Microsoft KB Archive/258994

= Able to Unlock Workstation with Cached Credentials =

Article ID: 258994

Article Last Modified on 2/28/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q258994



SYMPTOMS
If you change your user password in one session while a second session is open, you can unlock the second session by using either the old or the new password.

After you use the new password, you can establish new network connections. However, you cannot establish any new network connections by using the cached credentials. The cached credentials are removed when you log off from the session.



RESOLUTION
This behavior does not pose any security risk because it does not breach the confidentiality of either password, and therefore does not enable an unapproved user to establish network connections.



WORKAROUND
If your user password is compromised, change the password immediately and manually disconnect all network sessions for that account.

Keywords: kbenv kbprb KB258994

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.