This is an NTLM feature that automatically tries a different DOMAIN name from what you entered.
Every login in your screenshots is the user ENALOG\Peter
, not NEMOQ_AD\Peter
.
It doesn't matter that you're typing the domain NEMOQ_AD\Peter
, since NEMOQ_AD
is not a domain that ENALOG
trusts. (See below.)
Notice that you don't see NAMOQ_AD
anywhere once you've connected to Voldemort
.
NTLM pass-through authentication
NTLM supports something called pass-through authentication. The important bit of the article is here: (emphasis added)
- If the domain name specified is not trusted by the domain, the authentication request is processed on the computer being connected to as if the domain name specified were that domain name. NetLogon does not differentiate between a nonexistent domain, an untrusted domain, and an incorrectly typed domain name.
Example for your net share use
What is happening is the following:
Voldemort
receives a request to authenticate the user NEMOQ_AD\Peter
.
Voldemort
sees that NEMOQ_AD
is neither its own domain nor any domain that it trusts.
- Voldemort tries to authenticate the user
ENALOG\Peter
instead.
- Since you entered the password for
ENALOG\Peter
(as you said in another comment), authentication succeeds.
Re. net shares in general
When you are accessing the drive share, you have to be using NTLM (any attempt to use Kerberos will fail because ENALOG
doesn't trust NAMOQ_AD
) using pass-through authentication, which allows you to access network shares without typing a password. This works only when you are using identically-named accounts with an identical passwords on the two machines.
Re. RDP
When you enter a password when using Remote Desktop, it's behaving exactly as if you had tried to log in as ENALOG\Peter
instead of NEMOQ_AD\Peter
, and using whatever password you typed in. This way, if you type Peter
as your username, the local computer sends NEMOQ_AD\Peter
since that's the only domain it knows about, but the remote computer decides to try ENALOG\Peter
instead.
Re. SSMS
I assume SQL Server Management Studio is using one strategy or the other (probably the second one), I don't know exact details of its implementation and don't have two domains lying around to test it.