0

This is something I'm curious about. There is a LAN consisting of Windows XP machines. There is an administrator account say admin-xyz which can be used to login to any of the machines on the network. But, when I run pwdump to get the password hashes on a machine, I dont see the admin-xyz account. I am just curious as to how the authentication happens. Can someone please shed some light on this?

Thank You.

Improve this question
4
  • is this 'admin-xyz' a domain admin account?
    – DanBig
    Dec 30, 2009 at 20:42
  • yes Dan, i think it is.So, in that case how does the authentication happen ?
    – Joe
    Dec 30, 2009 at 20:43
  • Thats domain authentication, which authenticates against the domain controller.
    – DanBig
    Dec 30, 2009 at 20:46
  • Just keep in mind that using tools such as pwdump may not be permitted on a corporate network, where it's often considered to be security violation.
    – John Gardeniers
    Dec 30, 2009 at 23:32

1 Answer 1

Reset to default
2

Most likely it's only dumping the LOCAL hashes from the SAM, and you are looking for the domain admin account which is not stored locally.

Improve this answer

You must log in to answer this question.