NT 4.0 (Workstation) Logon Authentication Vulnerability

[jhw1970 () HOTMAIL COM (jhw1970 () HOTMAIL COM)]

Scenario:  User logon to WinNT domain.

Problem:  I believe WinNT may cache user passwords.  This
allows a user to disconnect a terminal from the network and
login to the workstation locally without being
authenticated by the PDC or BDC.

Vulnerability:  A malicious user may disconnect a machine
from the network and add/remove software without being
audited by the PDC/BDC.  Also, a user who has been deleted
from the domain users list may still have access to a
machine which he/she had used in the past.