Re: Client/Server application with single login-SecureStream?

Hi,

NegotiateStream will fallback to a protocol called NTLM to do non-Domain based authentication, you need

a) mirrored accounts on both machines or
b) specifiy credentials to use

http://www.leastprivilege.com/NegotiateStreamAndNTLM.aspx

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

If kerberos will only work with domain accounts, then would it be
possible to use NegotiateStream to authenticate a client on a server
that is NOT a member of a domain?  You said that Kerberos will only
work on machines that belong to the same domain, or to domains that
trust each other, but I'm looking at a case where client A is a member
of domain D, and server B is connected to the same network as A, but
is not a member of any domains (just a windows server box configured
on a workgroup).  Will B still be able to authenticate the client if
it opens a secureStream connection?  In other words, if B is not a
member of the domain, can it still contact the domain controller to
authenticate?



.

Relevant Pages

  • Re: Client/Server application with single login-SecureStream?
    ... NegotiateStream uses the negotiate protocol which uses Kerberos or NTLM. ... NTLM can authenticate local machine accounts, so it should be possible to ... > that is NOT a member of a domain? ...
    (microsoft.public.dotnet.security)
  • Re: KERB_SMART_CARD_LOGON
    ... the smart card reader name, ... This member must be set to 1. ... The number of characters in the bBuffer buffer that precede the name ... The domain name of the user to authenticate. ...
    (microsoft.public.platformsdk.security)
  • Re: KERB_SMART_CARD_LOGON
    ... the smart card reader name, ... This member must be set to 1. ... The number of characters in the bBuffer buffer that precede the name ... The domain name of the user to authenticate. ...
    (microsoft.public.platformsdk.security)
  • Re: Looking for way to enumerate members of local administrators group
    ... the local group is a domain object, like "Domain Admins", I don't know what ... member objects, and it makes sense that you cannot include references to ... Maybe you can authenticate to the local group with credentials of a ... strDomainAdmName, strPassword, ADS_SECURE_AUTHENTICATION Or ...
    (microsoft.public.windows.server.scripting)
  • Re: Domain Controller location by clients
    ... When a member of a site attempts to ... authenticate to a DC within its site and is unable to gain access to any DC ... any questions should be posted in the NewsGroup ...
    (microsoft.public.windows.server.active_directory)
Loading