up vote 0 down vote favorite
share [g+] share [fb]

This is something I'm curious about. There is a LAN consisting of Windows XP machines. There is an administrator account say admin-xyz which can be used to login to any of the machines on the network. But, when I run pwdump to get the password hashes on a machine, I dont see the admin-xyz account. I am just curious as to how the authentication happens. Can someone please shed some light on this?

Thank You.

link|improve this question
is this 'admin-xyz' a domain admin account? – DanBig Dec 30 '09 at 20:42
yes Dan, i think it is.So, in that case how does the authentication happen ? – Joe Dec 30 '09 at 20:43
Thats domain authentication, which authenticates against the domain controller. – DanBig Dec 30 '09 at 20:46
Just keep in mind that using tools such as pwdump may not be permitted on a corporate network, where it's often considered to be security violation. – John Gardeniers Dec 30 '09 at 23:32
feedback

1 Answer

up vote 2 down vote

Most likely it's only dumping the LOCAL hashes from the SAM, and you are looking for the domain admin account which is not stored locally.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard