Machine password encrypted by admin password in SP3?

[Luke Kenneth Casson Leighton]

On Wed, 22 Apr 1998, Paul Ashton wrote:

> 
> paulle at microsoft.com said:
> 
> > You have to add the workstation to the DC _from the workstation_ by
> > specifying the name of an account with the right to create machine accounts
> > and its password.

what this does over-the-wire is to open a \PIPE\samr with NTLMSSP
encryption, and add an LSA_USER_INFO_21 structure with ACB_WKSTRUST, an
account of MACHINE$ and a random password.

> > Usually, that's an admin. If you add the account at the
> > PDC (or remotely to the PDC from a workstation already in the domain) it
> > will create a well known password (the machine name) for the new machine.