220-1102 Question 370
Single answerUsername and passwordA small office uses Windows 11 PCs joined to a Microsoft Active Directory domain. A user reports that they can sign in to their laptop with the username and password they have been using for months, but they cannot access a shared folder on a file server. When they try to open the share, they are repeatedly prompted for credentials and receive an 'Access denied' message. Other users can access the share normally. The technician confirms the user recently changed their password while working remotely and has not connected to the corporate network or VPN since then. Which action should the technician take FIRST to resolve the issue?
- A
Have the user connect to the corporate VPN and lock/unlock or sign out/sign back in so the PC can update cached domain credentials
- B
Create a new local administrator account on the laptop and use it to access the network share
- C
Reset the user's password again in Active Directory and tell the user to wait 24 hours for replication
- D
Disable the user's account lockout policy so the old cached password continues to work for network resources
Show answer and explanation
Correct answer: A
Explanation
This question tests the difference between cached logon credentials and live authentication to domain resources, which is a practical A+ Core 2 troubleshooting topic related to usernames and passwords. On Windows domain-joined systems, users may be able to sign in offline with cached credentials from a previous successful logon. However, when accessing a network share, the file server validates the user's current domain credentials. If the user changed their password while remote and has not reconnected through the corporate network or VPN, the local workstation may not yet have refreshed its authentication state. The best first step is to reconnect the device to the domain environment and have the user reauthenticate. This aligns with Microsoft best practices for domain authentication and credential troubleshooting in Active Directory environments.
- A. Correct.
Correct. In a domain environment, a laptop can often still allow sign-in using cached credentials even when it has not recently contacted a domain controller. However, access to domain resources such as file shares requires current domain authentication. Because the user changed their password remotely and has not reconnected to the corporate network or VPN, the laptop may still be using older cached credentials locally while the server expects the newer password. Connecting to the VPN and reauthenticating allows the workstation to communicate with Active Directory and refresh the user's credentials.
- B. Incorrect.
Incorrect. A local administrator account is separate from the user's domain account and does not solve the underlying authentication mismatch with the domain file server. Even if a technician logged on locally with an admin account, that would not grant the user access to a domain share that depends on the user's domain username, password, and permissions.
- C. Incorrect.
Incorrect. Resetting the password again is unnecessary based on the scenario. The problem is not that Active Directory failed to change the password; it is that the laptop has not reconnected to the domain environment since the change. Also, in a typical single-site environment, password changes replicate quickly, and waiting 24 hours is not a standard first troubleshooting step.
- D. Incorrect.
Incorrect. Account lockout policy exists to protect against repeated failed sign-in attempts and should not be disabled as a troubleshooting shortcut. More importantly, allowing an old cached password to continue working for network resources is not how domain authentication works. This option reflects a misunderstanding of the difference between local cached logons and live domain authentication.