MSLogon Domain Authentication when user is remote

[MentalNomad]

I need to clarify how MSLogon authenticates when using domain accounts if the user running uVNC server is off the corporate network.

I understand that if they're in the office, domain accounts like mydom\admin and mydom\helpdesk can remote-control the user's PC, because those accounts are in groups which are also in the user's PC's "Administrators" group.

But what happens when the user is offsite and the helpdesk needs to connect to their computer? (Assume we've dealt with the NATting issues.)

When the Helpdesk tries to logon to the user's computer as mydom\helpdesk, how does the user's computer check the credentials? There's no access to a domain controller from the user's remote location.

Does it use cached credentials saved on the user's computer? And if so, does that mean that the Helpdesk needs to log into their computer before they leave, so that the credentials are cached? Or will it be impossible to assist the remote user until they're back on the domain?

[bigjohn]

If the local PC holder is logged in to the corporate VPN, this will work flawlessly.

So, how does the user login to the machine when they are remote? Do they login to their domain account, or do they login to a local machine account?