Re: Cached credentials on shared folders

yaro137 wrote:
> Not sure if this is the right group for my question as the problem
> actually occurs in a branch office that runs Server 2k8 standard on a
> member server but the DC in the head office runs SBS2k8.
> While the VPN link goes down users can't access shared folders on the
> server even though they can log on. Does it have something to do with
> GPOs?
> yaro

No it has to do with Kerberos (tickets).

--
/kj

yaro137 wrote:
> On 22 July, 17:12, "kj [SBS MVP]" <KevinJ....@SPAMFREE.gmail.com>
> wrote:
>> yaro137 wrote:
>>> Not sure if this is the right group for my question as the problem
>>> actually occurs in a branch office that runs Server 2k8 standard on
>>> a member server but the DC in the head office runs SBS2k8.
>>> While the VPN link goes down users can't access shared folders on
>>> the server even though they can log on. Does it have something to
>>> do with GPOs?
>>> yaro
>>
>> No it has to do with Kerberos (tickets).
>>
>> --
>> /kj
>
> Is there a way then to make it work when the connection to the DC
> fails?
> Thanks
> yaro

You can open the shares, you can have the users access the branch server
with branch server local accounts, or you can put a second dc at the branch.

Or improve the reliability of the SBS server connectivity, which would be
the preferred choice.


--
/kj

My ten cents worth would be that no VPN is reliable enough to make an office
totally dependent on it for logon. Unless you can afford a leased line you
should avoid domino-effect scenarios.

The question here is whether you need to manage the users from the central
location, or whether the small amount of extra work in maintaining separate
useraccounts would be preferable to creating an SPOF which can bring both
sites down in one fell swoop. I would argue that resilience is more important.

It's either that or you need to ditch the SBS.

"yaro137" wrote:


> > You can open the shares, you can have the users access the branch server
> > with branch server local accounts, or you can put a second dc at the branch.
> >
> > Or improve the reliability of the SBS server connectivity, which would be
> > the preferred choice.