Question

I need help answer this network and security question.

Describe the process by which a domain workstation is authenticated to the MS domain controller. After that workstation is authenticated, what happens when a person logs on to a workstation in an MS domain and receives access to a file share on another server in the same domain.

Answer 1

When you use a domain account to log on to a computer, you might expect the event to be logged on the DC. In reality, the logon occurs on the workstation or server that you are accessing. Therefore, the event is logged in that computer’s Security log—if Audit logon events is enabled on that system. Without DCs logging authentication activity, completing an audit trail of domain-user logon activity is impossible: You would need to collect the Security logs from every workstation and server on your network

Windows supports two kinds of user accounts: domain accounts and local accounts as shown below. Local accounts are stored in the SAM of member servers and workstations and are authenticated by the local system. Domain accounts are stored in AD and are authenticated by DCs. Because of the associated maintenance problems, avoiding the use of local accounts is often best. However, attackers frequently target local accounts, so you should understand how Windows records logon attempts against those accounts.

When a user attempts a network logon, such as to a shared folder on another computer, the workstation by default reuses the credentials that the user entered when he or she initially logged on. However, the user can specify a different local or domain account.