2

when we login into windows which is connected to a domain, we specify

domain\userid (e.g. companya\usera)

I believe the domain should resolve to the IP of the Active Directory ? What if the computer does not have an internet connection ?

Where/how does the computer actually resolve the domain ? (I realize it doesn't have a .com behind it though)

Can any guru here shed some light on how it works at the backend ?

I also realize that I can login with my account using multiple computers without logging each other out - is this normal ?

2 Answers 2

2

Windows domains and DNS domains are not the same thing. There is a lot more to it, but simply A Windows domain is an organization of computers and servers in MS Active Directory. And a DNS domain is a name assigned to an IP address.

An internet connection is not necessary for a Windows domain, again, as they are not related. The computer resolves the domain through DNS provided by Active Directory.

As for logging in to multiple computers on one account, that is standard. It can be limited, but generally there isnt a need.

2

I believe the domain should resolve to the IP of the Active Directory ?

No, not necessarily. Windows uses SRV records on additional subdomains to discover all services it needs. For example, _kerberos._udp.domain points at Kerberos servers (used for the actual authentication), _ldap._tcp.domain points at the LDAP servers (used for retrieving additional account info), and so on.

(Although, AD's DNS layout is a bit more complex than the example above, with global services and "site"-specific services, but the general idea is the same.)

The same scheme is used outside AD, too – for example, Minecraft uses _minecraft._tcp.domain, XMPP (Jabber) chat uses _xmpp-client._tcp.domain, and traditional email has MX records.

What if the computer does not have an internet connection ?

If you have logged in previously, then Windows will use cached information to verify you. Otherwise it'll ask you to connect to the internet.

Where/how does the computer actually resolve the domain ? (I realize it doesn't have a .com behind it though)

It uses the DNS servers configured on the computer, just like it would for any other domain.

When your computer first asks the corporate DNS server about a name, that server can really answer queries about any domain it decides, even if it's not present on the global DNS. (In the same way, many home gateways have built-in DNS servers which host a .home domain or such.)

(Although, this is becoming harder both due to DNSSEC and due to new SSL certificate requirements. But IMHO it was a silly idea anyway.)

I also realize that I can login with my account using multiple computers without logging each other out - is this normal ?

Yes, it's absolutely normal, just like you can log in to Gmail using multiple computers. Active Directory is used for authentication (and related things like authorization or account data retrieval), but most of the time that's where it ends – there aren't any "single use" resources in your account, so no technical reasons to enforce one login.

(Yes, there are some exceptions. For example, the older "roaming profiles" don't work nicely with multiple logins, so the admins might choose to limit that.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .