Kerberos authentication on client boot

hi,
i'm reading many docs kerberos authentication..
i still not know happens after when client enters username , password (to open session, @ begginig).
can confirm these 3 points? :
1- kinit called when session starts.
2- kinit can read username of user in c:\windows\system32\configure\sam (if no, where?).
3- kinit sends krb_as_req (containing username) kerberos server (the kdc).

thanks lot!
hamza.

hello,

 

do use unix computer log onto windows domain saw "kinit"?

 

sorry not familiar unix, list brief windows logon processes reference. hope general idea of logon process.

 

1.       after press ctrl+alt+del, winlogon dispatch dll called graphical identification , authentication (gina). gina generates logon dialog box asks enter user name , password.

 

2.       local security authority (lsa) called , given user's name , password.

 

if account should authenticated locally, lsa checks accounts information stored locally in security accounts manager (sam) database.

 

if account should authenticated domain, user's information verified lsa on domain controller instead of local lsa. local lsa sends krb_as_req message kdc's authentication service in domain.

 

this krb_as_req message includes user's principal name , name of account domain kdc can verify account.

 

for more information, suggest read following article in detail,

 

how interactive logon works:

http://technet2.microsoft.com/windowsserver/en/library/779885d9-e5e9-4f27-9c14-5bbe77b056ba1033.mspx?mfr=true

 

hope helps.

best regards,

chang yin

microsoft online community support

Windows Server  >  Security