Out of curiosity, why it takes way much time for windows 7 to show the failed login message for the wrong password instead it almost instantaneously lets you to login if the password is correct ?
Is this only me who is seeing this behavior ?
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
It is mainly to prevent quick brute forcing of passwords. This blog article gives you much more information than you probably care for! |
|||
|
|
So it takes longer to brute force a password. If this computer is on a domain, using the right password will skip the domain lookup and verify against the cached credentials. If it can't use a cached credential then it has to contact a domain controller, which has several handshakes involved (Kerberos and LDAP at the minimum). |
|||
|
|
I just did a test since I have a similar setup. My machine is Win 7 domain PC, if I am connected to the network my DC is on and enter the password wrong it takes 30 seconds or so to tell me the PW is incorrect. However if I turn my Wifi off or connect to a different network it instantly tells me the password is incorrect. Probably a mix of what Chris S said below and communication between the Domain controller and PC. |
|||
|
|
|
Most OSes (linux and windows are good examples) enforce a retry delay in order to prevent someone from scripting a login to the server and potentially brute forcing or locking out an account without a delay that will (potentially) allow the attempt to get noticed by someone getting failed login alerts. In addition the method of authentication (domain vs local) also has a performance hit on the authentication. Note that in the case of domain passwords the password is verified twice if it fails on a non pdc emulator DC. |
|||
|
|
|
It 's deliberate. If you miss it 2 or 3 time, it stole less than a minute of your life. But if you try to much, it will take your life. |
|||
|
