Understanding Logon and Authentication in Visual C#.NET

Painting Denso QR Bar Code in Visual C#.NET Understanding Logon and Authentication

16

When a user logs on to a computer, a series of steps begins that makes up the authentication process. Authentication validates user identity and defines resources that a user can access. Windows operating systems use NTLM or the Kerberos V5 authentication protocol. Authentication is mostly automatic, but understanding the protocols, policies, and other elements involved can help you configure and manage authentication and strengthen security. In this chapter: Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .640 Working with Authentication Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .650 Managing Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .659 Setting Authentication Policy Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .670 Auditing and Troubleshooting Logon and Authentication . . . . . . . . . . . . . . . . . .679 Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .681

For more information about authorization, see 17, Managing Authorization and Access Control. For more information about authentication by using remote access services, see 25, Connecting Remote Offices. For more information about Kerberos V5 authentication, see Authentication in the Distributed Systems Guide of the Microsoft Windows 2000 Server Resource Kit. For more information about implementing security for Windows-based client computers and servers, see the Microsoft Windows Security Resource Kit, Second Edition (Microsoft Press, 2005).

Part III:

Microsoft Windows XP Professional assures security by using the following processes:

Authentication, which verifies the identity of something or someone Authorization, which allows you to control access to all network resources, such as files and printers

Authentication takes place all around us. For example, you are required to authenticate your identity and purpose when crossing international borders or completing business transactions. Similarly, in Windows, the identity of a user or computer must be authenticated before the user or computer has access to files, folders, and applications. The following discussion provides detailed information about the configuration, management, and maintenance of authentication functions for Windows XP Professional based clients, whether they are stand-alone clients or members of an Active Directory or other network environment.

If you are already familiar with the security model in Microsoft Windows NT version 4.0 and Microsoft Windows 2000, you will recognize many of the features in Windows XP Professional. At the same time, you will also find a number of familiar features that have changed significantly and new features that will improve your ability to manage system security. The following are among the changed security-related features in Windows XP Professional:

Everyone membership. The built-in Everyone group includes Authenticated Users and Guests, but it no longer includes members of the Anonymous group.

By default, on Windows XP Professional systems that are not connected to a domain, all attempts to log on from across the network will be forced to use the Guest account. In addition, on computers that are using the simple file sharing security model, the Security Properties dialog box is replaced by a simplified Shared Documents Properties dialog box.

Simple file sharing. Administrative ownership. In Windows NT 4.0 and Windows 2000, all resources such as files and folders that are created by a member of the Administrators group belong to the group as a whole. In Windows XP Professional, these resources by default belong to the individual who creates them. Encrypting File System (EFS) recovery agent. In a Windows 2000 environment, if you attempt to configure an EFS recovery policy with no recovery agent certificates, EFS is automatically disabled. In a Windows XP Professional environment, the same action enables users to encrypt files without a Data Recovery Agent (DRA). In an environment with computers running both Microsoft Windows XP and Windows 2000, an empty

16: