Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As I am looking for more information for my final exam I was wondering how the process of authenticating Windows users works.

In my own imagination it could possibly go like this:

  1. user enters login information on his windows machine
  2. machines passes credentials to PDC
  3. PDC asks the active directory
  4. AD matches entry with it's database
  5. AD tells PDC --> O.K.
  6. PDC tells windows machine --> O.K.
  7. windows machine logs on user

But maybe the windows machine just skips the PDC and passes the request directly to the active directory service (e.g. unix machines passes authentication requests to a LDAP server...)?

Does anybody know exatly how this works?

share|improve this question

closed as off topic by Sven, Chopper3, Dan, Khaled, Tim Brigham Apr 18 '12 at 16:12

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Unless you have an NT4 domain, there are no PDCs any more. There is a PDC emulator FSMO role, but it's entirely different than what a PDC was. – MDMarra Apr 18 '12 at 12:23
Not really; in case all goes to hell in your domain, it's the machine with the PDC role that acts as tie-breaker for any and all conflicts. – adaptr Apr 18 '12 at 12:30
@adaptr It's the PDC emulator role, and it's entirely different than a PDC used to be. What you say is correct, but it's still not a PDC. – MDMarra Apr 18 '12 at 12:56
Wait...given the comments to answers and whatnot...are you authenticating Windows users via a Linux system acting as a PDC via SAMBA that in turn is asking an AD controller for credentials? Because if so that's really specific and should be spelled out here... – Bart Silverstrim Apr 18 '12 at 13:20
@MDMarra yeah... that :) – adaptr Apr 18 '12 at 15:03
up vote 0 down vote accepted

Here's a nice detailed article on the process that I found by searching for Windows logon process.

Good luck

share|improve this answer
It's usually encouraged to put a summary of material in the answer, just because links stagnate or go dead over time so the answer won't be useful to later searchers. The link should be used to support the answer and not be the answer. – Bart Silverstrim Apr 18 '12 at 12:24
great work uSlackr, thanks! Cite: "during a domain logon, the LSA on a domain controller validates the user. The LSA evaluates the user's credentials to determine if the logon should be processed as a logon to a local account or a logon to a domain account." – Master of Celebration Apr 18 '12 at 12:26

I don't know what exam this is going to be, but if you had taken any actual Microsoft AD-related classes you would not spout such nonsense.

  1. user enters credentials on the local machine.
  2. local machine checks if it already has an authentication ticket for these credentials.
  3. if not, it contacts the first ADS server it can find that offers kerberos authentication functions
  4. the ADS machine checks the credentials against the LDAP database.
  5. if they check out, kerberos returns a TGT (ticket-granting-ticket) to the client machine
  6. for a certain duration set in AD (usually 8~10 hours) this TGT will bypass any credential checking in case the local machine user wishes to connect to resources that require permissions not present in his bare user account (i.e. group memberships, additional machine and share access, etc.)

The TGT is what allows SSO behaviour across all members and services of a windows domain.

share|improve this answer
well, the exam is major depending on linux machines :-) thank you anyway. – Master of Celebration Apr 18 '12 at 12:32
...and they would expect you to answer Windows questions because ? – adaptr Apr 18 '12 at 12:33
...they want me to compare some processes with e.g. Microsoft-like strategies, to enhance the difficulty level a bit :-) – Master of Celebration Apr 18 '12 at 15:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.