Can accounts still be logged onto if Password Caching is not enabled?

Question

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security measure? I am not quite sure how this all ties into the registry / SAM & other files.. So would someome still be able to use a program like ONTPRE and add in an administrative password to the SAM file or log in by some other means? (Through sniffing or other means.. I assume the other means would generally be easier, if they exist)

In a nutshell, this is my question: The question is it still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

Answer 1

is [it] still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

Of course. If you have physical access to the machine, you always have the ability to reset the local security database with known password values, thus giving yourself access. This is due to the very design of the PC architecture and cannot be changed, no matter what operating system you are using.

But this would be local access to all data stored on the local machine - you would not have any online domain resources available. You would still need valid domain account credentials for that.

The risk for accessing the "data at rest" (i.e. data which is persistent even when the operating system is not running) can be alleviated by using encryption mechanisms which are tied to user input or removable keys (like smartcards) - for example with EFS.