This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Windows Authentication Package
Windows Authentication Package

Version management

Difference between version and

At line 1 added 65 lines
!!! Overview
[{$pagename}] identifies the the [Dynamic-Link Library] ([DLL]) loaded and used by the[Local Security Authority] ([LSA]) along with configuration information stored in the [Windows registry].
Loading multiple [{$pagename}]s permits the [LSA] to support multiple logon processes and multiple security [protocols].
%%warning
[LSA Protection] prevents unsigned [{$pagename}]s from being loaded.
%%
[Windows Logon] use [{$pagename}] to analyze logon data by following the rules and procedures set forth in a security protocol.
[{$pagename}] are responsible for the following tasks:
* Analyzing logon [data] to determine whether a security principal is allowed to [Access] a system or [Resource].
* Establishing a new logon [session] and creating a unique logon identifier for the successfully authenticated principal.
* Passing security information to the [LSA] for the principal's security [token].
[{$pagename}]s provide [Authentication Mechanism] services by implementing package-specific functionality for the LsaLogonUser and LsaCallAuthenticationPackage functions provided by the [LSA].
After a [Windows Logon] session is created and associated with a [principal], subsequent [authentication] requests made on behalf of the [principal] are handled differently than the initial logon. The [{$pagename}] does not create a new [Windows Logon] session nor return information for creating a [token]. The [{$pagename}] can, however, associate supplemental [credentials] obtained during a subsequent [authentication] with the principal's existing [Windows Logon] session. Supplemental [credentials] are obtained when access to a requested resource requires information beyond the [credentials] established by the initial [Windows Logon].
Msv1_0.dll is an [example] of a [{$pagename}] which accepts a user name and a [Hashed|One-Way Hash Function] [password], which it looks up in the [Security Account Manager] ([SAM]) [database]. Depending on the results of the lookup, the MSV1_0 [{$pagename}] accepts or rejects the authentication attempt.%%zebra-table
%%sortable
%%table-filter
||Component||Description
|Credssp.dll|Operates with [CredSSP] and is the default dynamic-link library (DLL) module that operates in the security context of [Winlogon].
|Netlogon.dll|Some of the services that [Netlogon service] performs include:\\maintains the computer’s [Schannel SSP] to a [Domain Controller].\\[Netlogon service] passes the user’s [credentials] through a [Secure connection] channel to the [Domain Controller] and returns the [AD DOMAIN] [SIDs] and user [Permissions] for the user.\\ Publishes service resource records in the [Domain Name System] ([DNS]) and uses [DNS] to resolve names to the [Internet Protocol] ([IP Address]) of [Domain Controllers].
|Msv1_0.dll| Operates with the [NTLM SSP] which uses [NTLM] [Authentication Method] [protocol]. [Extended Protection for Authentication] is enabled using the [Channel Binding] [token].
|Schannel.dll|Operates with the [Schannel SSP] and provides [Secure Socket Layer] ([SSL]) and [Transport Layer Security] ([TLS]) [authentication] [protocol]. This [protocol] provides [Mutual Authentication] over an encrypted channel.
|Kerberos.dll|Operates with the [Kerberos SSP] which uses [Kerberos] V5 authentication protocol. This protocol provides authentication using Kerberos protocol. [Extended Protection for Authentication] is enabled using the [Channel Binding] token.
|Wdigest.dll|Operates with the [Digest SSP] providing a Simple [Challenge-response Authentication Mechanism] that provides increased security over [Basic Authentication Scheme]. [Extended Protection for Authentication] is enabled using the [Channel Binding] [token]. For information about Extended Protection in Digest, see Digest Authentication Processes and Interactions.
|Pku2u.dll|The [PKU2U] [SSP] enables [Peer-to-peer] [authentication], particularly through the Windows 7 media and file sharing feature called Homegroup, which permits sharing between computers __that are not members of a domain__.
|Negoexts.dll|Operates with the [Negotiate SSP] to provide an method that negotiates the use of [SSPs] for applications and scenarios implemented by [Microsoft] and other software companies.
|Lsasrv.dll|The [Local Security Authority Subsystem Service] ([LSASS]), which both enforces security [policies|Politics] and acts as the security package manager for the [LSA].
|Samsrv.dll|The [Security Account Manager] ([SAM]), which stores__ local security accounts__, enforces locally stored policies, and supports [APIs].
|Secur32.dll|The authentication provider that exposes the [Security Support Provider] ([SSP]) interfaces to applications.
/%
/%
/%
!! [Windows Event Log]
[{$pagename}] is shown in the [Windows Event Log] fields within the [Windows Logon] process that only provides a "__hint__" at how the user tried to access the system.
If the logon was to a Windows resource and authenticated via [Kerberos], the [{$pagename}] field would list "[Kerberos]".
at its console, through Server Message Block (SMB) or Common Internet File System (CIFS) for shared-folder access, or through IIS. Some logon processes are authentication-protocol specific as shown in the chart below.
* [Winlogon] - Windows Logon Process
* [Schannel SSP] - Secure connection such as SSL
* KSecDD - Kernel Security Device Driver - A [kernel]-mode [Software library] of functions that implement the advanced [Local Procedure Call] (ALPC) interfaces that other [Kernel] mode security components, including the Encrypting File System (EFS), use to communicate with [LSASS] in user mode. KSecDD refers to the name of the file for this [Software library] which is in %SystemRoot%\System32\Drivers\Ksecdd.sys.
* Secondary Logon Service - [Run As]
* [IKE] - [Internet Key Exchange]
* HTTP.SYS - is a [web] [server] for ASP.NET Core that only runs on Windows.
* SspTest - Test program for the [NTLM SSP] service.
* dsRole - Directory Service function
* DS Replication - Directory Service function
* CredProvConsent - (user account control)
* [NTLM SSP] - Might also be [Anonymous] [authentication]
* advapi - implies it was a Web-based logon as IIS processes [Windows Logon] through the advapi Logon Process shows as [MICROSOFT_AUTHENTICATION_PACKAGE_V1_0]
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Chapter 5 Logon/Logoff Events|https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter5|target='_blank'] - based on information obtained 2020-04-27
* [#2] - [Authentication Packages|https://docs.microsoft.com/en-us/windows/win32/secauthn/authentication-packages|target='_blank'] - based on information obtained 2020-05-21
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop