Windows Authentication: Part 1

Windows Authentication

If you ever used Windows, you might have seen following login screen a number of times. Have you ever wondered how login actually works on Windows? In this series of blog posts, let’s deep dive into Windows login. Let’s start with the types of logons.

1. Local Logon

In the early days of Windows, specifically during the late ’80s and early ’90s, the concept of domains or the Internet did not exist. Each machine operated in isolation, and users logged in locally.

• Mechanism: When you log in locally, your credentials (username and password) are validated by the local machine.
• Scope: This type of logon is limited to accessing resources on the specific machine where the logon was performed.
• Common Use: This is still common in workgroup environments where there is no central authentication authority.

2. Microsoft Account Logon

With the advent of Windows 8, Microsoft introduced the ability to log in using a Microsoft account (previously known as Windows Live account).

• Mechanism: This type of logon uses Microsoft’s cloud services to authenticate the user.
• Scope: It allows users to access their personal settings and files across multiple devices by synchronizing with their Microsoft account.
• Common Use: Ideal for personal devices where users want a seamless experience across their Windows devices.

3. Domain Joined Logon

For enterprise environments, domain logons have been a cornerstone since the introduction of Active Directory.

• Mechanism: Users authenticate against an Active Directory (AD) service using protocols like Kerberos and NTLM.
• Scope: This type of logon allows users to access resources across the entire corporate network, provided they have the necessary permissions.
• Common Use: Widely used in businesses and organizations for managing user access to network resources.

4. Azure AD Logon

As businesses move towards cloud-based solutions, Azure Active Directory (Azure AD) has become prevalent.

• Mechanism: Similar to domain logons, but the authentication is handled by Azure AD, Microsoft’s cloud-based identity and access management service.
• Scope: Allows access to cloud-based applications and resources, facilitating single sign-on (SSO) across various services.
• Common Use: Used by organizations that have adopted Microsoft 365 or other Azure services.

5. Hybrid Domain Logon

To bridge the gap between on-premises and cloud-based resources, hybrid domain join solutions are implemented.

• Mechanism: Users authenticate against both on-premises Active Directory and Azure AD. This dual-authentication mechanism supports seamless access to both on-prem and cloud resources.
• Scope: Facilitates single sign-on (SSO) and provides a unified experience across different environments.
• Common Use: Ideal for enterprises transitioning to the cloud while maintaining their on-premises infrastructure.

Credential Providers and Their Roles

The Sign-in options listed in the image above are based on the available Credential Providers on the machine. Credential providers play a vital role in the Windows logon process. They collect and validate user credentials and hand them off to the appropriate authentication service. Following are most common credential providers:

• Password: The most common credential, where users input their username and password.
• Windows Hello: Uses biometric data such as facial recognition or fingerprints and PIN. These credentials are stored locally and never leave the device, ensuring a higher level of security.
• FIDO (Fast Identity Online): Utilizes physical devices like security keys, which provide a secure, hardware-based authentication method.
• Smart Cards: Physical cards that store user credentials, providing an additional layer of security.

Next, let’s take a look at the process that shows logon UI to the user. The process is aptly named as LogonUI.exe

LogonUI.exe

LogonUI is the user interface process that presents the logon screen when you start your Windows machine. This interface is responsible for collecting the user’s credentials, such as passwords, PINs, biometrics (fingerprints, facial recognition), and smart cards, and then passing them to the appropriate system components for authentication.

How LogonUI Works

1. Presentation of Credential Providers:
   • When you boot up your Windows machine, LogonUI displays the logon screen. This screen includes various credential providers. Credential providers are specialized plugins that collect different types of credentials (e.g., passwords, PINs, biometric data).
   • The logon screen allows you to enter your credentials. It could be a password, a PIN, or biometric data like a fingerprint or facial recognition.
2. Handling Credentials:
   • Once the user enters their credentials, LogonUI captures this information and sends it to the Winlogon process. Winlogon manages the overall logon experience and interacts with the local security authority subsystem service (lsass).
3. Interaction with Winlogon and Lsass:
   • Winlogon receives the credentials from LogonUI and forwards them to lsass through an API called LSAlogonUser.
   • lsass is responsible for the actual authentication process. It verifies the credentials against the stored user data using various authentication packages (like Kerberos, NTLM, OAuth).
4. Authentication Packages:
   • These packages represent different protocols that handle the authentication of the provided credentials. For instance, Kerberos and NTLM are common in enterprise environments for validating user identities.
5. Post-Authentication Actions:
   • After successful authentication, lsass notifies Winlogon, which then proceeds to initialize the user session. This involves loading the user profile, starting the desktop environment, and running any login scripts if necessary.
6. Creating the Desktop:
   • Winlogon creates the user desktop by loading the necessary components such as the registry settings, user-specific configurations, and any network resources.
   • It also starts Userinit, which executes logon scripts and finally starts Explorer, the Windows shell that provides the desktop, taskbar, and Start menu.

Detailed Flow of Events

1. User Initiates Logon:
   • The user sees the LogonUI interface upon system start.
   • The interface includes various options depending on the configured credential providers (password, PIN, smart card, biometrics).
2. Credential Entry:
   • The user enters their credentials.
   • LogonUI captures this input with the help of credential providers and forwards it to Winlogon.
3. Processing Credentials:
   • Winlogon passes the credentials to lsass via LSAlogonUser.
   • lsass uses the appropriate authentication package to validate the credentials.
4. Authentication Confirmation:
   • lsass confirms the credentials and informs Winlogon of the successful authentication.
   • Winlogon starts the process of creating the user’s desktop environment.
5. Loading User Profile:
   • Winlogon loads the user profile by accessing the registry, user-specific settings, and any network resources.
   • Userinit runs any necessary logon scripts specified in Active Directory.
6. Starting Explorer:
   • Finally, Userinit starts the Explorer process, which provides the user interface elements like the Start menu and taskbar.
   • The user is now logged in and can interact with the Windows desktop environment.

Local Security Authority (LSA)

The Local Security Authority (LSA) is a critical component in the Windows operating system, responsible for managing security policies, auditing, and handling authentication. One of its key roles involves working with authentication packages, such as the Negotiate package, to verify user credentials and facilitate secure logons.

Negotiate Authentication Package

In the next post, we will go deeper into each of the protocols used for logon starting with Kerberos.

Exercise

In interesting exercise for a security student/professtional would be to threat model Windows authentication process. If you are not familiar with how to threat model, definitely take a look at Thread Model 101.

Resources

Windows Authentication Overview | Microsoft Learn

Credentials Processes in Windows Authentication | Microsoft Learn

Winlogon and Credential Providers – Win32 apps | Microsoft Learn