Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller?

PS: I'm having a problem getting info on how this works on a low level, I think because I don't have googlable terminology, 'lil help?

share|improve this question
"Kerberos" comes to mind, but not sure if that's it. – Luc Sep 10 '12 at 17:34
After spending a while reading Phillip Nordwall's links this is my understanding. From a network traffic point of view (excluding the AD stuff going on inside the domain controller) authentication IS Kerberos. Without explaining the whole protocol the DC encrypts a token with the hashed version of the users password and the client decrypts with the hashed version of the password. The very fact that the DC has the hashed password is what proves it's a valid DC. – Keith Loughnane Sep 11 '12 at 14:55

If there is a trust relationship already established Kerberos is used.

NTLM is used when

  1. authenticating to a machine using an IP address
  2. if the machine is in a different forest that is using NTLM
  3. the target machine isn't in the domain
  4. the machines are not on the domain
  5. if firewalls block the kerberos traffic

Microsoft has information on their use of kerberos at

You can also find more information at the following links:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.