Security

Suppose that you want to make a connection to a network
resource in a domain environment, let's say by using "net
use \\servername\sharename" and you are logged onto a
machine with a local account.
Has anyone ever noticed that when you give the credentials
the domain name is ignored?
After typing the above command you will be prompted for a
user name. You can then type in "anydomainname\username"
and then when prompted for password, you just type in the
password for the respective username.
In other words, as long as the username and password are
the same as an account from the domain that the server
belongs to, you can type any domain name that you want
before the username (or no domain name, I would guess).
It looks as though this hasn't changed since NT4. It
doesn't seem like a major security issue, but can anyone
explain why this happens or why it's allowed to happen?
Thanks

To log on to a domain you have to give domain name
to identify which domain you want to join.
Domain name is used to locate the domain, to which credentials
should be sent for authenitcation. Authentication process as such
doesn't need a domain name.

As long as your computer is able to locate the correct domain controller,
you can log on to the share without giving domain name.
If there are more than 1 domain controller in the network and the share
permissions are only for certain domain users, then I think you must provide
the domain name as well.

Sharad

"Charlie" <(E-Mail Removed)> wrote in message
news:1005401c3f380$ad16c560$(E-Mail Removed)...
> Suppose that you want to make a connection to a network
> resource in a domain environment, let's say by using "net
> use \\servername\sharename" and you are logged onto a
> machine with a local account.
> Has anyone ever noticed that when you give the credentials
> the domain name is ignored?
> After typing the above command you will be prompted for a
> user name. You can then type in "anydomainname\username"
> and then when prompted for password, you just type in the
> password for the respective username.
> In other words, as long as the username and password are
> the same as an account from the domain that the server
> belongs to, you can type any domain name that you want
> before the username (or no domain name, I would guess).
> It looks as though this hasn't changed since NT4. It
> doesn't seem like a major security issue, but can anyone
> explain why this happens or why it's allowed to happen?
> Thanks

>-----Original Message-----
>Suppose that you want to make a connection to a network
>resource in a domain environment, let's say by using "net
>use \\servername\sharename" and you are logged onto a
>machine with a local account.
>Has anyone ever noticed that when you give the
credentials
>the domain name is ignored?
>After typing the above command you will be prompted for a
>user name. You can then type in "anydomainname\username"
>and then when prompted for password, you just type in the
>password for the respective username.
>In other words, as long as the username and password are
>the same as an account from the domain that the server
>belongs to, you can type any domain name that you want
>before the username (or no domain name, I would guess).
>It looks as though this hasn't changed since NT4. It
>doesn't seem like a major security issue, but can anyone
>explain why this happens or why it's allowed to happen?
>Thanks
>.
>I should add that this is only the case on Domain
Controllers. If you try to access a member server on the
domain, it doesn't know who you are.