In order to perform an authenticated scan, an scanning tool can be configured with credentials controlled by a centralized directory (domain controller/AD/LDAP). While performing a scan, the scanner tries to establish a Remote Procedure Call (RPC) with the assets using configured credentials and, on successful login, executes tests on the same privilege level to that of the provided credentials.
An authenticated scan reports weaknesses exposed to the authenticated users of the system, as all the hosted services can be accessed with a right set of credentials. An unauthenticated scan reports weaknesses from a public viewpoint (this is what the system looks like to the unauthenticated users) of the system. ...
