Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC?

Likewise, AD can be used to authenticate for services hosted on other machines (e.g. SQL Server). How does the SQL Server know that the DC is the real DC?

  • Via the Domain Controller Locator Process. Jul 30, 2017 at 19:06
  • The Domain Controller Locator Process let's you find the DC, not authenticate it. Jul 31, 2017 at 3:23
  • The system is already domain joined, so it knows the DC to authenticate against by using the aforementioned process. Beyond that dig into how Kerberos and NTLM authentication work. Your question is vague, so providing more detail or including an example would help. Jul 31, 2017 at 14:03

2 Answers 2


The DC is not authenticated as a DC, but otherwise as part of the kerberos authentication mechanism both sides require a shared secret (your password). The ephemeral encryption key used to encrypt the as-rep (which has the tgt) in transit is passed using that shared secret. So assuming someone has your password (and your machine account password if you are using windows) he can spoof a dc. Notice that if you want to access any external service the DC needs to know what is the shared secret for that service, so essentially it's being verified on the fact that it needs prior knowledge of everyone's password.


I believe this is done through kerberos authentication tickets against the host and the dc in question. First step would be to authenticate to the DC provided that the host has been joined to the domain. For additional info take a look at the Domain Controller Locator Process: https://technet.microsoft.com/en-us/library/cc978011.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .