Admin authentication on a Windows XP machine on a network

Question

This is something I'm curious about. There is a LAN consisting of Windows XP machines. There is an administrator account say admin-xyz which can be used to login to any of the machines on the network. But, when I run pwdump to get the password hashes on a machine, I dont see the admin-xyz account. I am just curious as to how the authentication happens. Can someone please shed some light on this?

Thank You.

yes Dan, i think it is.So, in that case how does the authentication happen ? — , Dec 30 '09 at 20:43
Thats domain authentication, which authenticates against the domain controller. — DanBig, Dec 30 '09 at 20:46
Just keep in mind that using tools such as pwdump may not be permitted on a corporate network, where it's often considered to be security violation. — John Gardeniers, Dec 30 '09 at 23:32

score 2 · Answer 1 · answered Dec 30 '09 at 20:43

2

Most likely it's only dumping the LOCAL hashes from the SAM, and you are looking for the domain admin account which is not stored locally.

answered Dec 30 '09 at 20:43

DanBig

11,423
1
29
53

Admin authentication on a Windows XP machine on a network

1 Answers1