Windows XP Domain Logon Authentication Methods

Windows XP Professional utilized a defined hierarchy of network authentication protocols to verify user identities when connecting to Windows domains. While Kerberos version 5 served as the default and preferred mechanism in Active Directory environments, the operating system retained support for legacy protocols such as NTLM and NTLMv2, integrated public-key cryptography for smart cards, and employed local credential caching for offline logons.

Kerberos Version 5

Kerberos version 5 was the primary authentication protocol for Windows XP Professional systems authenticating against Windows 2000 Server or Windows Server 2003 Active Directory domains.

The Kerberos process functions through a Key Distribution Center (KDC), which runs as part of the Active Directory Domain Services:

  • Authentication Service (AS) Exchange: The client sends an authentication request to the KDC. Upon successful verification of user credentials, the KDC issues a Ticket-Granting Ticket (TGT).
  • Ticket-Granting Service (TGS) Exchange: The client presents the TGT to request a service ticket for specific network resources, including the domain workstation itself.
  • Mutual Authentication: Both the client and the server authenticate each other, preventing man-in-the-middle attacks. Kerberos in Windows XP also integrated authorization data via the Privilege Attribute Certificate (PAC), which carries the user's security identifiers (SIDs) and group memberships.

NTLM and NTLMv2

When Kerberos could not be used, Windows XP fell back to the NT LAN Manager (NTLM) suite of challenge-response protocols. Situations requiring NTLM included:

  • Logging on to legacy Windows NT 4.0 domains.
  • Authenticating across non-transitive or external domain trusts that did not support Kerberos.
  • Scenarios where the client referenced a server by an IP address rather than a Fully Qualified Domain Name (FQDN), preventing Service Principal Name (SPN) resolution.
  • Failure to reach the KDC over UDP/TCP port 88.

By default, Windows XP Professional supported NTLMv2, which provided stronger 128-bit session security and mitigated replay attacks compared to the legacy NTLMv1 and LAN Manager (LM) protocols. System administrators could configure protocol enforcement levels via the Local Security Policy under the LAN Manager authentication level setting.

Smart Card Authentication (PKINIT)

Windows XP Professional supported smart card-based interactive logons. This mechanism integrated hardware tokens using the Public Key Cryptography for Initial Authentication (PKINIT) extension to Kerberos v5.

During a smart card logon:

  1. The user inserted a cryptographic smart card and entered a Personal Identification Number (PIN).
  2. The workstation used the private key on the smart card to sign a pre-authentication request.
  3. The KDC verified the signature using the user's digital certificate mapped in Active Directory and issued a standard Kerberos TGT.

Cached Domain Credentials

For mobile and remote workstations unable to communicate with a domain controller, Windows XP provided an offline logon mechanism known as Cached Domain Credentials (MS-Cache / MSCash).

During an offline attempt, the Local Security Authority Subsystem Service (LSASS) compared the user's password input against a cryptographically salted hash of the previously successful domain logon stored in the local system registry. By default, Windows XP cached the credentials of the last 10 unique domain users. While this allowed users to access their desktop environment without network connectivity, no domain resources could be accessed until a connection to a domain controller was restored.