Why does it take a long time for Windows 7 to show the failed login message when the wrong password is entered when it almost instantaneously lets you login if the password is correct?

Is it only me who is seeing this behavior?

  • What? can you rewrite your question please, it's difficult to understand. – Chopper3 Nov 22 '10 at 16:07
  • Sure, let me rephrase the question. – Biswanath Nov 22 '10 at 16:08
  • Is this PC on a domain? – Supercereal Nov 22 '10 at 16:12
  • I use the machine on and off the domain. – Biswanath Nov 22 '10 at 16:13

It is mainly to prevent quick brute forcing of passwords.

This blog article gives you much more information than you probably care for!

| improve this answer | |
  • Ben, I should learn more about my googling skills. Dropping off windows-7 from my query is giving me better results. Thanks for the link. – Biswanath Nov 22 '10 at 16:19
  • 3
    The linked blog post is a good one, but I would summarize it differently from this answer. "It is mainly" because when you type a wrong password, the local workstation needs to contact the domain controller to make sure the password is really wrong (e.g. if your password had been changed from elsewhere, and your local password cache had not yet been refreshed). The deliberate delay, to prevent quick brute forcing, doesn't kick in until you've typed a wrong password multiple times. – LarsH Apr 22 '14 at 3:09

So it takes longer to brute force a password.

If this computer is on a domain, using the right password will skip the domain lookup and verify against the cached credentials. If it can't use a cached credential then it has to contact a domain controller, which has several handshakes involved (Kerberos and LDAP at the minimum).

| improve this answer | |
  • Me too became too imaginative thinking on the lines of may be to prevent remote timing attack. – Biswanath Nov 22 '10 at 16:15

Most OSes (linux and windows are good examples) enforce a retry delay in order to prevent someone from scripting a login to the server and potentially brute forcing or locking out an account without a delay that will (potentially) allow the attempt to get noticed by someone getting failed login alerts. In addition the method of authentication (domain vs local) also has a performance hit on the authentication. Note that in the case of domain passwords the password is verified twice if it fails on a non pdc emulator DC.

| improve this answer | |

It 's deliberate.

If you miss it 2 or 3 time, it stole less than a minute of your life. But if you try to much, it will take your life.

| improve this answer | |
  • I have to vote this up as an explanation to scare users into putting some effort into typing their passwords correctly... – Bart Silverstrim Nov 22 '10 at 16:30

I just did a test since I have a similar setup. My machine is Win 7 domain PC, if I am connected to the network my DC is on and enter the password wrong it takes 30 seconds or so to tell me the PW is incorrect. However if I turn my Wifi off or connect to a different network it instantly tells me the password is incorrect. Probably a mix of what Chris S said below and communication between the Domain controller and PC.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.