Status: ✅ COMPLETE
Scope: How Windows decides who you are and what you may do: accounts, passwords and hashes, access tokens, SIDs, ACLs, NTLM, Kerberos, Windows Hello, Credential Manager, and the full chain from typing a password to seeing the desktop
Time to complete: 90–120 minutes of reading + lab
Prerequisites: The earlier chapters on how Windows works (see the links in the introduction) and the security architecture chapter before this one
What you'll know after: What happens in the seconds after you type your password, what an access token and a SID are, how Windows checks permissions, the difference between NTLM and Kerberos, and how to look at your own identity with safe, read-only tools
INTRODUCTION
Every time you sign in, Windows has to answer a hard question: "Is this really you?" And every time a program touches a file, it has to answer a second question: "Is this person allowed to do that?"
These are two different jobs. The first is authentication. The second is authorization. This chapter shows how Windows does both, using plain words and everyday pictures: a bank account number, a festival wristband, a guest list at a door.
No special tools are needed. The lab uses only built-in, read-only commands that look at your own account. Nothing in this chapter asks you to attack, bypass or dump anything. It is all about understanding and defending.
For related background, see Chapter 6, Chapter 8, Chapter 17 and Chapter 19.
This chapter explains:
- The types of accounts (local, Microsoft, domain) and how passwords are stored as hashes
- The difference between "who are you?" and "what may you do?"
- What an access token is, and how every program you run carries one
- What a SID is, and why Windows trusts SIDs, not names
- How ACLs and ACEs are checked, and why a deny wins
- How NTLM, Kerberos and Windows Hello prove identity
- What Credential Manager saves, and how it is protected
- The complete chain: Winlogon, LogonUI, LSASS, authentication package, SAM or domain controller, token, explorer.exe
CHAPTER OUTLINE
- Section 1: Login and User Accounts
- Section 2: Authentication vs Authorization
- Section 3: Access Tokens
- Section 4: Security Identifiers (SIDs)
- Section 5: ACL and ACE (Authorization Mechanics)
- Section 6: Authentication Protocols
- Section 7: Credential Manager
- Section 8: What Happens When You Enter Your Windows Password (Complete Chain)
- Practical Lab: Authentication Exploration
- Knowledge Check
Chapter Status: Complete
Estimated reading time: 100 minutes
Practical time: 30 minutes
Knowledge check time: 30 minutes