Network Access Validation Algorithm and Example

• Microsoft Windows NT Advanced Server version 3.1
• Microsoft Windows NT Server versions 3.5, 3.51, 4.0

The following is a simplified algorithm that explains how Windows NT Advanced Server account validation is observed to function during network access. This discussion does not cover the internal workings of this process. With this information, you can predict Windows NT network logon behavior under deterministic conditions.

Keep in mind when following this article that the local database is the ONLY database on a domain controller. But on the other server and all workstations the local database is different than the domain controller.

NOTE: All references to Windows NT Advanced Server in this article also include Windows NT Server.

Background Information

When two Microsoft network systems communicate over a network, they use a high-level protocol called server message block (SMB). These commands are embedded within the transport protocols like NetBEUI or TCP/IP. When a client carries out a NET USE command, it sends out a "SMB Session Setup and X" frame.

In Windows NT, the Session Setup SMB includes the user account, a function of the encrypted password and login domain. An Advanced Server will look at all of this information to determine if the client has permissions to complete the NET USE command.

Algorithm

Windows NT workstation sends the following command to an Advanced Server:

   NET USE x: \\server\share

    Login Domain, User Account and Password.

    It checks its own Domain SAM[Security Account Manager]database for
        a matching account.
    If  it finds a matching account then
        The SMB password is compared to the Domain Database password.
        If  the password matches then
            The Command Completed Successfully.
        If  the password does NOT match then
            User is prompted for a password.
                It is retested as above.
            System error 1326 has occurred.  Logon failure: unknown
            user name or bad password.
        End
    If  it does NOT find the account in the domain SAM database then
        Guest permissions are tested.
        If  the Guest account is Enabled
            The Command Completed Successfully.
        If  the Guest account is Disabled
            * See Note A.
            User is prompted for a password.
            System error 1326 has occurred.  Logon failure:
                unknown user name or bad password.
        End

        Server TRUSTS then
    The Advanced Server will do pass through authentication.  The
        network logon request will be sent to an Advanced Server in the
        specified Trusted Domain.
    The Trusted Domain Advanced Server checks its own Domain database
        for a matching account.
    If  it finds a matching account then
        It looks to see if the Account is a Local or Global Account.
        If  the Account is Local then
            Guest permissions on the Original Server are tested.
            If  the Guest account is Enabled
                The Command Completed Successfully.
            If  the Guest account is Disabled
                * See Note A.
                User is prompted for a password.
                System error 1326 has occurred.  Logon failure:
                unknown user name or bad password.
        End
        If  the Account is Global
            The SMB password is compared to the Domain Database
                password.
            If  the password matches then
                The Command Completed Successfully.
                * See Note B.
            If  the password does NOT match then
                User is prompted for a password.
                    It is retested as above.
                System error 1326 has occurred.  Logon failure:
                unknown user name or bad password.
        End
    If  it does NOT find the account in the Trusted domain
            database then
        Guest permissions are tested on the ORIGINAL Advanced
            Server -NOT the Trusted Advanced Server.  * See Note C.
        If  the Guest account is Enabled
            User will have original server guest access.
            The Command Completed Successfully.
        If  the Guest account is Disabled
            * See Note A.
            User is prompted for a password.
            System error 1326 has occurred.  Logon failure:
                unknown user name or bad password.
    End

        Server. [A Domain was specified but it was not
        recognized by the Server as a Trusted Domain or
        its own.]
    It  will check its own Domain Account Database for
        a matching account
    If  the Advanced Server finds a matching account then
        The SMB password is compared to the Domain Database password.
        If  the password matches then
            The Command Completed Successfully.
        If  the password does NOT match then
            The User is prompted for a password.
                It is retested as above.
            System error 1326 has occurred.  Logon failure: unknown
            user name or bad password.
    End
    If  it does NOT find the account in the domain database then
        Guest permissions are tested.
        If  the Guest account is Enabled
            The Command Completed Successfully.
        If  the Guest account is Disabled
            System error 1326 has occurred.  Logon failure:
            unknown user name or bad password.
    End

    The Advanced Server will treat this a local network logon.  It
        will check for a matching account in its own SAM Database.
    If  it finds a matching account then
        The SMB password is compared to the SAM Database password.
        If  the password matches then
            The Command Completed Successfully.
        If  the password does NOT match then
            The User is prompted for a password.
                It is retested as above.
            System error 1326 has occurred.  Logon failure: unknown
            user name or bad password.
    End
    If  it does NOT find the account in the local SAM Database then
        The Advanced Server will Simultaneously ask another Advanced
            Server in each Domain that it Trusts if it has account that
            matches the SMB account.
        The first Trusted Advanced Server to reply is sent a request to
            perform pass through authentication of the client
            information.
        The Trusted Advanced Server will look in its own SAM Database.
        If  an account that matches the SMB account is found then
            It looks to see if the Account is a Local or Global
                Account.
            If  the Account is Local then
                Guest permissions on the original Server are tested.
                If  the Guest account is Enabled
                    The Command Completed Successfully.
                If  the Guest account is Disabled
                The user will be prompted for a password.
                No matter what password is entered, user will receive
                    "Error 5: Access has been denied."
            End
            If  the Account is Global
                The password specified in the SMB is compared
                    to the SAM Database password.
                If  the password matches then
                    The Command Completed Successfully.
                If  the password does NOT match then
                    The User is prompted for a password.
                        It is retested as above.
                    System error 1326 has occurred.  Logon failure:
                    unknown user name or bad password.
            End
    If  no Trusted Domains respond to request to identify the
        account then
        Guest permissions are tested on the Original Advanced Server -
            not the Trusted server.
        If  the Guest account is Enabled
            The Command Completed Successfully.
        If  the Guest account is Disabled
            System error 1326 has occurred.  Logon failure:
            unknown user name or bad password.
    End

Notes

1. At the point that the GUEST account is disabled and the user does not have an account, the Windows NT Server will still request a password. Although no password will meet its requirements, it will still request it. This is a security measure. It insures that an unauthorized user cannot tell the difference between a case where an account exists and when the account does not exist. Password prompting always occurs regardless if the account exists.

2. At this point, the following information is returned from the Trusted Domain in the Response: Domain SID, User ID, Global Groups Memberships, Logon Time, Logoff Time, KickOffTime, Full Name, Password LastSet, Password Can Change Flag, Password Must Change Flag, User Script, Profile Path, Home Directory and Bad Password Count.

      authentication and msv

      authentication and msv