netlogon service

Yes, only machines in a domain make use of the Netlogon service.

The NT NetLogon service performs these functions:

Establishes a Secure Channel between systems,
Participates in Domain logins (not Local logins),
Performs Domain Synchronisation,
Participates in Backup Domain Controller (BDC) promotions
Secure Channel
NetLogon provides a secure channel between systems. There are Secure Channels setup between machines as shown in the following table:

From To Why
Member server or workstation Local Domain Controller Domain and pass-through authentication
Local Domain Controller Domain Controller of trusted domain Authentication of accounts form Trusted Domain

When a machine joins a domain, a machine account is created for it. This is similar to a normal user account, but doesn't show up in user manager etc. For a machine called "FRED", the machine account will be called "FRED$". This account has a password associated with it. This password is automatically changed at regular intervals. This account and password are used by NetLogon to establish a Secure Connection to the Domain Controller.

Domain Controllers use a similar system to setup secure channels with the Domain Controllers of Trusted domains.

When looking for a Domain Controller to attach to, the NetLogon service retrieves a list of Domain Controllers from WINS (if you're using it) by resolving the name "DOMAINNAME [1C]" (if your domain is called "DOMAINNAME"!). It sends a request to establish the secure channel to the first (twenty??) entries in the list. It establishes the channel with the one that replies first.

local authentication is dealt with by the local security authority (lsass.exe)

network authentication (out of AD) is done via NTLMv2, if not available NTLM and ultimately Lan Manager
(if both machines are W2k at least, or ntsp4 NTLMv2 will be used).

take a look at:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/576.mspx

there's some info on the kind of authentication used, etc. for workstations.

thanks, but i read an article very similar at http://www.snakegully.nu/tech/netlogon.html#domainlogin

my question refers to why the netlogon is not used at the workgroup level, and is this still secure?

cheers ralonso, i'm sure on my AD setup here kerberos is used.....

Workgroups only use local logins, as mentioned by ralonso, and NetLogon deals primarily with domain logins. the Netlogon service is a dedicated channel for trusts and the replication/querying of a single master SAM database. There is no need for NetLogon to be utilised in workgroup security, as the credentials are verified by the local machine rather than having to be passed through the NetLogon service to a domain controller.

it is still secure, but the security of every server is only as good as the security policy applied to it.

authentication works the following way (workstation member of a domain):

1 - The machine starts
2 - network services are started
3 - The netlogon service in the workstation opens a connection to the nearest (-ish) DC
4 - The workstation logs on to the domain (account WORKSTATION$)
The windows screen comes on

5 - The user hits ctrl+alt+del
6 - The machine uses the previously established secure channel (if still alive) or creates a channel
7 - The DC provides a list of all DC with a trust relationship where the user can log on (that's why sometimes it takes a few seconds to appear the login screen)

The login screen comes up
8 - When the user types in username and password, the LSA collects the info and hands it over to the local netlogon service.
9 - If the Netlogon channel is still available, the info is sent to the domain controller.
10 - The DC generates a session token with the SID for the user account, plus all SID's for global groups of which the account is member.