Revision Summary Date Revision History Revision Class Comments 2/11/2011 1.0 New Released new document. 3/25/2011 2.0 Major Updated and revised the technical content. 5/6/2011 2.0 None No changes to the meaning, language, or formatting of the technical content. 6/17/2011 2.1 Minor Clarified the meaning of the technical content. 9/23/2011 3.0 Major Updated and revised the technical content. 12/16/2011 3.0 None No changes to the meaning, language, or formatting of the technical content. 3/30/2012 4.0 Updated and revised the technical content. 7/12/2012 4.0 None No changes to the meaning, language, or formatting of the technical content.
10/25/2012 5.0 Major Updated and revised the technical content. 1/31/2013 5.1 Minor Clarified the meaning of the technical content. 8/8/2013 6.0 Major Updated and revised the technical content. 11/14/2013 6.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 6.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 6.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 7.0 Major Significantly changed the technical content. 9/24/2015 7.1 Minor Clarified the meaning of the technical content. 10/16/2015 7.1 None No changes to the
as well as constrained delegation and encryption that principals support. Public Key Cryptography for Initial Authentication (PKINIT) in Kerberos Protocol Specifies Microsoft extensions to the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) protocol. extensions describe how the Windows implementations of PKINIT differ from what is specified in and . Authentication Protocol Domain Support Specifies the communication between a server and a that uses interfaces ( section 3.2) to complete an authentication sequence for certain authentication protocols and provides group membership information. Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) Extension Extends , which specifies a negotiation mechanism for the Generic Security Service Application Programming Interface . Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol These two extensions to Kerberos enable an application service to obtain a Kerberos on behalf of a user, but each provides a
different way to obtain a ticket on behalf of a user. Credential Security Support Provider (CredSSP) Protocol Enables an application to securely delegate a user's from a client to a target server. Netlogon Remote Protocol Used for user and machine authentication on networks. Intranet Web Environment Protocol name Description Document short name Digest Protocol Extensions Extends the Digest Authentication standard and . Remote Certificate Mapping Protocol Used by servers that authenticate users by using certificates. This protocol allows the server to use a directory, database, or other technology to map the user's X.509 certificate to a . This protocol returns the information that is associated with the security principal in the form of a , as specified in , that represents the user's identity and group memberships.
Transport Security (TLS) Profile Specifies the differences between Microsoft implementation and the SSL/TLS standards. NT LAN Manager (NTLM) Authentication Protocol See section . Kerberos Protocol Extensions See section 2.2.1. Public Key Cryptography for Initial Authentication (PKINIT) in Kerberos Protocol Specifies the Microsoft extensions to the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) protocol and enables the use of cryptography in the initial authentication exchange (that is, in the Authentication Service (AS) exchange) of the protocol [MS-KILE]. Authentication Protocol Domain Support See section 2.2.1. Simple and Protected Generic Security Service Application Programming Interface Negotiation Mechanism (SPNEGO) Protocol Extensions See section 2.2.1.
Index A Actors 44 44 73 40 41 42 41 40 21 43 Auxiliary 65 67 68 C 72 87 73 42 42 43 42 43 21 Conceptual overview authentication 5 11 11 5 Connecting to an SMB2 share 81 81 83 Considerations 73 73 D Dependencies 43 42 Design intent 44 auxiliary 65 67 68 45 network 48 58 54 52 51 44 security services - data 71 70 44 44 44 E 42 42 72 Examples connecting to an SMB2 share 81 83 81 74 interactive domain logon - service ticket for client computer 78 78 80 Extensibility 86 72 42 F Functional 21 requirements interactive authentication 22 24 23 network logon authentication 25 31 34 36 25 28 21 relationship between standards and Microsoft extensions 39 38 40 36 21 21 G 13 74 H
72 I 86 73 18 43 Interactive domain - service ticket for client computer 78 45 78 80 Introduction authentication 5 11 11 5 M 86 N Network logon 48 58 54 52 51 O Overview interactive authentication 22 24 23 network logon authentication 25 31 34 36 25 28 relationship between standards and Microsoft extensions 39 38 40 36 40 41 42 41 40 21 5 P 43 86 R 18 Requirements 73 72 interactive logon authentication 22 24 23 network logon authentication 25 31 34 36 25 28 21 43 relationship between standards and Microsoft extensions 39 38 40 36 S Security 73 services - data 71 70 73 Summary of supporting actors and system interests 44 44 System 21 dependencies 42 43 42 72 44 overview authentication 5 11 11 5 protocols 41 42 41 40 requirements interactive logon authentication 22 24 23
network logon authentication 25 31 34 36 25 28 21 relationship between standards and Microsoft extensions 39 38 40 36 use cases 44 auxiliary 65 67 68 45 network logon 48 58 54 52 51 44 security services - data 71 70 44 44 21 42 43 42 72 40 21 System use cases 44 44 44 T 40 41 42 41 40 87 U 44 44 auxiliary 65 67 68 45 network logon 48 58 54 52 51 44 security services - data 71 70 44 44 44 V Versioning 86 72