How Windows NT Challenge/Response Works (174775)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SUMMARY

Microsoft Internet Information Server (IIS) supports Microsoft Windows NT Challenge/Response authentication that a user identifies without requiring the transmission of actual passwords or account information across a network.

However, the Web server authenticates users by carrying out a procedure that challenges the user's Web browser to carry out a specific mathematical computation involving the password and to respond by returning the results of the computation to IIS. IIS then duplicates this computation using the user's account password information, and compares this result to the user's result. If both results match, IIS recognizes that the user has the correct password and grants access.

Your server will not switch to another authentication method if the user is initially denied access. Instead, the user's Web browser will prompt the user for a user name and password that the browser will process and send to IIS as part of the Windows NT Challenge/Response authentication protocol. If this second authentication attempt fails, the user will be denied access to IIS.

MORE INFORMATION

You will find Windows NT Challenge/Response authentication useful in an intranet environment, where both user and Web server computers are in the same, secure domain. Additionally, you can only use Windows NT Challenge/Response to authenticate users that logon with Web browsers capable of supporting this method. Currently, Microsoft Internet Explorer version 2.0 or later is the only Web browser that supports Windows NT Challenge\Response.