StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The NTLM challenge between machines is a little more complex @Quassnoi indicates but it is similar. The machines may well be in the same domain or trusted domains, but the accounts you are using are local machine accounts, scoped only to the local machine's security access management. </p> <p>Local SAM accounts patterned as machinename\userid are non-propagatable. You'd experience a series of negotiated fallbacks when you tried to authenticate against external resources using that account as follows:</p> <ol> <li>Pass current domain/username/password hash token - it'll fail, the account is untrusted</li> <li>Fallback - revert passing hash of UserID + Password</li> <li>Fallback - revert to connecting as anonymous credentials.</li> </ol> <p>The fallbacks can also be disabled through configuration, it is very common for anonymous authentication to be prevented.</p> <p>As @Quassnoi indicates in this instance you managed to login using the #2 fallback.</p> <p>To enable account credentials to propagate, you'd need the following to be true:</p> <ol> <li>machines would need to be members of domains with at least one-way trust between each other (they don't necessarily have to be members of the same domain). </li> <li>use domain accounts - not local machine accounts - would look something like domainname\userid. A special case is the Network Service account which has a proxy account in the domain scenario - domainname\machinename$.</li> </ol> <p>How do you tell if your machine is a member of the domain? It's pretty easy if you've got interactive login to the machines. There are a few strategies</p> <ol> <li>interactively the System control panel will show workgroup or domain membership. (Right-click properties on Computer in the start menu) </li> <li>at the command-line, <code>IPCONFIG /ALL</code> will also show the default DNS prefix which is typically the same as your domain name.</li> </ol> <p>I suspect your ISP would create a domain just to make it easy to manage and monitor their machines. Whether they'd let you create domain accounts is a different question.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload