In this lesson, I will discuss the Windows logon process. The Windows logon process hasn't changed much from version to version. Meaning from Window 7 to Windows 8 to Windows 10. However, there are some things, as system administrators, you need to understand. What Windows is doing behind the scenes to make sure that you can log in to a system. So I'm going to start the authentication sequence, and this is called the secure authentication sequence. So I just pressed my left mouse button, which now allows me to enter my password. We could also press CTRL+ALT+Delete to trigger that SAS process, or the secure authentication sequence process. Prior to Windows 10, this was also called GINA, which was a Graphical Identification and Authentication process. Now what Microsoft has introduced is called credential providers, and I'll talk about that here in a minute. So notice that it just went back to the time screen. So if I type anything here, now I'm ready to start entering my password. I'm going to enter my password here. What's happening at the moment is I've just provided my credentials. The local security authority or LSA processes those credentials and they are converted into the same form in which they were stored in the account database. The account database within Windows, locally is called the SAM file or the SAM database. And this stores all the local accounts for the user. What happens is, the LSA hashes the password that I entered, checks to make sure that it matches the hashed password inside the SAM file. And then I'm either allowed or authenticated into the system, or denied. If the logon is, or the computer is joined to the domain, I have other ways that Windows is trying to authenticate me to make sure I can get in. So this way is called Kerberos, and we talked about that in a previous lesson. So we use Kerberos for domain access and we use the SAM account for local access. Now the problem with Kerberos is that if I've never logged on to this domain before, I may not be able to get in. So right here, I can see that I have Internet access, it says connected. Now if I wasn't able to connect to the Internet and I had logged into this machine before my local credentials that are stored for the domain allow me to get in. Those are called cached credentials. However, if I've never logged in before, I'm not going to be able to get in, because there's going to be no domain controller available for me to login. Let me look at my Greg account real quick. So I'm going to type in users here, okay? And you can see that I'm a local administrator. When we first setup Windows, we're also provided with the option to join the computer to a Microsoft account. So we don't have to come up with a local account. Well that's fine, as long as we have Internet. Additionally, I talked about credential providers. Credential providers are a way for third parties to authenticate users. So think of two factor authentication, for example. Duo security, and that's spelled D-U-O, provides many organizations with two factor authentication. The problem is if an update is made to the system that locks down Internet access. And I'm not able to access the third party, that I have the credential provider integrated with, then I've just locked myself out of that system. So it's a good idea to integrate the third party credential provider into the domain versus locally. So in conclusion, while the advances of the Internet and the advances of Windows provide us a myriad of different ways to authenticate users, now we're relying on the Internet to login. So if users are not able to log in, look at how users are logged in and if they're able to access Internet or if they're not able to access the Internet.