1

My computer is joined to a Window domain named "acme.local". However when I login into the computer, I only specify

acme\username --> notice ".local" is not specified

and not

acme.local\username

But I am still able to login, why ?

I would believe acme.local will resolve to a DomainController's IP, but how does "acme" itself get resolved ?

Is the resolution done via NetBios or DNS when speciying "acme\username"?

If it is done via DNS and my primary DNS suffix is acme.local , wouldn't specifying acme alone, result in the system attempting to resolve acme.acme.local instead ?

2

The answer to your question is not related to DNS.

When you create an Active Directory domain, amongst other things, you need to specify the domain name and the domain NetBIOS name. The domain name is the FQDN of your domain (acme.local). The domain NetBIOS name is by default (and usually never changed) the first part of your FQDN (acme) and also referred to as the pre-2000 domain name or legacy domain name.

When you log on to a machine with a domain user account, you can either

  1. user the User Principal Name (UPN): user@acme.local,
  2. the down-level logon name: ACME\user
  3. just the user name (SAM Account Name): user

Regardless of what method you chose for authentication, the computer is always sending the username to the domain controller of the currently joined domain (which is resolved by DNS). From comments: If you pull down the drop down for the local computer you do not authenticate against the domain.

The down-level logon name is derived from the NetBIOS name. If you chose acme, the downlevel logon name is ACME (which in reality is case-insensitive).

If you omit the down-level logon name, Windows always authenticated towards a domain controller of the currently joined domain.

(For the record: You can add multiple UPN suffixes per domain.)

Edit:

You can use nbtstat -n to find the NetBIOS domain name of the currently joined domain.

I found some sources:

3
  • 2
    It will always authenticate against the selected domain. If you pull down the drop down for the local computer you do not authenticate against the domain.
    – Nick Young
    Jan 18 '16 at 13:12
  • great I think this now encompasses the complete answer. +1
    – Nick Young
    Jan 18 '16 at 14:06
  • @Daniel thanks for the reply. As you mentioned "no matter which method for authentication is chosen, the computer is always sending the username to the DC of the currently joined domain" --> how does the computer find the DC ? to add-on, if we specify acme/username when we logon, what happen in the background actually, does the system use NETBIOs to find the DC ?
    – tiongmaru
    Jan 18 '16 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.