Struggling to Demonstrate Universal Group Membership Caching

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi guys,

Running some last minute labbing before 70-640 next week and I am having a hard time demonstrating the Need for universal group membership caching.

So I have setup contoso.com, with 2 DC's spanning 2 separate sites.
I have setup a universal group called Contoso Universe, and created a bunch of users of which I have added a small portion to the universal group.

So to try and prove the concept of "logons need to contact a GC to verify universal group membership before authenticating" I am disabling the network link between my 2 DC's (having ensured all users and groups have replicated first).

Whenever I log on to a client machine for the first time in the 2nd site, with the sites link disabled, whether I use a member of Contoso Universe or just a standard user It Always Allows Me To Log On

Is there something obvious I am missing, or am I completely misunderstanding the need for UGMC???

 

Yes but before enabling UGMC I just wanted to see what happens when I try to log on Without a GC, ie to see if any error messages are generated when logging in to my site that doesn't have a local GC (thus why I terminate the link back to the main site that hosts the GC). Instead it just allows me to log on every time despite there been no GC??

 

*Facepalm* So I need a multi-domain forest before GC's and UGMC becomes an issue.

Thanks Sparky!

 

Wahooo! That was it - multiple domains needed.

1 forest, 2 domains each in their own site
Severing the link between the 2nd site and the primary site (holding the GC) and trying to create new users in the 2nd site gave a popup error that Windows could not verify the user name is unique as the GC is not available and it would create the user account but they could not log on until the username is verified as been unique.

Attempting to log the users on when the site link was down just provided a "User name or password is incorrect" consistently until the site link back to the GC came back online.

Now I know why UGMC would be needed