Windows – What protocols are used when a machine joins to a windows domain

active-directorydomain-name-systemwindows

I'm trying to figure out what exactly happens when a machine is added to a domain. Once you type in the domain name:
1) What protocol does the machine use in order to figure out which domain controller to use?
2) How is the domain name looked up? Example: domain is setup as dc=company,dc=com, but the "Windows" domain is COMPA. Some how these names are mapped to each other.

I know that Active Directory and DNS are tightly integrated, but I don't quite understand the details. What is the best source of information on the technical details. Most of what I can find tells you HOW to get things done, but not what happens under the covers.

Best Answer

There is a lot of DNS involved.

Here is the workflow when a workstation is given a NetBIOS name to join (COMPA in your example)

  1. Checks its resolver cache to see if COMPA is already resolved.
  2. Does a DNS lookup for "COMPA" without any domain to see if the DNS Server finds it.
  3. Does a DNS lookup for "COMPA" with the various domains in the DNS Search list.
  4. (if you have it) Does a WINS lookup to see if COMPA exists as a Workgroup or Domain.
  5. Checks the Network Browse List to see if a COMPA domain is visible.

Once it finds a domain controller, it them asks it for it's AD DNS name. Then,

  1. Checks DNS for the SRV records for company.com's domain controllers

Contrast this with the workflow for the DNS style of name (company.com in your example)

  1. Checks DNS for the SRV records for company.com's domain controllers
  2. Queries DNS for the SRV records relating to the Domain's AD Sites

A lot shorter. Once it has identified the domain controllers in the domain, it then uses the credentials supplied by the domaining user to attempt to contact the DC. That can happen over any of the x security protocols AD uses:

  • LanMan (LM)
  • NTLM
  • NTLMv2
  • Kerberos

The exact protocol is negotiated between the workstation and the domain controller. If no common protocol can be agreed to, the workstation can't be domained.

Related Topic