do not take effect on the local machine until a domain controller is reachable again.