prendi nota di quanto segue:
Replication of Password Changes
Password changes are replicated differently than both normal (non-urgent) replication and urgent replication. Changes to security account passwords present a replication latency problem wherein a user’s password is changed on domain controller A and the
user subsequently attempts to log on, being authenticated by domain controller B. If the password has not replicated from A to B, the attempt to log on fails. Active Directory replication remedies this situation by forwarding password changes immediately to
a single domain controller in the domain, the PDC emulator.
In Active Directory, when a user password is changed at a domain controller, that domain controller attempts to update the respective replica at the domain controller that holds the PDC emulator role. Update of the PDC emulator occurs immediately,
without respect to schedules on site links. The updated password is propagated to other domain controllers by normal replication within a site.
When the user logs on to a domain and is authenticated by a domain controller that does not have the updated password, the domain controller refers to the PDC emulator to check the credentials of the user name and password rather than denying authentication
based on an invalid password. Therefore, the user can log on successfully even when the authenticating domain controller has not yet received the updated password. On domain controllers that are running Windows Server 2003 or Windows 2000 Server with SP4,
if the authentication is successful at the PDC emulator, the PDC emulator replicates the password immediately to the requesting domain controller to prevent that domain controller from having to check the PDC emulator again.
If the update at the PDC emulator fails for any reason, the password change is replicated non-urgently by normal replication.
For clients that are running Windows NT 4.0 or clients that are running Windows 95 or Windows 98 without the Directory Service Client Pack, the client attempts to contact the PDC emulator. If the client has the Directory Service Client Pack installed, the
client contacts any domain controller and the contacted domain controller then attempts to contact the PDC emulator.
Edoardo Benussi
Microsoft MVP - Management Infrastructure
edo[at]mvps[dot]org
Flag "User must change password at next logon"
