Chapter 24 · Windows Authentication

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is the difference between authentication and authorization?
  2. Where does a local account's password hash live?
  3. Why does Windows store a hash instead of the password?
  4. What does an access token contain? Name at least four things.
  5. What is the SID of the built-in Administrators group, and what is RID 500?
  6. In an ACL, what happens if one ACE denies and a later ACE allows the same right?
  7. Which protocol is the default in a domain: NTLM or Kerberos?
  8. What does LSASS do?
  9. Which command lists saved credential names from Credential Manager?
  10. Which program starts the user's shell (explorer.exe) after a successful sign-in?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Authentication vs authorization

Authentication is proving who you are (done once at sign-in). Authorization is deciding what you may do (done each time you open an object).

2. Local password hash

In the SAM database (Security Account Manager), at HKEY_LOCAL_MACHINE\SAM. It is protected, so normal users cannot read it.

3. Why a hash

A hash is a one-way scramble. Windows hashes what you type and compares it to the stored hash, so it never needs, or keeps, the real password.

4. Token contents

User SID, group SIDs, privileges, integrity level, logon session ID, token type (primary or impersonation). Any four.

5. Administrators SID and RID 500

The group is S-1-5-32-544. RID 500 (the last number of a SID) marks the built-in Administrator account.

6. Deny and allow

Deny wins. Windows keeps deny entries ahead of allow entries and stops at the first deny that matches.

7. Domain default

Kerberos. NTLM is the older fallback.

8. LSASS

The Local Security Authority: it receives credentials, uses authentication packages to check them, creates the logon session and token, and applies security policy and auditing.

9. Saved credentials

cmdkey /list

10. Starting the shell

userinit.exe, started by Winlogon, which then starts explorer.exe with your token.

UNDERSTANDING QUESTIONS

Q1. Why does Windows use SIDs in permission lists instead of user names?

Answer Names can change and can be reused. A SID is unique and is never reused. If you delete an account and make a new one with the same name, it gets a new SID and none of the old permissions. Windows looks up the name only for display.

Q2. Why is the Secure Attention Sequence (Ctrl+Alt+Del) useful?

Answer It goes straight to Winlogon, and no normal program can intercept or imitate it. This stops fake sign-in screens that try to steal a password. Winlogon shows the real screen on a protected desktop.

Q3. Why is the token described as a "snapshot"? What practical problem does it cause?

Answer The token is built once at sign-in using the groups and privileges you had at that moment. If an administrator adds you to a group later, your running programs do not see it until you sign out and in again. So you can still get "Access is denied" until a new sign-in.

Q4. How does a challenge-response protocol like NTLM prove knowledge of a password without sending it?

Answer The server sends a random challenge. The client mixes it with a secret derived from the password and sends the result. The server does the same with its own copy and compares. Each challenge is new, so an old recorded answer does not work, and the password itself is never sent.

Q5. Why is a Windows Hello PIN safer than a password, even though it is shorter?

Answer The PIN only works on that one device. It unlocks a private key stored in the TPM, and the key signs requests. The PIN is never sent to a server, a stolen PIN is useless without the device, and the TPM locks after too many wrong guesses.

SCENARIO QUESTIONS (Troubleshooting)

S1. An administrator adds you to the "Finance" group, but you still get "Access is denied" on the Finance folder. What do you try first?

Answer Sign out and sign in again (or restart). Your token was created before the group change and does not include the new group. After a fresh sign-in, `whoami /groups` should list it.

S2. A laptop joined to a company domain cannot sign in when you are at home, but a coworker's can. What is a likely cause and what do you check?

Answer Domain sign-in needs the domain controller, or a cached earlier sign-in. Possible causes: you never signed in on this laptop while connected (so no cache exists), or the cache is not allowed by policy. Also check that the clock is correct, because Kerberos fails when clocks differ by more than about five minutes. Ask IT, and connect to the VPN or office network once.

S3. You see two processes named lsass.exe in Task Manager, and one is in a user folder. What do you do?

Answer Be suspicious: the real `lsass.exe` is in `C:\Windows\System32`, there is only one, and it runs as SYSTEM. Disconnect from the network if possible, run a full scan with your antivirus, and ask for help. Do not try to dump or inspect lsass yourself.

S4. A shared folder on a home NAS keeps connecting as the wrong user after you changed the NAS password. What is the cause and the fix?

Answer An old, saved credential in Credential Manager (Windows Credentials) is being used automatically. Open Credential Manager, remove or edit the entry for the NAS, then connect again and enter the new password.

S5. You delete a user and re-create one with the same name, but she cannot open her old files, even though the permissions list "her". Why?

Answer Permissions use SIDs, not names. The new account has a new SID, so the old entries (now shown as an unresolved SID number) no longer match. Re-grant the permissions to the new account, or restore the original account.

INTERVIEW QUESTIONS

I1. Walk me through what happens when a user signs in to Windows.

Answer Winlogon manages the sign-in on the secure desktop (optionally after the Secure Attention Sequence); LogonUI shows credential providers; the chosen provider collects the credentials and Winlogon passes them to LSASS; LSASS uses an authentication package (MSV1_0 for local or NTLM, Kerberos for domain) which checks the SAM or asks the domain controller; on success LSASS creates a logon session and access token; Winlogon starts userinit.exe, which starts explorer.exe with that token; all later processes inherit the token.

I2. Explain DACL and SACL.

Answer The DACL lists who is allowed or denied access to an object and is used for authorization. The SACL lists which accesses should be audited (logged) and is used for auditing. Both are in the object's security descriptor, along with the owner.

I3. What is the difference between a primary token and an impersonation token?

Answer A primary token is the main identity of a process. An impersonation token is a temporary identity that a thread borrows, so a server can act with the client's rights for one request and then drop it.

I4. Compare NTLM and Kerberos.

Answer NTLM uses challenge-response, is older, does not authenticate the server, and may involve the server asking the domain controller each time. Kerberos uses tickets from a KDC (a TGT and then service tickets), allows single sign-on and mutual authentication, and needs synchronized clocks. Kerberos is the default in domains.

I5. What is UAC doing to an administrator's token?

Answer At sign-in an administrator gets two tokens: a filtered one (admin groups deny-only, fewer privileges, Medium integrity) used by default, and a full one (High integrity). The full token is used only after the user approves a UAC prompt, so ordinary programs do not run with full power.

PRACTICAL TASK

Write a one-page "identity card" for your own account. Using the lab, record: your user name, your full SID (and what the RID tells you), five groups from whoami /groups and what each means, three privileges and whether they are enabled, your integrity level, the sign-in methods in Settings, and the number of saved entries in Credential Manager. Add a small diagram of your own sign-in chain, from keyboard to explorer.exe.

Why This Matters

When you get "Access is denied", you can compare your identity card with the object's permissions and find the reason. It also trains you to see a signed-in PC as a set of tokens and SIDs, not just a user name.

CHAPTER SUMMARY

  • Accounts are local, Microsoft or domain. Passwords are stored as hashes, never as plain text.
  • Authentication proves who you are (once). Authorization decides what you may do (each time).
  • An access token (user SID, group SIDs, privileges, integrity level, logon session) is built at sign-in and copied to every process.
  • A SID is a permanent identity: RID 500 is Administrator, 501 is Guest, 1000 and up are new users. SYSTEM is S-1-5-18, Everyone is S-1-1-0.
  • An ACL is a list of ACEs (allow or deny + SID + rights). The kernel walks the list in order, and a deny wins.
  • NTLM is legacy challenge-response. Kerberos uses tickets from a KDC. Windows Hello uses a PIN or biometric to unlock a device key held in the TPM.
  • Credential Manager saves sign-ins in an encrypted vault protected by DPAPI.
  • The chain: keyboard, Winlogon, LogonUI, credential provider, LSASS, MSV1_0 or Kerberos, SAM or domain controller, token, userinit, explorer.exe.
  • Previous: the security architecture chapter in this part
  • Next: the next chapter on Windows Permissions
  • Related: Chapter 24 Overview