Score:1

Why don't Windows domain machines periodically query security group membership, like other things?

cn flag

When I was in lower tier support (and sometimes still), one of the most annoying sequences of events was a request for new file permissions >> add user to security group and specify in the reply "you must log out and back into your machine". 20 minutes later, "I'M STILL GETTING DENIED PERMISSION!!". Because you didn't log out and back in did you

Why don't Windows machines in an AD domain periodically query and update the user group membership like they do for group policies and many other things?

Score:3
bd flag

The need to log out is due to AD group memberships only updating when a Kerberos ticket is created, which occurs during login.

You can refresh a computer's Kerberos ticket by running klist -li 0:0x3e7 purge on an elevated command line, followed by gpupdate /force if you need to update the group policy.

Referece: http://woshub.com/how-to-refresh-ad-groups-membership-without-user-logoff/

WakeDemons3 avatar
cn flag
I'm going to select this answer because it's literally true. But I more wanted the "why". Why doesn't the PC do this kerberos ticket purge and update as a background process just like with GPOs (every 90 minutes), or DNS lists, or NTP, etc.
slightly_toasted avatar
bd flag
@WakeDemons3 I would assume it has to do with the tradeoff between using up resources (mostly CPU) to regenerate the Kerberos ticket, multiplied by all logged in accounts on the domain. Vs. Causing a slight inconvenience when a group membership change occurs. Also, due to Kerberos being stateless, it wouldn't be possible for the AD to trigger a ticket regeneration on account membership change.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.