## Logon Security

Initial UNIX logon security is based on authenticating the system user with subsequent access to system resources determined by file permissions. Windows NT security is based on the concept of access to objects. When a user is authenticated, an access token generates an access control list on an object.

The typical UNIX logon process consists of the following steps:

1. The user types in user name and password.
2. The password is encrypted using Data Encryption Standard (DES).
3. The encrypted password is compared to the password field in the password file (possibly by the Network Information Service (NIS).
4. If they match, logon proceeds.
5. A shell starts that runs with a uid and gid from etc/passwd.

The typical Windows NT logon process consists of the following steps:

1. WinLogon requests a user name and password. The user name and password are sent to the Local Security Authority (LSA) in the security subsystem.
2. LSA queries the Security Accounts Manager (SAM) to determine if the user name and password are authorized.
3. SAM checks the user name and password against information contained in the directory database.
4. If access is approved, LSA creates an access token with the granted access rights, and then passes the access token back to the WinLogon process.
5. WinLogon calls for a new process for the user, usually Explorer.exe, to which the user’s token is attached.

####

Interactive vs. Remote Logon

Interactive logon in Windows NT occurs when the user presses CTRL+ALT+DEL and provides information in the Logon Information dialog box, and the security subsystem goes through the steps previously listed.

Remote logon takes place when a user is already logged on to a user account and makes a network connection to another computer. The security-access token created during the interactive logon is assigned to the initial process created for the user. When the user tries to access a resource on another computer, the remote server authenticates the user again and creates a security-access token for the user. The security-access token is placed in a table stored on the remote server.

#### Secure Administrative Connections

Passwords exchanged among Windows NT computers are always encrypted. This is different than in most UNIX-to-UNIX communication where the security of the connection varies, depending on the service being used. For example, Telnet usually passes UNIX passwords in clear text, unless it has been modified to use Kerberos or another security system. Network traffic among Windows NT computers is not normally encrypted, but Virtual Private Networks (VPNs) can be used to prevent "sniffing attacks."

#### Trusted Path

Windows NT uses a Secure Attention Sequence (SAS) mechanism to prevent "Trojan-horse-style" programs from stealing logon and password information. The key sequence CTRL+ALT+DEL brings up the Logon dialog box when a user logs on or logs off a password-protected screen saver, making it hard for a program to steal a user’s credentials.

©1997 Microsoft Corporation. All rights reserved. Legal Notices.
Last Updated: December 1, 1997