Windows 2000 User Authentication Process

[FallenZer0]

Good Evening:

I read about the User Authentication in W2K Professional/Server edition on the MS KB. The article describes when a user type the user-name and password,

GINA component collects the user-name/password.
GINA passes it Local Security Authority for Authentication.
LSA passes the user-name/password to Security Support Provider Interface(SSPI). SSPI, is an interface that communicates to both Kerberos and NTLM services.
For Local authentication, SSPI passes the user-name/password to NTLM Driver MSV1-0 SSP. The NTLM drivers uses NetLogon service to authenticate the user against the local SAM database.

Now, I understand the process. But what good is the information, if I don't know how to use it. Could someone guide me or provide any ideas how I can explore this information further to enhance my knowledge.

Thankyou & Your Thoughts Are Greatly Appreciated.

[White Scorpion]

well, if you know assembly, you could disassemble the netlogon.exe and winlogon.exe files to see what they do exactly, also when you run one of them, use regmon from sysinternals to see which registry keys they access or filemon to see which files they access.

hope this helps

regards

[FallenZer0]

Originally posted here by White Scorpion
well, if you know assembly, you could disassemble the netlogon.exe and winlogon.exe files to see what they do exactly, also when you run one of them, use regmon from sysinternals to see which registry keys they access or filemon to see which files they access.

hope this helps

regards

Good Evening:

Thankyou White Scorpion for your response. I don't know any programming languages. Are there any Freeware Disassemblers that you could recommend?

[White Scorpion]

i personally prefer w32dasm and for second ollydbg.

just google for those names and you will have tons of download options.

[FallenZer0]

Good Evening:

Thankyou White Scorpion.