WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

User Authentication

Windows 2000 Professional supports user authentication, which authenticates a user's identity. A user's authentication is the basis for granting access to network resources. Within this authentication model, the security system provides two types of authentication:

Interactive logon, by which users confirm their identification to their local computer or network account. When using Windows 2000 Professional in a Windows 2000 Server environment, the network account is an Active Directory account.

Network authentication, by which Windows 2000 confirms the user's identification to any network service that the user is attempting to access. To provide this type of authentication, the Windows 2000 security system includes three different authentication mechanisms: Kerberos v5, smart cards, and NTLM for compatibility with other versions of Windows.

Interactive logon confirms the user's identification to either a domain account or a local computer. This process differs, depending on the type of user account:

With a domain account, a user logs on to the network with a password or smart card, using single sign-on credentials stored in Active Directory. By logging on with a domain account, an authorized user can access resources in the domain and any trusting domains. If a password is used to log on to a domain account, Windows 2000 uses Kerberos v5 for authentication. If a smart card is used, Windows 2000 uses Kerberos v5 authentication with certificates, unless the server is not a Windows 2000 server.

With a local computer account, a user logs on to a local computer using credentials stored in Security Account Manager (SAM), which is the local security account database. Any workstation or member server can store local user accounts, but those accounts can only be used for access to that local computer.

Windows 2000 uses a user principal name (UPN) to identify users for interactive logon. UPNs serve the same purpose as user names and are formatted as username@domain.

If Logon domain does not appear in the dialog box provided at logon, and you want to log on to a Windows 2000 domain, you can type your user name and the Windows 2000 domain name in two ways:

Your user principal name prefix (your user name) and your user principal name suffix (your Windows 2000 domain name), joined by the "at" sign (@). For example, user@sales.westcoast.microsoft.com.

Your Windows 2000 domain name and your user name, separated by the backslash () character. For example, salesuser.

Note that the suffix in the first example is a fully-qualified DNS domain name. Your administrator might have created an alternative suffix to simplify the logon process. For example, creating a user principal name suffix of "microsoft" allows the same user to log on using the much simpler user@microsoft.com.

Smart Cards

Interactive logon can be configured to require smart card authentication for greater security.

Smart cards are credit card-sized plastic cards that contain integrated circuit chips. Smart cards are used to store users' certificates and private keys, enabling easy transport of these credentials. Smart cards can perform sophisticated public key cryptography operations, such as digital signing and key exchange.

You can deploy smart cards and smart card readers to provide stronger user authentication and security for a range of security solutions, including logging on over a network, secure Web communication, and secure e-mail.

Smart cards provide tamper-resistant authentication through onboard private key storage and processing. The private key is used in turn to provide other forms of security related to digital signatures and encryption.

For detailed procedures on implementing smart cards, see Windows 2000 Server Help.

Network Authentication

Network authentication confirms the user's identification to any network service that the user is attempting to access. To provide this type of authentication, the Windows 2000 security system supports many different authentication mechanisms, including smart cards, Kerberos v5, and NTLM for compatibility with Windows NT 4.0.

Domain account users do not see network authentication because Windows 2000 provides single sign-on support, automatically handling network authentication requests after a user has authenticated himself or herself and has been granted credentials. On the other hand, users of a local computer account must provide credentials (such as a public key certificate or a user name and password) every time they access a network resource.

Kerberos v5 Authentication

Kerberos v5 is the primary security protocol for authentication within a domain. The Kerberos v5 protocol verifies both the identity of the user and network services. This dual verification is known as mutual authentication.

The Kerberos v5 authentication mechanism issues a ticket-granting ticket (TGT) thatis used to get service tickets (STs) thatprovide access to network services. These tickets contain encrypted data, including an encryption password that confirms the user's identity to the requested service. Except for entering an initial password or smart card credentials, the authentication process is transparent to the user. The general Kerberos Authentication process includes the following processes:

The user on a client system, using a password or a smart card, authenticates to the Key Distribution Center (KDC). The KDC runs on each domain controller as part of Active Directory.

The KDC issues a special ticket-granting ticket to the client. The client system uses this TGT to access the ticket-granting service (TGS), which is part of the Kerberos v5 authentication mechanism on the domain controller. The ticket-granting service then issues a service ticket to the client.

The client presents this service ticket to the requested network service. The service ticket proves both the user's identity to the service and the service's identity to the user.

For more information about how Kerberos v5 provides authentication, see the Windows 2000 Server Resource Kit.

NTLM

The NTLM protocol was the default for network authentication in Windows NT 4.0 and is based on a challenge response mechanism for client authentication. It is retained in Windows 2000 for compatibility with earlier client and server versions of Windows. NTLM is also used to authenticate logons to stand-alone computers with Windows 2000.

Computers with Microsoft® Windows® 3.11, Windows 95, Windows 98, or Windows NT 4.0 will use the NTLM protocol for network authentication in Windows 2000 domains. Computers running Windows 2000 will use NTLM when authenticating to servers with Windows NT 4.0 and when accessing resources in Windows NT domain.

By default, Windows 2000 is installed in a mixed-mode network configuration, meaning a network configuration that uses any combination of Windows NT 4.0 and Windows 2000 computers. A Windows 2000 workstation or client manages the NTLM credentials entered at system logon on the client side to use when the client connects to Windows NT 4.0 servers using NTLM authentication. Support for NTLM credentials in the Windows 2000 security is the same as for Windows NT 4.0 for compatibility.

As examples, the following configurations would use NTLM as the authentication mechanism:

A Windows 2000 Professional client authenticating to a Windows NT 4.0 domain controller.

A Microsoft® Windows NT® Workstation 4.0 client authenticating to a Windows 2000 domain controller.

A Windows NT Workstation 4.0 client authenticating to a Windows NT 4.0 domain controller.

Users in a Windows NT 4.0 domain authenticating to a Windows 2000 domain.

In addition, NTLM is the authentication protocol for computers that are not participating in a domain, such as stand-alone servers and workgroups.

The NTLM authentication package in Windows 2000 supports three methods of challenge/response authentication:

LAN Manager (LM). This is the least secure form of challenge/response authentication. It is available so that computers running Windows 2000 Professional can connect in share level security mode to file shares on computers running Microsoft® Windows® for Workgroups, Windows 95, or Windows 98.

NTLM version 1. This is more secure than LM challenge/response authentication. It is available so that clients running Windows 2000 Professional can connect to servers in a Windows NT domain that has at least one domain controller that is running Windows NT 4.0 Service Pack 3 or earlier.

NTLM version 2. This is the most secure form of challenge/response authentication. It is used when clients running Windows 2000 Professional connect to servers in a Windows NT domain where all domain controllers have been upgraded to Windows NT 4.0 Service Pack 4 or later. It is also used when clients running Windows 2000 connect to servers running Windows NT in a Windows 2000 domain.

By default, all three challenge/response mechanisms are enabled. You can disable authentication using weaker variants by setting the LAN Manager authentication level security option in local security policy for the computer.

For more information about configuring the LAN Manager authentication level, see Group Policy Reference on the Microsoft® Windows 2000 Professional Resource Kit companion CD or the Windows 2000 Server Resource Kit.

Remote Access Logon Process

Windows 2000 supports several authentication protocols such as MS-CHAP, CHAP, and SPAP for dial-in access. Windows 2000 can be configured to support Extensible Authentication Protocol (EAP) if you want to use security devices to authenticate remote access users in conjunction with other security devices such as smart cards and certificates. EAP-transport layer security (TLS) allows users remote access by authenticating their identities using a combination of authentication vectors. When remote access users attempt to log on to a server that is using EAP-TLS, they are prompted to insert their smart card and enter their PIN during network logon authentication. If the user's PIN and smart card credentials are valid, the user is logged on and granted rights for the appropriate network user account. For more information about EAP-TLS, see "Internet Authentication Service" in the Microsoft® Windows® 2000 Server Resource Kit Internetworking Guide.

The remote access logon process depends primarily on server configuration to enable logon. Windows 2000 Server includes Routing and Remote Access Services which can authenticate remote access network users. Routing and Remote Access supports smart card logon authentication using the EAP-TLS extension of the Point-to-Point Protocol (PPP).

For information about adding a smart card reader to your Windows 2000 Professional computer, see Windows 2000 Professional online documentation.

For more information about Routing and Remote Access, see "Remote Access" later in this chapter.