Section 2: Authentication vs Authorization

The Big Picture: The Hotel

Picture a hotel. At the front desk you show your passport and get a key card. That is one step. Later, you tap the card on a door. The door decides if your card opens it. That is a second, separate step.

• The front desk answered: "Who are you?" — that is authentication.
• The door answers: "Is this person allowed in this room?" — that is authorization.

These two words sound alike and people mix them up. Keep them apart in your head. Every security question in Windows is one of the two.

        AUTHENTICATION                    AUTHORIZATION
        "Who are you?"                    "What may you do?"

  you ──► password / PIN / finger ──►   token ──► checked against ──► allow
          Windows checks the proof                 the object's list    or
          happens ONCE, at sign-in                 happens MANY times   deny

2.1 Authentication (Who You Are)

What it is: Authentication is the process of proving your identity. You present a credential, and the system checks it. The result is simple: accepted or refused.

There are three classic kinds of proof, called factors:

Using two or more factors together is called multi-factor authentication (MFA). It is stronger, because a thief must steal more than one thing.

What authentication produces. If the proof is good, Windows does not keep asking for it. Instead it creates a logon session and an access token (Section 3), which together say, "this person has already been checked." Every program you start afterward carries that token. Think of it as the wristband you get at a festival gate: you show your ticket once, and the wristband proves it afterwards.

Who does the checking? A Windows part called LSASS (the Local Security Authority Subsystem Service, file lsass.exe) does it, using the account database on the PC or the domain controller. Section 8 follows the whole chain.

Authentication is NOT about permission. Being known does not mean being allowed. A valid guest or standard user is fully authenticated, yet cannot change system files.

2.2 Authorization (What You Can Do)

What it is: Authorization decides what an authenticated user may do with each specific thing: read a file, delete a folder, shut down the PC, start a service.

It happens again and again, every time a program asks to open something. When you double-click a file, the program that opens it asks Windows for access. Windows then checks:

1. Who is asking? (your access token: your SID, your groups, your privileges)
2. What do they want? (read? write? delete?)
3. What does the thing say? (its list of permissions, the ACL from Section 5)

 Program (running as you)           Windows security check
 ───────────────────────            ──────────────────────
 "Open D:\Reports\plan.xlsx   ──►   token says: Harshil, group Staff
  for WRITE"                        file's list says: Staff may READ only
                                    ─────────────────────────────────
                               ◄──  ACCESS DENIED

Windows keeps the two jobs in different places:

The SRM is the kernel's "door checker." It compares your token with the object's access list. It lives in the kernel, so no normal program can fool or skip it. (The next chapter on Windows Permissions covers this in detail. This chapter explains the mechanics.)

Two more ideas that belong to authorization:

• Privileges are system-wide rights, not tied to one file. For example, "may shut down the PC" or "may debug other programs." They live in your token (Section 3).
• Integrity levels are labels (Low, Medium, High, System) that stop a lower-trust program from changing a higher-trust one, even if the file permissions would allow it. A normal browser tab runs with lower trust than you do.

Authentication vs Authorization: Side by Side

Use the error message as a clue. "The user name or password is incorrect" is an authentication failure: Windows does not believe who you are. "Access is denied" is an authorization failure: Windows knows exactly who you are and said no anyway.

Common mistake: "I am an administrator, so I can open anything." Not always. Files can be set to deny you, and some system files are owned by special accounts. Being authenticated as an administrator does not remove the authorization check.

Summary