I've two machines MachineA and MachineB. Both have two local accounts which have same username . Both accounts are local admin on those machines.

If they have same password, I'm able to access \\MachineA\C$ from MachineB.

But if I change any one password above doesn't work. And it prompts for username and password. Now if I provide MachineA\username and password, it then connects.

Why isn't there a prompt for password when passwords are same? I expected passwords to be hashed with random salt, how does windows know passwords are same and authorize access?

These machines are running Windows Server 2008 R2.

PS. I've created following reg key to enable drive access HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1

  • This is symmetric challenge/response authentication. It does not behave anything like a normal password. In particular, salted hashes can't be used for the stored password. (How could you ensure two endpoints used the same salt? And if they didn't, how could they tell that the password was correct?) Jun 20 '12 at 13:11
  • David brings up a really good point using a Salt would not make sense. Even if a salt would be used the Salt could not be random and thus generated by any application that knew how the Salt was generated. This is the reason local users shouldn't be used if you deal with computers on a network.
    – Ramhound
    Jun 20 '12 at 14:09
  • Does that mean windows just hashes passwords and compares hashes in above case?
    – Ankush
    Jun 20 '12 at 14:16
  • Just adding another related question: serverfault.com/questions/205872/…
    – E235
    Oct 3 '17 at 16:04

After you log in, Windows takes your entered password and stores its LM and NT hashes in kernel memory, in order to provide this single-signon function on workgroups and NT4 domains. (On Active Directory domains, the Kerberos TGT obtained during login is stored as well.)

User-space programs cannot access these hashes directly1, but they can ask the kernel to connect to a SMB server using the stored password/ticket, or to perform NTLM challenge-response or Kerberos authentication on behalf of the program (for other protocols such as IMAP or HTTP).

Also, Windows NT uses unsalted MD4 hashes for both local authentication and NTLM, but this is not important – it could just as well keep the plain-text password in memory if it was necessary.

1 There is a tool WCE which, given sufficient privileges, can examine kernel memory and display the stored credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.