schrags11

Using active directory, are all the users passwords also kept locally, and not just on the server?

wooch

A cached copy of the passwords are kept for logging in when not connected to the domain network.

The clients use NTLM to authenticate to the DC. If a DC isn't present, or the network cable is unplugged, the LSASS service uses the cached password information stored in the client PC's registry.

deftech

It depends on how the network is configured. The client machines could be set to cache passwords, but most places disable that if they are using AD.

__________________
Jordan M. Wigley
Aximsite.com
Email: jordan AT aximsite.com

.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Come join the friendly community at
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

schrags11

In the SAM file in the registry like regular users, by any chance, lol?

Howard2k

They still use NTLM? Aren't they using Kerberos now as the primary and NTLM2 as the backup?

Could be wrong. Not an NT geek anymore...

__________________
Always read stuff that will make you look good if you die in the middle of it.

deftech

Which registry key are you referring to?

In AD, the sAMAccountName is the same as a userid (with domain\ on the front of it).

__________________
Jordan M. Wigley
Aximsite.com
Email: jordan AT aximsite.com

.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Come join the friendly community at
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

schrags11

No, not a key, the whole file. (sam, security, default, etc). (Wanting to brute force it all summer, lol.)