Re: Are Active Directory passwords encrypted?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Eddie,

EddieF wrote:
We're trying to make sure passwords are encrypted on all of our systems. Just want to verify that passwords are automatically encrypted in Active Directory and on the domain controllers. Also, are the local account passwords encrypted on file servers? If not are there any suggestions on how to do this? Thanks in advance for any help and suggestions.

They are stored as hashes - no chance you get to see the real passwords in the database. Passwords aren't transmitted over the wire - always the hashes. What happens when you connect to a file is you basically acquire a service ticket at the DC by encrypting a message from the DC with your hashed password. The DC verifies the encrypted answer and - if the password is correct - hands out a ticket for the file server service. Go then connect to the file server and show that ticket. Have a look at the well-known kerberos authentication protocol - that's what it is.

cheers,

Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste
.

Relevant Pages

  • Re: [Full-disclosure] Filezillas silent caching of users credentials
    ... My point is, if you are granting access to this password file to everyone, the security hassles you're going through are all useless. ... Users/admins should be limiting access to the passwords file in the first place. ... encrypting the file would have prevented this mess - somewhat. ...
    (Full-Disclosure)
  • Re: how to hide oracle instance name within dbi code??
    ... See for example the way Mozilla stores passwords ... If the program is used non-interactively, encrypting ... putting them into configuration files still makes a lot of sense: ... That's the environment of the process itself. ...
    (perl.dbi.users)
  • Re: password encode and decode ?
    ... These passwords are encrypted when being written ... to the database and have nothing to do with encrypting passwords between the ... client browser and the server. ... As both the database and PHP are server-side, ...
    (comp.lang.php)
  • Re: creating a key from a password
    ... > keys from passwords. ... I figured I could use md5 or sha on the password ... > for encrypting files with blowfish so since i already have the bf alg ... authenticate the message (encryption without authentication is often ...
    (sci.crypt)
  • File Shares/User names and passwords being remembered
    ... We've got a Win2k3 machine set up as a simple File Server (Active ... Connecting in using Windows XP machines initially the machines request ... user names and passwords which is good. ...
    (microsoft.public.windows.server.general)