Return
-
Title
User profiles are being created on the Password Manager server -
Description
Password Manager operations lead to the creation of local profiles when:
- Password Manager is installed on a domain member server or domain controller.
- The Password Age Rule is enabled in the Password Manager Admin site.
- The Password Manager host server has Allow log on locally enabled for Users.
-
Resolution
Remove Users from the Allow log on locally User Rights Assignment in the Local Security Policy for the server hosting Password Manager.
-
Additional Information
Technical details: Password Manager performs remote operation ChangePassword on domain controller. After successful ChangePassword the local LSA performs interactive logon, presumably to update cached credentials on client host. If interactive logon is allowed for user then a local profile is created. By default the local security policy allows interactive logon on member servers and denies on domain controllers.