I've been trying to wrap my head around how computers are identified and granted access to a Windows domain. More specifically, I've been asking myself if whatever mechanism is involved really prevents faking the identity of a computer or not, and if so, then how?
Assuming one has full access to a computer that is already on the domain, I'm thinking that whatever information the domain controller relies on for identification could be replicated on another computer.
(As I understand it, what identifies a computer in a domain is one LSA shared secret. According to this Technet blog, LSA shared secrets can be decrypted and extracted.)
According to this answer to a question on Server Fault about re-joining a wiped computer to a domain it used to be on, and here on Information Security, this one about similar topics, it's not possible to have a computer assume even an existing identity in a windows domain.
If this is true, I would like to know the principle of behind this prevention mechanism. The answers given in the above links to me do not contain enough insight.
If the above claims are false, and it is in fact possible to fake the identity of a computer on the domain given the right circumstances, I would like in summary to know what steps would be involved.
Thank you beforehand for any effort to help me out.