How does a client authenticate the domain controller

Question

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller?

PS: I'm having a problem getting info on how this works on a low level, I think because I don't have googlable terminology, 'lil help?

Answer 1

If there is a trust relationship already established Kerberos is used.

NTLM is used when

1. authenticating to a machine using an IP address
2. if the machine is in a different forest that is using NTLM
3. the target machine isn't in the domain
4. the machines are not on the domain
5. if firewalls block the kerberos traffic

Microsoft has information on their use of kerberos at http://technet.microsoft.com/en-us/library/bb742516.aspx.

You can also find more information at the following links:

• http://en.wikipedia.org/wiki/NTLM
• http://en.wikipedia.org/wiki/Kerberos_%28protocol%29
• http://technet.microsoft.com/en-us/library/cc738300%28v=ws.10%29.aspx
• http://technet.microsoft.com/en-us/library/bb742516.aspx
• http://support.microsoft.com/kb/102716

Answer 2

The authentication is indeed based on Kerberos. In Active Directory, the role of the KDC (Key Distribution Centre) is played by the Domain Controller (DC). It would be possible for an attacker to impersonate the Domain Controller by directing the Kerberos authentication request to the wrong DC. That could be done by entering the wrong IP address for the DC in the DNS. And the DNS itself can be "impersonated" by providing the wrong IP address for it in the hosts file (C:\Windows\System32\drivers\etc\hosts). To understand why the odds of this are low in Kerberos version 5, here is some backgound information:

• Kerberos Overview – fig. 4.2 from Stallings, W., "Network Security Essentials: Applications and Standards", 3rd edition, 2007, Prentice Hall (copy can be found via PPT slides with google search)
  • Kerberos demo: http://williams.comp.ncat.edu/IA_visualization_labs/security_visual_tools/kerberos/kerberos_demo.html
  • Details about Kerberos in Active Directory http://windowsitpro.com/security/kerberos-active-directory