Patent ID: 8296824

Claim:
At a local domain controller in a computerized environment in which the local domain controller receives secure and non-secure information from a hub domain controller, a method of authenticating a user logon request in a manner that provides enhanced security and ease of use of the local domain controller, comprising the acts of: receiving a first user logon request from a first client computer system and a second user logon request from a second client computer system, wherein the first user logon request and second user logon request require authentication; determining that the first user logon request and second user logon request cannot be processed because a first secret for the first user logon request and a second secret for the second user logon request are not stored at a local domain controller; sending the first user logon request and the second user logon request to a hub domain controller over a network; receiving the first secret for the first user logon request and the second secret for the second user logon request from the hub domain controller such that the first secret and second secret are received at the local domain controller only in response to the first user logon request and the second user logon request rather than being received as part of a periodic update to cached secrets at the local domain controller; receiving at least one indication whether the local domain controller is permitted to cache the first secret and the second secret, wherein the at least one indication indicates that the local domain controller is not allowed to cache the second secret and that the local domain controller is allowed to cache the first secret; allowing the second user to logon at the local domain controller but not caching the second secret; storing the first secret in the local domain controller cache, such that a subsequent user logon request from the first client computer system can be handled by the local domain controller; and subsequent to receiving the first secret, receiving an update message from the hub domain controller that changes metadata associated with the first secret, such that the first secret received from the hub domain controller has an invalid metadata state, such that upon receiving a third user logon request from the first client computer system, the third user logon request is sent to the hub domain controller for authentication and to receive an updated third secret which is then stored at the local domain controller such that the local domain controller can handle subsequent user logon requests from the first client computer system.