Mastering Active Directory - Second Edition

Microsoft Passport

The most common way of protecting access to a system or resource is to introduce authentication and authorization processes. This is exactly what AD does as well; when a user logs in to a domain-joined device, AD first authenticates the user to see whether they're the user they claim to be. Once authentication is successful, it then checks what the user is allowed to do (authorization). To do that, we use usernames and passwords. This is what all identity infrastructure attackers are after. They need some kind of username and password to get into the system. Passwords are a rather weak authentication method; they are breakable, it's just a matter of time and the methods used in order to break them. As a solution to this, ...