> For the complete documentation index, see [llms.txt](https://jackx8x7x.gitbook.io/security-stuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jackx8x7x.gitbook.io/security-stuff/windows/auth/logon.md).

# Logon

Stuff about logon process.

## Types of Logon

The Authentication Services protocols provide authentication services for applications like:

* interactive applications, such as Winlogon, or
* distributed client and server applications, such as a web browser, web server, or a file client or a file server, or
* any other type of client and server application

through the following methods:

* Interactive Logon
  * Local Logon
  * Domain Logon/Smart Card Domain Logon
* Network

{% embed url="<https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/windows-logon-scenarios>" %}

### Interactive Logon

The logon process begins either when a user enters credentials in the credentials entry dialog box, or when the user inserts a smart card into the smart card reader, or when the user interacts with a biometric device.

Users can perform an interactive logon by using *a local user account* for local logon or *a domain account* for domain logon by using the security account database on *the user's local computer* or by using *the domain's directory service*.

* Local logon\
  Logon to a local account grants a user access to Windows resources on the local computer and requires that the user has a user account in the account database maintained by the *Security Account Manager (SAM)* on the local computer.
* Domain Logon/Smart Card Domain Logon\
  A process that proves the identity of the user to the domain controller, implies eventual user access to local and domain resources, and requires that the user has a user account in an account database, such as Active Directory.

A user can interactively logon to a computer *locally* or *remotely through* Terminal Services.

{% embed url="<https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/bfc67803-2c41-4fde-8519-adace79465f6>" %}

### Network Logon

Used only after interactive logon authentication *has taken place*. During network logon, the process *does not* use the credentials entry dialog boxes to collect data

{% embed url="<https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/131b1590-0c21-46e1-96bf-995a7a2cc461>" %}
Network Logon
{% endembed %}

## Domain Logon

### Kerberos

The domain logon authentication process first tries the [Kerberos Authentication Protocol](#kerberos) (\[MS-KILE]). If Kerberos fails, the authentication process falls back to the NTLM pass-through mechanism (\[MS-APDS]).

1. First, the client request the TGT from the KDC.
2. Client then requests the service ticket *for the domain-joined computer*.
3. Finally, Client submits the service ticket to verify the user logon information.

{% embed url="<https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/2e9de599-e791-4b3d-bb0c-2ffbef5ee665>" %}

### Packet Tracing

{% embed url="<https://medium.com/@robert.broeckelmann/kerberos-wireshark-captures-a-windows-login-example-151fabf3375a>" %}

{% embed url="<https://wiki.wireshark.org/Kerberos>" %}

## References

{% embed url="<https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication>" %}
Credentials Processes in Windows Authentication
{% endembed %}

{% embed url="<https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter3>" %}
[www.ultimatewindowssecurity.com](http://www.ultimatewindowssecurity.com) - Understanding Authentication and Logon
{% endembed %}