How Windows NT/Challenge Response Authentication Works

SUMMARY

Your Web server supports Microsoft Windows NT Challenge/Response authentication, which identifies users without requiring the transmission of actual passwords or account information across a network. Instead, the Web server authenticates users by carrying out a procedure that challenges the user's Web browser to carry out a specific mathematical computation involving the password and to respond by returning the results of the computation to their Web server.

Next, your Web server duplicates this computation using the user's account password information, and compares this result to the user's result. If both results match, your Web server recognizes that the user has the correct password and grants access.

Your server will not switch to another authentication method if the user is initially denied access. Instead, the user's Web browser will prompt the user for a user name and password, which the browser will process and send to your Web server as part of the Windows NT Challenge/Response authentication protocol. If this second authentication attempt fails, the user will be denied access to the Web server.