Detailed data synchronization mechanism for modifying AD user passwords

Phenomenon:

Accidentally found a very strange phenomenon, the user to change the password of their own ad account, the new password is immediately available, but the old password is also available.

Test:

To understand the nature of the problem, I did a lot of testing, found that the problem is indeed universal, and the old and new passwords can be used in time, precise control in 5 minutes, a few seconds, a few.

To minimize interference from other factors, each password modification process is performed on the DC. The total test DC has 3 units, DC01, DC02 for the same site, where DC01 is the PDC emulator, and the other is the DC03 for the field site. To improve efficiency, a query interface was written using ws-* to return "OK" or "incorrect" value to indicate that the password was correct or wrong. Next to open windows from the always, accurate to the second to observe.

Let's talk about the site testing.

Test Account Original password is "11", enter the password "11" Return the result "OK", enter the password "22" Return the result "incorrect".

Modify the password on the DC02 "22", enter the password "22" to return the result "OK", enter the password "11" also return the result "OK".

Keep trying the password "11" and return the "OK" result. After 5 minutes, the return result becomes "incorrect".

Modify the password on the DC01 "33", enter the password "33" to return the result "OK", enter the password "22" still return the result "OK".

As before, always try the password "22", all return "OK" result. After 5 minutes, the return result becomes "incorrect".

It is noteworthy that if the password is modified at the same time on the DC01 and DC02, then the old password will be invalidated immediately.

The situation between the site is roughly equivalent, I connect the local AD site to query, DC random, modify password operation in the field of DC03.

For a clearer explanation of the problem, the following illustration shows a screenshot of ADSI information, from left to right, which is the ADSI attribute option for DC01, DC02, and DC03.