Staff randomly unable to log in at home - local profile?

[synaesthesia]

Bit of an odd one, and extremely inconsistent which makes troubleshooting difficult.

We've had 2 members of staff in the last couple of months unable to log in on their staff laptop from home/off site, domain is unavailable. In both cases, the laptop was used on site at least a couple of days before. Local profiles for staff, no profile deletion has occurred manually or otherwise and there's nothing in event viewer that I can see to suggest anything else going on.

Windows 11 24H2 in both cases we've had.

Only thing "out of the ordinary" so to speak, in comparison to the 80+ other identical laptop & windows combos is they're support staff but again the profiles & setup doesn't differ in any way. Certainly isn't widespread (yet).

Can anyone think of any possible reasons please?

 

[sideone]

Following, we had this happen to one user yesterday.

[psydii]

1 hour ago, synaesthesia said:

In both cases, the laptop was used on site at least a couple of days before. Local profiles for staff, no profile deletion has occurred manually or otherwise and there's nothing in event viewer that I can see to suggest anything else going on.

 

I'm going to assume that you've checked GPOs for caching logon credentials settings or settings configuring the requiring line of site to the  DCs?  Don't forget to check Local Group Policy of the offending machine too in case there is somehow something there.

 

(rmdir /s grouppolicy and rmdir /s grouppolicyuser is a handy trick for clearing out stuck/corrupt policy settings, I've found I've needed that a lot in the last 12 months, having never needing it in the previous 25 years)

 

Also Is it possible that when they were on site, they were not actually connected to an ssid that allowed them line of site to the domain controllers? (i.e. creds aren't cached)

 

or there is a dns/dhcp quirk that makes the device think it's got LoS to the DC (when at their house), and so then fails when the DC doesn't respond (because they are at their house).

..maybe they have a device on thier home network that has the same IP of one of your DCs?

 

There are a few reports around the place for this sort of thing:

Domain not available for single user while on different network - Software & Applications - Spiceworks Community (There's a link to a reddit thread at the bottom of that conversation  that I can't follow right now, maybe there is some insight there.)

 

[synaesthesia]

Yup, checked all of that - definitely not GPO but checked gpresults regardless. Both confirmed connected in school to the correct SSID (don't have the ability to change when on site). 

Very unlikely there's anything at home with the same IP as ours, DHCP/DNS quirks are always a possibility mind. Just strange it's not wider spread, I'm half of the mind that it's a combination of a windows update and applying at the wrong time (for example if the update applies off site, affects something regarding profiles then they can't reconnect until they do have sight of the DC).

Not a beat dropped with Windows 10!

[psydii]

I wonder if it's maybe it's a by-product of some silent a/b testing in an update for "credential guard" that's bugging out and clearing/blocking access to the cached credentials.

[synaesthesia]

I did see entries for credential guard in event viewer but didn't think anything of it - thought that was only something that worked in the user context rather than system context, could obviously be wrong! (could be thinking of credential manager)

Edited April 21 by synaesthesia

[synaesthesia]

Have been digging into this further, @sideone worth checking the registry for the profiles - HKLM>Software>Microsoft>Windows NT>CurrentVersion>ProfileList>profileGUID>NextLogonCacheable

 

Was 1 for this instance but I don't think I can verify if it was the same when this occurred for the user. I can see a hangover in that profilelist however from an old home drive which no longer exists, so it may be related - a rebuild of the laptop at most or at quickest, removing the user profile might stop this happening again. 

 

The information pinpointed by @psydii does show a lot of evidence of changes in windows updates that have affected different areas of authentication; whilst most appear to centre around smartcard authentication I suspect there may be other implications, particularly with certificates used to authenticate devices as well as the usual credentials. In which case, I plan to keep a close eye on things in the near future and force any windows updates that come along (rather ironically as they seem to be the root cause of the issues these days!)

 

Sources:

https://community.spiceworks.com/t/domain-not-available-for-single-user-while-on-different-network/1208422/32

https://schweigerstechblog.de/offline-cache-credentials-mit-smartcard-unter-windows-11-24h2/

https://www.reddit.com/r/sysadmin/comments/1i1y9j9/windows_11_24h2_offline_cache_credentials_failing/#:~:text=We noticed that starting in,into the computer just fine

https://www.reddit.com/r/sysadmin/comments/1g9e4kc/comment/mig5jkj/?context=3

https://community.spiceworks.com/t/domain-user-not-cacheing/365337/4