Need Help on the following questions.

  1. When a users login (on a computer in the network) is validated against AD what is/are the authentication method used?
  2. When a users login is validated in Windows NT environment (not AD) what is/are the authentication method used?
  3. If all user's account is on AD, is it possible to change the authentication mechanism only (or protocols) from AD to NT and vice versa (if possible)?
  4. If part/whole of question 3 is valid, where should one look to change these authentication methods ?
  5. What is the difference between AD and Windows-NT authentication ?

Windows server 2008 Domain controller used.


  • For clarification: it sounds like when you say "NT (not AD)" you really do mean Windows NT 4.0, domains, pre-AD. You're asking about the differences between NT 4.0 and AD for domain authentication, not the difference between AD and modern stand-alone machine login authentication. – mfinni Apr 30 '10 at 18:34
  • Second comment- why do you want to do items 3 and 4? You can use a different GINA at the workstation to connect to something besides AD, but those aren't commonly found. Unless you've got an old Netware setup; their replacement GINA allowed for auth via NDP and/or AD. – mfinni Apr 30 '10 at 18:38
  • 1
    this smells too homeworkish to me – Jim B Apr 30 '10 at 20:24
  • Even looks like copy and paste from a question sheet. If this is homework please declare it as such. – John Gardeniers May 1 '10 at 0:51
  • Thanks for your comments Jim & John... These are not questions some question papers. These are questions in my head to understand a clients issue. We dont deal with AD setup/config however an application that we support offers Windows NT authentication or Windows AD authentication. It appears that it works here with either of the options set in our local AD environment but not the case in Client's environment and talks about some authentication mechanism failure when the options are set to AD authentication. Windows server 2008 is Domain controller. – rockbala May 1 '10 at 3:05

I'm not sure what exactly you're looking for on how AD vs. local machine authentication works, but you can switch between the two. The topic is enough to take up volumes.

The short of it is that active directory queries are sent to active directory servers, while local authentication is handled using the SAM in the registry. If you want to switch methods, you'd authenticate as \localmachinename\username instead of \activedirectory\username right at the opening login prompt when you turn on the machine (some versions of windows let you change the "method" in a third box, under username and password, where it lists domains available or the local computer name (this computer).

The difference? One is local to that computer only, one is providing a way for you to have an account valid on any machine that is a member of the domain. AD centralizes the management of the accounts and centralizes passwords and user management. If you have more than a couple Windows computers, AD can be very helpful and almost necessary for running the IT infrastructure.

This sounds a little bit like a homework question...is it? Is there a particular issue that these questions are aimed at solving that the community could possibly help with that you're driving at?

| improve this answer | |
  • Local machine authentication is good for individual computers - isn't it. I am not talking about individual computers. You are right AD centralizes the account... So when user types in the AD user name and password on a computer for the domain and clicks login (what happens in the background) I am sure that his/her login credentials are verified (or authenticated) by AD, right ? If so, what mechanism is used for Authentication. is it challenge requests etc (NTLM, Kereberos etc) ? So how was this happening before AD evolved. (I'd think they have Windows NT nw - what's da mechanism there) – rockbala Apr 30 '10 at 17:42
  • In AD, it's Kerberos. There are some settings where if Kerberos fails to connect, the machines can use older auth methods, but those can be locked down via GPO to only allow secure methods. For pre-AD NT domains, it was NTLM, of various versions. – mfinni Apr 30 '10 at 18:36

The detailed information you are looking for is in the server 2008 resource kits. As Bart mentioned this is volumes of information (literally) eg (locating a domain controller in DNS etc.)

| improve this answer | |
  1. It depends. Within the same forest? Should be Kerberos. Within a second forest that shares a forest level trust? Should also be Kerberos. Through an external trust? NTLM.
  2. If you mean an NT 4.0 domain, there is no Kerberos support. NTLM.
  3. And you wouldn't want to. Kerberos is considered more secure than NTLM for a good set of reasons.
  4. N/A.
  5. Kerberos, which AD uses natively uses a ticketing system which reduces hits against the DC. It also supports delegation, which NTLM does not. And it uses a timestamp, which reduces the likelihood of a replay attack working. Those are some of the reasons Kerberos is preferred.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy