The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about the impacts of this on a networked system.
When logging in to an Active Directory controlled system, the system is given a token that it can use to gain access to network resources for the user without the user having to re-enter their password. Is this token kept when locking the system or reacquired when unlocking?
I am trying to better understand the possible risks of an Inception derived attack on a corporate network. If it only allows access to the local system, it is significantly less of a risk factor than if it is also able to gain access to network resources associated with the user.