Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I understand:

-- Outlook connects to exchange server (which stores my emails or gathers emails from where they are stored) and gets my emails

-- How is the above authentication done? Since it doesn't again ask me for password, it must use the windows logon authentication here too. One way I know to achieve single sign-on is kerberization. Is kerberization what is coming into picture here or something else and my understanding is missing something?


Addition: Does NTLM something come into picture here somewhere?

share|improve this question

migrated from Feb 18 '11 at 11:51

This question came from our site for system and network administrators.

up vote 5 down vote accepted

Exchange is using the same kind of authentication/authorisation as, for example, file shares.

When you connect with an appropriately configured transport (Named Pipes are the simplest) then your authentication information is carried across. In a domain (required for Exchange) this uses Active Directory's Kerberos derived system that means you password (or a hash of your password) is not sent, but rather a token that AD gives you computer. The Exchange server then checks that token with an AD to verify you identity.

See Kerberos for more information.

(NTLM also provides SSO in a similar way, but it has some security problems and has been replaced by Kerberos in most places.)

share|improve this answer

Are you sure you didn't enter your password initially when first setting up Outlook? I believe that as standard it just remembers this.

You can (if wanted) get it to ask your password every time via tools > email accounts > add or modify an existing account > change > more settings > security > "always prompt for username and password"

share|improve this answer

The system is what's known as Single Sign On (Wikipedia artice here).

Exchange is the back end system for outlook in most enterprise environments and it integrates very tightly with the active directory in Windows Server.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .