topic Re: Windows domain password hashing process in Tech Talk

Windows domain password hashing process

ericgeater — Mon, 24 Aug 2020 02:37:00 GMT

Maybe my keyword google talents are just lacking. Continuing: I am culturally aware that a Windows AD server only keeps domain user password hashes for comparison. I just don't know which machine performs the hash.

Is it typically the client which hashes, then sends the hash data to the DC? Or (in less secure networks) is the password passed in plaintext across the network, then hashed and compared at the server?

Thanks!

Re: Windows domain password hashing process

AlecTrevelyan — Mon, 24 Aug 2020 09:47:28 GMT

You need to be a little more specific about which authentication mechanism is in use, but it will be either NTLM or more likely Kerberos. There are also subtle variations in how the mechanisms work depending on the Windows version and / or the Domain Functional Level that's been enabled.

However, some basics of how both of these mechanisms work and how to define which one is in use can be found in the link below - this will hopefully give you a good starting point:

https://answers.microsoft.com/en-us/msoffice/forum/all/ntlm-vs-kerberos/d8b139bf-6b5a-4a53-9a00-bb75d4e219eb

Re: Windows domain password hashing process

ericgeater — Mon, 24 Aug 2020 14:08:24 GMT

That was a great starting point. It looks like both NTLM and Kerberos perform the hash on the client, in different stages.

This wouldn't have come up at all, except I remember seeing manuals describe external VPN connections via LDAP pass authentication traffic over the network in the clear. That raised my curiosity about internal client-server traffic, and whether Windows computers handled domain passwords the same way (or not).

Re: Windows domain password hashing process

wimremes — Tue, 25 Aug 2020 11:43:06 GMT

Turns out there is A LOT going on when you enter your password into a windows machine:

https://twitter.com/SteveSyfuhs/status/1297957799079510018?s=20