If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password

Question

Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes effect? Is this possible?

I ask because I have a computer that is on 24/7 and that runs important services. It spends most of it's time locked (Windows key + L locked). Theoretically, if for example somebody broke into the office and got access to the domain controller, they could reset the password and log in. But if they had to restart before logging in, then additional security measures could be put in place to prevent the OS from booting unless you know what to do.

Thanks

Answer 1

I'm not sure your security expectations here are realistic.

If someone gets access to your DC in such a way that allows them to change arbitrary account passwords, then you've got plenty of bigger problems to worry about.

If they could re-boot the system in order to force their password change to take effect (after which point, your hypothetical additional security measures take effect), then they either have:

1.) Remote login access to the system, which means that they don't need to reboot the system for this purpose because they're already on it.

or

2.) Physical access to the system, which pretty much bypasses any additional logical security you have in place, short of hard drive encryption.

Let's say, for the sake of argument, that they are able to re-boot the system but are still unable to log into it. At this point, they've effectively DoSed whatever services the system provides which requires you to keep the system logged in at all times. Perhaps this is not as significant of a breach as if they actually got logical access to the system. But, depending on how critical those services are, it could have a significant impact on your organization.

The lesson here is to make sure your servers which require a high level of CIA (Confidentiality, Integrity, or Availability), such as systems running critical services and the domain controllers they answer to, are well secured physically, and separated from your other less-secured systems as far as possible both physically and logically.

I believe the saying goes something like: "If you allow someone (either intentionally, or through lack of adequate security) physical access to your system, then the system is no longer yours." The same goes especially for domain controllers. If you allow someone to run arbitrary commands on your domain controller, then the domain is no longer yours.