2

It seems a simple question but I can't find the answer on Google or Windows support pages/forums.

If a domain administrator decides to remove the automatic right for domain users to be able to add up to 10 computers to a domain using the 'add workstations to domain' right then how does Active Directory know when one of those actual computers is attached/attaching? I'm assuming it's not just based on name as it is easy to rename your computer to anything so that would easily defeat the security control of denying the user the ability to add new computers (i.e. computer accounts) by just renaming a new computer to the same as an already authorised one.

Does this computer verification require a predefined key or token to be present on the computer attaching to the domain?

Improve this question

1 Answer 1

Reset to default
1

Like most entries in the Active Directory the computer accounts have a globally unique identifier (GUID) that serves as the primary way their object is identified. The computer name is a property of the computer account object, and like you said it can be changed. But the name change doesn't change the GUID.

Domain member computers are also Kerberos principals in the AD, which means that domain controllers have an associated account password hash they can use to authenticate the computer when it comes online. This password is associated with the computer account object, so renaming it doesn't change this.

Renaming a computer could potentially cause some DNS problems, but the renamed computer still won't have the right password for the computer account it is trying to impersonate. So from an AD perspective it is clear the computer isn't who it says it is.

Improve this answer
4
  • 1
    So is the GUID readable from one computer and then can it be copied to another computer i.e. where is it stored on the computer being verified and how secure is that store? How is the GUID read and can the reading of the GUID be intercepted like a session token or is it passed back and forth in some kind of secure handshake?
    – David Scholefield
    Commented Nov 21, 2016 at 17:34
  • @DavidScholefield The GUID isn't used for authentication by itself, I just mentioned that to explain how computer objects are actually identified in the AD. The authentication part is done using Kerberos (msdn.microsoft.com/en-us/library/bb742516.aspx). Kerberos tickets act kind of like session tokens, although used only for the initial auth. An attacker would need to compromise computer account data not normally accessible in the AD to impersonate a domain member computer.
    – PwdRsch
    Commented Nov 21, 2016 at 18:26
  • i'm not sure this really answers the question. For user login, this uses Kerberos, but it depends on a username and password in the ticket generation part (these credentials allows the user identity to be verified) but what takes the place of the username and password for the computer when the computer needs to verify its identity to the Kerberos system - what are the 'login credentials' for the computer?
    – David Scholefield
    Commented Nov 22, 2016 at 7:54
  • 2
    @DavidScholefield When the computer joins the domain it generates a random password that it stores and uses for that same Kereberos authentication process. The username is the computername.
    – PwdRsch
    Commented Nov 27, 2016 at 2:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .