On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller?

PS: I'm having a problem getting info on how this works on a low level, I think because I don't have googlable terminology, 'lil help?

  • "Kerberos" comes to mind, but not sure if that's it.
    – Luc
    Commented Sep 10, 2012 at 17:34
  • 3
    After spending a while reading Phillip Nordwall's links this is my understanding. From a network traffic point of view (excluding the AD stuff going on inside the domain controller) authentication IS Kerberos. Without explaining the whole protocol the DC encrypts a token with the hashed version of the users password and the client decrypts with the hashed version of the password. The very fact that the DC has the hashed password is what proves it's a valid DC. Commented Sep 11, 2012 at 14:55

2 Answers 2


If there is a trust relationship already established Kerberos is used.

NTLM is used when

  1. authenticating to a machine using an IP address
  2. if the machine is in a different forest that is using NTLM
  3. the target machine isn't in the domain
  4. the machines are not on the domain
  5. if firewalls block the kerberos traffic

Microsoft has information on their use of kerberos at http://technet.microsoft.com/en-us/library/bb742516.aspx.

You can also find more information at the following links:


The authentication is indeed based on Kerberos. In Active Directory, the role of the KDC (Key Distribution Centre) is played by the Domain Controller (DC). It would be possible for an attacker to impersonate the Domain Controller by directing the Kerberos authentication request to the wrong DC. That could be done by entering the wrong IP address for the DC in the DNS. And the DNS itself can be "impersonated" by providing the wrong IP address for it in the hosts file (C:\Windows\System32\drivers\etc\hosts). To understand why the odds of this are low in Kerberos version 5, here is some backgound information:

  • 1
    It isn't really clear how you are answering the question. You are not adding any information that is not included in the first answer or that is relevant to the question.
    – MiaoHatola
    Commented Apr 12, 2017 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .