Hello,
I am trying to find an answer, preferably a Microsoft document/forum/something that says that the following is 'as designed'.
I bought a new PC, have not yet joined it to the domain, but did create a local user account with the same username and password as my domain account. Hooked the laptop up to the network and went to a remote system, where it logged on without prompting me for credentials. Weird. I reset my password to something completely different, logged off then back on, tried to access the same system, and prompted me for credentials just as it should. A quick look in the Security log on my DCs reveals that i was granted permission to do on that laptop and it authenticated me as my domain account.
So my question is: If the local account is the same username and password as my domain account, when i go to a remote system, does it look at the local account first, see if it can authenticate, and if it cant, then prompt?
I would love a real article by MS that proves this is by design and not some security glitch on our end. I am running Windows 7 when doing this.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Yeah if the local account credentials match on the non-domain machine to what the domain credentials are then it will pass authentication.
"when i go to a remote system, does it look at the local account first, see if it can authenticate, and if it cant, then prompt?"
Yes I believe the process you mentioned is how it works.
That is perfectly normal behavior since NT; the following article mentions Windows 2000, but the basics are still the same.
"[...]
Windows 2000 behavior:
When a logon attempt is made, three things are specified: the user name, the encrypted password, and the domain name. All fields are optional. The following simplified logic is used by the Net Logon service to process these logon credentials:
1. If no domain is specified, or if the domain that is specified is the local domain (a computer or NetBIOS name for a member server), the local SAM database validates the logon. If an account is found, and the credentials match, the logon proceeds. If no account is found, and the domain is specified, the "account not found" message is returned.
[...]"
Windows NT User Account Database Search Order
http://support.microsoft.c
And I have to correct KCTS and Zouleous here: the credentials of the local user are NOT automatically matched against domain credentials, they're only matched against the host's *local* database. Only if a non-domain user connects to a DC will the client user credentials be matched against the domain database (because that's what the DC considers to be his local user database).
Ok, so how can this be stopped? From a security standpoint this is a huge hole. If an employee came into the building with his personal laptop, created a local user account with the same account name as his domain creds and setting the password the same, he could unleash fury with unknown viruses on his laptop that he could deploy, even to a file server. He could delete all data on a file server that his domain accounts has access to.
Nope, there isn't; the user doesn't even need to create a local account; he can as well connect a network drive using different (namely his domain) credentials when mapping; that's by design.
To prevent network access from unauthorized machines, you'd need to start with 802.1X: http://en.wikipedia.org/wi
Business Accounts
Answer for Membership
by: KCTSPosted on 2009-10-27 at 18:40:29ID: 25679331
This is normal - it checks the credentials against matching credentials in the domain to allow it to access shares in a workgroup like fashion