Subject: Re: servers, passwords, and key generation

From: Martin Rex <[email-masked]>
Date: Mon, 4 Aug 2003 15:32:52 +0200 (MET DST)

Liqiang wrote:
> 
> Localsystem/networkservice passwords are truly random, we basically call
> CryptGenRandom() to get the new passwords and these passwords got
> changed rather frequently. Each machine password is 28 octets long in
> ws2k3, 240 octets in LH, and mostly is not print-able. 
> 
> the popular myth that MS stores cleartext passwords perhaps originates
> from tools like lsadump2, which dumps so called "LSA secrets", one of
> which, named "$MACHINE.ACC", is the cleartext version of the machine
> password. This is only stored on each individual machine, not to be
> confused with stored keys on the KDC. We have one current key per each
> supported etype, we also do store previous copies for enforcing account
> lockout policy etc.

Now that's a funny way to put it.

It's not a popular myth, it is the rule.  The localsystem account seems
to use a special hack and make a single exception to this rule.

What ways are there to use credentials for a specific (not the current)
user on Microsoft Platforms?

- when using SSPI, one can pass an AUTH_IDENTITY structure filled
  with user, domain and *tadaa* printable password.

- when using the "default" SSPI credentials, one needs to create
  an access token for that other user first, either using
  "LogonUser", which requires user, domain and *tadaa*" printable password

- or when running a service under a special service account,
  open the "Service" snap-in (Administrative Tools->Services),
  change to "Log on" tab and what do you need to enter?
   user, domain and *tadaa* printable password

-Martin

---

From: Luke Howard <[email-masked]>
Date: Tue, 5 Aug 2003 00:23:06 +1000

>to use a special hack and make a single exception to this rule.

Not really; as Liqiang pointed out, the machine stores the password,
and the KDC stores the keys.

(That said, I believe that NT 4.0 domain members stored the MD4
hash of the machine secret, so a newly upgrade workstation may only
have the rc4-hmac key material.)

-- Luke