Users, Groups, and Authentication

#Windows Users, Groups, and Authentication Mechanisms#link

Building on our understanding of Windows architecture from the previous lesson, we now dive into the identity layer — how Windows identifies users, organizes them into groups, and authenticates them. This is the foundation of all Windows security: every access control decision ultimately comes back to "who is requesting this, and what are they allowed to do?"

As a security professional, you need to understand not just how authentication works, but how attackers steal, forge, and abuse credentials. This lesson covers both the legitimate mechanisms and the attack surface they create.

Security Identifiers (SIDs)

Every user, group, and computer in Windows is identified by a Security Identifier (SID) — a unique alphanumeric string. SIDs are the true identity in Windows; usernames are just friendly labels that map to SIDs.

SID Structure Example: S-1-5-21-3623811015-3361044348-30300820-1001

S       = SID identifier
1       = Revision level (always 1)
5       = Identifier Authority (5 = NT Authority)
21      = Sub-authority (domain/local)
3623811015-3361044348-30300820 = Domain/computer identifier (unique)
1001    = Relative Identifier (RID) — identifies the specific account

Well-known SIDs are consistent across all Windows installations. Understanding these is critical for security analysis:

Local Users and Groups

On a standalone (non-domain-joined) Windows machine, user accounts are stored in the SAM (Security Account Manager) database, located at C:\Windows\System32\config\SAM. The SAM is locked while Windows is running and encrypted with a system key (SYSKEY).

Key local groups and their security implications:

• ▪Administrators — Full control over the local machine; can install software, modify security settings, and access all files
• ▪Users — Standard users with limited privileges; can run applications and modify their own files
• ▪Remote Desktop Users — Granted RDP access; a common lateral movement vector
• ▪Backup Operators — Can bypass file permissions to back up and restore; can be abused for privilege escalation
• ▪Power Users — Legacy group with minimal additional privileges on modern Windows; largely deprecated
• ▪Hyper-V Administrators — Can manage Hyper-V; on Windows 10/11, this group grants kernel-level access

# List all local users
Get-LocalUser

# List all local groups
Get-LocalGroup

# View members of the Administrators group
Get-LocalGroupMember -Group "Administrators"

# View detailed information about a specific user
Get-LocalUser -Name "Administrator" | Select-Object *

# Check if the built-in Administrator account is enabled
Get-LocalUser -Name "Administrator" | Select-Object Name, Enabled

NTLM Authentication

NTLM (NT LAN Manager) is Microsoft's legacy authentication protocol. Despite being deprecated in favor of Kerberos, NTLM is still widely used in enterprise environments — especially for local authentication, workgroup scenarios, and legacy systems. Understanding NTLM is essential because it is a primary target for credential theft and relay attacks.

The NTLM authentication process (challenge-response):

1. NEGOTIATE: Client sends a negotiation message to the server
2. CHALLENGE: Server generates a random 8-byte challenge (nonce) and sends it
3. AUTHENTICATE: Client encrypts the challenge with the NTLM hash of the
   user's password and sends the response
4. Server verifies the response (either locally via SAM or via domain controller)

The NTLM hash is computed as: MD4(UTF-16-LE(password)). It is stored in the SAM (local accounts) or NTDS.dit (domain accounts). Critically, the NTLM hash is a **pass-the-hash** compatible credential — an attacker who obtains the hash can authenticate without knowing the plaintext password.

Kerberos Authentication

Kerberos is the default authentication protocol for Active Directory domains. It is significantly more secure than NTLM when properly configured, but it has its own attack surface that every security professional must understand.

The Kerberos authentication flow involves three parties: the client, the Authentication Server (AS), and the Ticket Granting Service (TGS):

1. AS-REQ: Client requests a Ticket Granting Ticket (TGT) from the KDC
   (Key Distribution Center) on the Domain Controller

2. AS-REP: KDC encrypts the TGT with the KRBTGT account's hash and
   sends it. The session key is encrypted with the user's hash.
   Client decrypts the session key using their password hash.

3. TGS-REQ: Client sends the TGT + authenticator to request a service
   ticket (TGS) for a specific service (e.g., CIFS/fileserver)

4. TGS-REP: KDC returns a service ticket encrypted with the target
   service's account hash.

5. AP-REQ: Client presents the service ticket to the target server.
   Server decrypts it with its own hash to authenticate the client.

Key Kerberos concepts for security professionals:

• ▪KRBTGT Account — The KDC's service account. Its hash can forge Golden Tickets (domain-wide persistence). Changing it twice is required to invalidate existing forgeries.
• ▪Service Principal Names (SPNs) — Unique identifiers for services (e.g., MSSQLSvc/sql01.corp.local:1433). Used in Kerberoasting attacks.
• ▪Ticket Granting Ticket (TGT) — Proves the user has authenticated; valid for 10 hours by default. Can be exported and reused (Pass-the-Ticket).
• ▪Service Ticket (TGS) — Grants access to a specific service. Can be cracked offline in Kerberoasting attacks if the service account has a weak password.
• ▪PAC (Privilege Attribute Certificate) — Embedded in every Kerberos ticket; contains the user's group memberships and authorization data.

Credential Storage and Protection

Windows stores credentials in several locations, each with different protection levels:

# Check if LSA Protection is enabled (RunAsPPL)
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL"

# Check Credential Guard status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

# View cached credential policy
gpresult /h gpresult.html  # Then review the report