How Domain Controllers Verify Passwords

1. The client computer presents the user logon information to a domain controller. This includes the users account name and a cryptographic hash of their password. This information can be sent to any domain controller and is typically sent to the domain controller that is identified as the closest domain controller to the client computer.

2. When a domain controller detects that an authentication attempt did not work and a condition of STATUS_WRONG_PASSWORD, STATUS_PASSWORD_EXPIRED, STATUS_PASSWORD_MUST_CHANGE, or STATUS_ACCOUNT_LOCKED_OUT is returned, the domain controller forwards the authentication attempt to the primary domain controller (PDC) emulator operations master. Essentially, the domain controller queries the PDC to authoritatively determine if the password is current. The domain controller queries the PDC for this information because the domain controller may not have the most current password for the user but, by design, the PDC emulator operations master always has the most current password.

3. The authentication request is retried by the PDC emulator operations master to verify that the password is correct. If the PDC emulator operations master rejects the bad password, the PDC emulator operations master increments the badPwdCount attribute for that user object. The PDC is the authority on the user's password validity.

4. The failed logon result information is sent by the PDC emulator operations master to the authenticating domain controller.

5. The authenticating domain controller also increments its copy of the badPwdCount attribute for the user object.

6. The authenticating domain controller then sends a response to the client computer that notifies the domain controller that the logon attempt did not work. In a Windows 2000/2003 domain, the PDC emulator role holder retains the following functions:

· Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
· Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
· Account lockout is processed on the PDC emulator.