AD Network Interactions

The workstation looks for a suitable AD DC to authenticate it to the domain. Computer accounts are just a special type of user account; they authenticate to AD the same way users do.

The workstation performs a DNS request (through UDP port 53) for all SRV records that are registered in the zone ldap._tcp.<site>._sites.dc._msdcs.<domain>, where site corresponds to the AD site the workstation belongs to and domain is the domain the workstation belongs to. The workstation caches site information in the HKEY_LOCAL_MACHINESYSTEMControlSetServicesNetlogonParametersDynamicSiteName subkey. If the site's name changes between machine reboots or the site no longer exists, the query will fail, and the workstation will then query the DNS zone ldap._tcp.dc._msdcs.<domain>. This zone typically lists all the available DCs in a particular domain, any one of which could authenticate the machine.

The DNS server returns to the workstation a list of DCs for either the site (if known) or the domain.

The client makes a Lightweight Directory Access Protocol (LDAP—UDP port 389) search request, which asks one of the listed DCs to validate that the client exists in AD. The request asks AD to match the workstation's name, the name of the domain to which the workstation belongs, the domain's globally unique identifier (GUID), and the workstation's machine account name. (The machine account name is the system name followed by a dollar sign—$; e.g., a workstation called ws1 has the machine account name ws1$.) This LDAP request is unauthenticated (i.e., anonymous).

When the DC finds a match to the workstation's query, it sends a "success" response to the LDAP request.

The workstation then pings each DC in the list that the DNS server returned in Step 3. The first DC to respond handles the workstation's authentication requests.

From this point on, the interaction between the workstation (or member server) and DC involves authenticating the workstation to the domain and performing the tasks that are required to present a logon dialog to the user.

The workstation begins a series of TCP connections with the DC for specific services, such as remote procedure call (RPC) and Server Message Block (SMB). (RPC communications require this process, in which the client makes a request to the server on port 135 to find out which port a particular RPC server service is listening on. After the client gets that information, it opens a TCP connection on that port so that it can perform RPC communications.) First, the client opens a TCP connection to the RPC port mapper service (TCP port 135) running on the DC. This action makes a request to the AD logon service. The workstation then opens an SMB connection (TCP port 445) to the DC, an action that sets up a connection to a file share. The source and destination ports for RPC traffic are in the range above 1023. Therefore, if you're passing RPC communication through a firewall, you'll need to open these higher-numbered ports unless you can restrict which ports the RPC service in question uses.

After the workstation establishes these connections, the client uses Kerberos over UDP (port 88) to send an authentication request to the DC. If you want, you can force Kerberos to use TCP. (For details, see the Microsoft article "How to Force Kerberos to Use TCP Instead of UDP," http://support.microsoft.com/?kbid=244474.)

The workstation uses the information it received from the RPC port mapper in Step 7 to open a TCP RPC connection to the AD Logon RPC service, which is identified by its GUID (also referred to as a universally unique identifier—UUID): 12345678-1234-ABCD-EF00-01234567CFFB. You can see this process in the Network Monitor packet trace, as Figure 1 shows. In this trace, SERVER222 is the workstation's (or member server's) name and SPLEXORA-DC1 is the DC's name. All RPC traffic during this phase of communication between the workstation and DC is encrypted, so you can't see the data that the client and server are exchanging; you see only the RPC header information shown in the Network Monitor trace.

The DC responds to the workstation's Kerberos authentication request in Step 8 with the workstation's ticket-granting ticket (TGT), which is the session key the workstation will use for the life of its authentication session with the DC.

Using the TGT and the RPC connection that it opened in Step 9, the workstation authenticates to AD by issuing a series of RPC R_Logon requests to the DC. The DC satisfies the requests when the passed Kerberos session information is correct for the workstation.

The workstation uses the SMB connection it created in Step 7 to connect to the IPC$ share on the DC. The workstation also asks the DC whether it knows of any Microsoft Dfs referrals for the share it's connecting to (in this case, IPC$). This step automatically occurs whenever a client connects to a server share; later, we'll see how this step comes in handy.

After the SMB connection is open, the workstation performs a slow-link test to determine whether the DC it's authenticating to meets the criteria for a slow network link. This test determines future behavior, such as whether certain Group Policy extensions are processed or how (or whether) a roaming profile is downloaded when a user logs on. The slow-link test consists of a 60-byte ping that is sent and timed, followed by a 1514-byte ping that is sent and timed. The workstation repeats this series three times and uses the latency of each ping to determine the link speed and whether the speed falls below the workstation's preset slow-link threshold. This threshold is set to 500Kbps by default, but you can use Group Policy Administrative Template settings to modify the threshold at the client.

The workstation then performs a TCP-based LDAP request to get information about the domain, including the list of naming contexts (NCs) that the DC supports and each NC's LDAP distinguished name (DN).

The workstation then performs an authenticated LDAP bind, again over TCP to the DC. The workstation sends a Generic Security Service (GSS)­SPNEGO request to the DC to authenticate. This GSS-SPNEGO request indicates that the workstation is negotiating the authentication protocol with the DC. When both client and server support it, Kerberos is the preferred authentication mechanism for binding the workstation to LDAP. Figure 2 shows the packet trace for the LDAP negotiation process.

Then, the workstation figures out what Group Policy Objects (GPOs) it must process. It uses LDAP to determine which container objects (sites, domains, and organizational units—OUs) it's a member of. More specifically, after the workstation knows its place in the AD hierarchy, it sends a request to the DC to return the gpLink and gpOptions attributes for each container object.

The DC then returns the DNs for each GPO that the workstation must process. These DNs take the form of a path to the GPO's Group Policy Container (GPC). A sample DN might look like LDAP://CN={31B2F340-016D-11D2-945F-0C04FB984F9},CN=Policies,CN=System,DC=mycompany,DC=org.

The workstation next performs an SMB request to the SYSVOL share on the domain (e.g., \DC.mycompany.orgsysvol) to read the GPC portion of each GPO. Again, the workstation asks for any Dfs referral information before asking for a connection to this share. In fact, the original request the workstation makes is for \mycompany.orgsysvol, and the DC determines the closest Dfs replica before sending its return information.

The workstation uses SMB to read the contents of each GPO's Group Policy Template (GPT) and processes the required policy.

The workstation then uses Network Time Protocol (NTP) to perform a time synchronization with its partner DC.

Finally, the workstation determines whether it needs to know about any public key certificate services. Using LDAP, it queries the domain for information in the CN=Public.Key.Services,CN=Services,CN=Configuration,DC=mycompany,dc=org container, asking for objects of type NTAuthCertificates and caCertificate.