WindowsIdentity.Name doesn't return new name from Active Directory

Question

Any help on this would be TRULY appreciated.

I'll spare you the details, but we have to rename all of our Active Directory users from [First name] [Last Name] to [First Initial][Last Name] to get the space out of the usernames.

We have a production web application that uses the following line of code to get the Username from Windows once the user logs in with Windows Authentication:

System.Security.Principal.WindowsIdentity.GetCurrent().Name

After we update a user's account through Active Directory Users and Computers, it takes quite a while before that line of code returns their new username. They cannot login until that is updated.

Does anybody know what I can do on the webs server to get it to go ahead and update? I have tried the following:

1) Trigger replication between all domain controllers in AD Sites & Services 2) Run gpupdate /force from a command line on the production web servers 3) Run iisreset from a command line on the prouduction web servers

Right now I am having to update users one at a time so that everyone else as able to work.

Any answers, ideas, things to try, or a .Net explanation of where that .Name property actually gets its value would be appreciated.

Answer 1

In my understanding, the thing you describe may be due to "cached credentials". This feature allow a user to connect on a computer which is not plugged to the network (or can't see a DC).

You can configure this feature with the following GPO setting:

Computer->configuration->windows settings->security settings->local policies->security options. In the right pane "Interactive logon: Number of previous logons to cache"

The defaul value is 10, put 0.

The drawback of this solution is that people on laptop may not be able to reconect ... if they don't "see" a DC.

But it may be an explanation.

JP