diff --git a/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md index e50d7474e8..6624aea16d 100644 --- a/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md @@ -14,7 +14,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra join authentication to Microsoft Entra ID.](images/howitworks/auth/auth-aadj-cloud.png) -:::image type="content" source="images/howitworks/auth/entra-join-entra.svg" alt-text="Diagram of a Microsoft Entra join device authenticating to Microsoft Entra ID." lightbox="images/howitworks/auth/entra-join-entra.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/entra-join-entra.png" alt-text="Diagram of a Microsoft Entra join device authenticating to Microsoft Entra ID." lightbox="images/howitworks/auth/entra-join-entra.png" border="false"::: > [!NOTE] > All Microsoft Entra joined devices authenticate with Windows Hello for Business to Microsoft Entra ID the same way. The Windows Hello for Business trust type only impacts how the device authenticates to on-premises AD. @@ -31,7 +31,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra join authentication to Active Directory.](images/howitworks/auth/auth-aadj-cloudtrust-kerb.png) -:::image type="content" source="images/howitworks/auth/entra-join-ad-ckt.svg" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using cloud Kerberos trust." lightbox="images/howitworks/auth/entra-join-ad-ckt.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/entra-join-ad-ckt.png" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using cloud Kerberos trust." lightbox="images/howitworks/auth/entra-join-ad-ckt.png" border="false"::: | Phase | Description | | :----: | :----------- | @@ -42,7 +42,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra join authentication to Active Directory using a Key.](images/howitworks/auth/auth-aadj-keytrust-kerb.png) -:::image type="content" source="images/howitworks/auth/entra-join-ad-kt.svg" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using key trust." lightbox="images/howitworks/auth/entra-join-ad-kt.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/entra-join-ad-kt.png" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using key trust." lightbox="images/howitworks/auth/entra-join-ad-kt.png" border="false"::: | Phase | Description | | :----: | :----------- | @@ -57,7 +57,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra join authentication to Active Directory using a Certificate.](images/howitworks/auth/auth-aadj-certtrust-kerb.png) -:::image type="content" source="images/howitworks/auth/entra-join-ad-ct.svg" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using certificate trust." lightbox="images/howitworks/auth/entra-join-ad-ct.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/entra-join-ad-ct.png" alt-text="Diagram of a Microsoft Entra join device authenticating to Active Directory using certificate trust." lightbox="images/howitworks/auth/entra-join-ad-ct.png" border="false"::: | Phase | Description | | :----: | :----------- | @@ -70,7 +70,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ## Microsoft Entra hybrid join authentication using cloud Kerberos trust -:::image type="content" source="images/howitworks/auth/hybrid-entra-join-ckt.svg" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using cloud Kerberos trust." lightbox="images/howitworks/auth/hybrid-entra-join-ckt.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/hybrid-entra-join-ckt.png" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using cloud Kerberos trust." lightbox="images/howitworks/auth/hybrid-entra-join-ckt.png" border="false"::: | Phase | Description | | :----: | :----------- | @@ -84,7 +84,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra hybrid join authentication using a key.](images/howitworks/auth/auth-haadj-keytrust.png) -:::image type="content" source="images/howitworks/auth/hybrid-entra-join-kt.svg" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using key trust." lightbox="images/howitworks/auth/hybrid-entra-join-kt.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/hybrid-entra-join-kt.png" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using key trust." lightbox="images/howitworks/auth/hybrid-entra-join-kt.png" border="false"::: | Phase | Description | | :----: | :----------- | @@ -103,7 +103,7 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra hybrid join authentication using a Certificate.](images/howitworks/auth/auth-haadj-certtrust.png) -:::image type="content" source="images/howitworks/auth/hybrid-entra-join-ct.svg" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using certificate trust." lightbox="images/howitworks/auth/hybrid-entra-join-ct.svg" border="false"::: +:::image type="content" source="images/howitworks/auth/hybrid-entra-join-ct.png" alt-text="Diagram of a Microsoft Entra hybrid join device authenticating to Active Directory using certificate trust." lightbox="images/howitworks/auth/hybrid-entra-join-ct.png" border="false"::: | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/edge-on.png b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/edge-on.png deleted file mode 100644 index 06a13b6f1a..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/edge-on.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/key-credential-provider.svg b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/key-credential-provider.svg deleted file mode 100644 index dd8c09b2dd..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/key-credential-provider.svg +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-off.png b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-off.png deleted file mode 100644 index ccfade47d9..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-off.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-on.png b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-on.png deleted file mode 100644 index abb9b6456d..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/lock-screen-on.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-off.png b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-off.png deleted file mode 100644 index 8913baa8ce..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-off.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-on.png b/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-on.png deleted file mode 100644 index b0d03a6299..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/_deleteme_passwordless/uac-on.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.png new file mode 100644 index 0000000000..ef60414e70 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.svg deleted file mode 100644 index b08f1a1817..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ckt.svg +++ /dev/null @@ -1,216 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - auth-entra-join-ad-ckt - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Windows - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Windows - - - Object lifeline.1022 - DNS - - Sheet.1023 - - - - Sheet.1024 - - - - Sheet.1025 - - - Sheet.1026 - - - - - DNS - - - Message.1027 - DcLocator - - - DcLocator - - Return Message.1028 - return list of domain controlers - - - return list of domain controlers - - Message.1029 - TGS_REQ w/ Partial TGT - - - TGS_REQ w/ Partial TGT - - Self Message.1030 - Validate partial TGT - - - Validate partial TGT - - Return Message.1031 - TGT - - - TGT - - Self Message.1032 - find _ldap._tcp.dc._msdcs.domainhint.om - - - find _ldap._tcp.dc._msdcs.domainhint.om - - Self Message.1036 - Get domain hint from key metadata - - - Get domain hint from keymetadata - - Dynamic connector.1039 - - - Object lifeline.1040 - Domain Controller - - Sheet.1041 - - - - Sheet.1042 - - - - Sheet.1043 - - - - Domain Controller - - - Object lifeline.1045 - Windows - - Sheet.1046 - - - - Sheet.1047 - - - - Sheet.1048 - - - - Windows - - - Object lifeline.1050 - DNS - - Sheet.1051 - - - - Sheet.1052 - - - - Sheet.1053 - - - - DNS - - - State.1090 - A - - A - - State.1055 - B - - B - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.png new file mode 100644 index 0000000000..e45839808a Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.svg deleted file mode 100644 index 9d950e0cbc..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-ct.svg +++ /dev/null @@ -1,245 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - auth-entra-join-ad-ct - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Windows - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Windows - - - Object lifeline.1022 - DNS - - Sheet.1023 - - - - Sheet.1024 - - - - Sheet.1025 - - - Sheet.1026 - - - - - DNS - - - Message.1027 - DcLocator - - - DcLocator - - Return Message.1028 - return list of domain controlers - - - return list of domain controlers - - Message.1029 - KRB_AS_REQ w/signed preAuth data - - - KRB_AS_REQ w/signed preAuth data - - Self Message.1030 - PreAuth data validation - - - PreAuth datavalidation - - Return Message.1031 - KRB_AS_REP w/KDC cert and TGT - - - KRB_AS_REP w/KDC cert and TGT - - Self Message.1032 - find _ldap._tcp.dc._msdcs.domainhint.om - - - find _ldap._tcp.dc._msdcs.domainhint.om - - Self Message.1033 - Kdc cert chains and validates - - - Kdc cert chains and validates - - Self Message.1034 - KDC cert include KDC Authentication EKU (1.3.6.1.5.2.3.5) - - - KDC cert include KDC Authentication EKU(1.3.6.1.5.2.3.5) - - Self Message.1035 - KDC cert subject alternate name matches domain DNS - - - KDC certsubject alternate namematches domain DNS - - Self Message.1036 - Get domain hint from Certificate - - - Get domain hint from Certificate - - Self Message.1037 - WHFB privKey signs preAuth data - - - WHFB privKeysigns preAuth data - - Object lifeline.1038 - Domain Controller - - Sheet.1039 - - - - Sheet.1040 - - - - Sheet.1041 - - - - Domain Controller - - - Object lifeline.1043 - Windows - - Sheet.1044 - - - - Sheet.1045 - - - - Sheet.1046 - - - - Windows - - - Object lifeline.1048 - DNS - - Sheet.1049 - - - - Sheet.1050 - - - - Sheet.1051 - - - - DNS - - - State.1090 - A - - A - - State.1053 - B - - B - - State.1054 - C - - C - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.png new file mode 100644 index 0000000000..213efe1241 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.svg deleted file mode 100644 index 267034368c..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-ad-kt.svg +++ /dev/null @@ -1,245 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - auth-entra-join-ad-kt - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Windows - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Windows - - - Object lifeline.1022 - DNS - - Sheet.1023 - - - - Sheet.1024 - - - - Sheet.1025 - - - Sheet.1026 - - - - - DNS - - - Message.1027 - DcLocator - - - DcLocator - - Return Message.1028 - return list of domain controlers - - - return list of domain controlers - - Message.1029 - KRB_AS_REQ w/signed preAuth data - - - KRB_AS_REQ w/signed preAuth data - - Self Message.1030 - PreAuth data validation - - - PreAuth datavalidation - - Return Message.1031 - KRB_AS_REP w/KDC cert and TGT - - - KRB_AS_REP w/KDC cert and TGT - - Self Message.1032 - find _ldap._tcp.dc._msdcs.domainhint.om - - - find _ldap._tcp.dc._msdcs.domainhint.om - - Self Message.1033 - Kdc cert chains and validates - - - Kdc cert chains and validates - - Self Message.1034 - KDC cert include KDC Authentication EKU (1.3.6.1.5.2.3.5) - - - KDC cert include KDC Authentication EKU(1.3.6.1.5.2.3.5) - - Self Message.1035 - KDC cert subject alternate name matches domain DNS - - - KDC certsubject alternate namematches domain DNS - - Self Message.1036 - Get domain hint from key metadata - - - Get domain hint from keymetadata - - Self Message.1037 - WHFB privKey signs preAuth data - - - WHFB privKeysigns preAuth data - - Object lifeline.1038 - Domain Controller - - Sheet.1039 - - - - Sheet.1040 - - - - Sheet.1041 - - - - Domain Controller - - - Object lifeline.1043 - Windows - - Sheet.1044 - - - - Sheet.1045 - - - - Sheet.1046 - - - - Windows - - - Object lifeline.1048 - DNS - - Sheet.1049 - - - - Sheet.1050 - - - - Sheet.1051 - - - - DNS - - - State.1090 - A - - A - - State.1053 - B - - B - - State.1054 - C - - C - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.png new file mode 100644 index 0000000000..584702dcd1 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.svg deleted file mode 100644 index 563162bee2..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/entra-join-entra.svg +++ /dev/null @@ -1,367 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - auth-entra-join-entra - - Object lifeline.46 - Credential Provider - - Sheet.1001 - - - - Sheet.1002 - - - - Sheet.1003 - - - Sheet.1004 - - - - - Credential Provider - - - Object lifeline.1005 - Cloud AP provider - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Cloud AP provider - - - Object lifeline.1010 - Microsoft Entra ID - - Sheet.1011 - - - - Sheet.1012 - - - - Sheet.1013 - - - Sheet.1014 - - - - - Microsoft Entra ID - - - Object lifeline.1015 - Winlogon - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Winlogon - - - Self Message.1020 - User provides gesture - - - User provides gesture - - Message.1021 - Collected Credentials - - - Collected Credentials - - Object lifeline.1022 - LSA - - Sheet.1023 - - - - Sheet.1024 - - - - Sheet.1025 - - - Sheet.1026 - - - - - LSA - - - Message.1027 - Show the WHFB Cred Prov - - - Show the WHFB Cred Prov - - Return Message.1028 - Collected Credentials - - - Collected Credentials - - Message.1029 - Collected Credentials - - - Collected Credentials - - Message.1030 - Request Nonce - - - Request Nonce - - Return Message.1033 - Nonce - - - Nonce - - Return Message.1034 - PRT w/Session key - - - PRT w/Session key - - Return Message.1035 - Successful Authentication - - - Successful Authentication - - Self Message.1036 - Sign nonce WHFB privkey - - - Sign nonce WHFB privkey - - Message.1037 - Signed Nonce - - - Signed Nonce - - Self Message.1038 - Validate signature WHFB pubkey - - - Validate signature WHFB pubkey - - Self Message.1039 - Validate Nonce - - - Validate Nonce - - Self Message.1040 - Decrypt Session key w/ Transport key - - - Decrypt Session key w/ Transport key - - Self Message.1041 - Import Session Key to TPM - - - Import Session Keyto TPM - - Return Message.1042 - - - - Self Message.1043 - Load User Desktop - - - Load User Desktop - - State.1090 - A - - A - - Object lifeline.1045 - Credential Provider - - Sheet.1046 - - - - Sheet.1047 - - - - Sheet.1048 - - - - Credential Provider - - - Object lifeline.1050 - Cloud AP provider - - Sheet.1051 - - - - Sheet.1052 - - - - Sheet.1053 - - - - Cloud AP provider - - - Object lifeline.1055 - Microsoft Entra ID - - Sheet.1056 - - - - Sheet.1057 - - - - Sheet.1058 - - - - Microsoft Entra ID - - - Object lifeline.1060 - Winlogon - - Sheet.1061 - - - - Sheet.1062 - - - - Sheet.1063 - - - - Winlogon - - - Object lifeline.1065 - LSA - - Sheet.1066 - - - - Sheet.1067 - - - - Sheet.1068 - - - - LSA - - - State.1069 - B - - B - - State.1070 - C - - C - - State.1071 - D - - D - - State.1072 - E - - E - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.png new file mode 100644 index 0000000000..2ee3ebd7ff Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.svg deleted file mode 100644 index af536a80b1..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ckt.svg +++ /dev/null @@ -1,500 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - auth-hybrid-entra-join-ckt - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Winlogon - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Winlogon - - - Object lifeline.1020 - Microsoft Entra ID - - Sheet.1021 - - - - Sheet.1022 - - - - Sheet.1023 - - - Sheet.1024 - - - - - Microsoft Entra ID - - - Object lifeline.1025 - LSA - - Sheet.1026 - - - - Sheet.1027 - - - - Sheet.1028 - - - Sheet.1029 - - - - - LSA - - - Object lifeline.1030 - Credential Provider - - Sheet.1031 - - - - Sheet.1032 - - - - Sheet.1033 - - - Sheet.1034 - - - - - CredentialProvider - - - Object lifeline.1035 - Cloud Auth provider - - Sheet.1036 - - - - Sheet.1037 - - - - Sheet.1038 - - - Sheet.1039 - - - - - Cloud Authprovider - - - Object lifeline.1040 - Kerberos provider - - Sheet.1041 - - - - Sheet.1042 - - - - Sheet.1043 - - - Sheet.1044 - - - - - Kerberosprovider - - - Self Message.1020 - User provides gesture - - - User provides gesture - - Return Message.1028 - Collected Credentials - - - Collected Credentials - - Message.1029 - Collected Credentials - - - Collected Credentials - - Message.1027 - Show the WHFB Cred Prov - - - Show the WHFB Cred Prov - - Return Message.1061 - TGT - - - TGT - - Message.1062 - Collected Credentials - - - Collected Credentials - - Message.1030 - Request Nonce - - - Request Nonce - - Return Message.1033 - Nonce - - - Nonce - - Return Message.1034 - PRT w/Session key and Partial TGT - - - PRT w/Session key and Partial TGT - - Self Message.1066 - Sign nonce WHFB privkey - - - Sign nonce WHFB privkey - - Message.1037 - Signed Nonce - - - Signed Nonce - - Self Message.1038 - Validate signature WHFB pubkey - - - Validate signature WHFB pubkey - - Self Message.1039 - Validate Nonce - - - Validate Nonce - - Self Message.1040 - Decrypt Session key w/ Transport key - - - Decrypt Session key w/ Transport key - - Self Message.1041 - Import Session Key to TPM - - - Import Session Keyto TPM - - Return Message.1035 - Partial TGT - - - Partial TGT - - Self Message.1043 - Load User Desktop - - - Load User Desktop - - Return Message.1075 - Success - - - Success - - Message.1021 - Partial TGT - - - Partial TGT - - Self Message.1036 - Get domain hint from computer - - - Get domain hint from computer - - Return Message.1051 - return list of domain controlers - - - return list of domain controlers - - Message.1060 - DcLocator via DNS - - - DcLocator via DNS - - Return Message.1082 - TGT - - - TGT - - Message.1083 - TGS_REQ w/ Partial TGT - - - TGS_REQ w/ Partial TGT - - State - B - - B - - State.1087 - D - - D - - State.1088 - C - - C - - State.1089 - E - - E - - State.1090 - A - - A - - Object lifeline.1126 - Domain Controller - - Sheet.1127 - - - - Sheet.1128 - - - - Sheet.1129 - - - - Domain Controller - - - Object lifeline.1131 - Winlogon - - Sheet.1132 - - - - Sheet.1133 - - - - Sheet.1134 - - - - Winlogon - - - Object lifeline.1136 - Microsoft Entra ID - - Sheet.1137 - - - - Sheet.1138 - - - - Sheet.1139 - - - - Microsoft Entra ID - - - Object lifeline.1141 - LSA - - Sheet.1142 - - - - Sheet.1143 - - - - Sheet.1144 - - - - LSA - - - Object lifeline.1146 - Credential Provider - - Sheet.1147 - - - - Sheet.1148 - - - - Sheet.1149 - - - - CredentialProvider - - - Object lifeline.1151 - Cloud Auth provider - - Sheet.1152 - - - - Sheet.1153 - - - - Sheet.1154 - - - - Cloud Authprovider - - - Object lifeline.1156 - Kerberos provider - - Sheet.1157 - - - - Sheet.1158 - - - - Sheet.1159 - - - - Kerberosprovider - - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.png new file mode 100644 index 0000000000..7e4cb22dcf Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.svg deleted file mode 100644 index 349f7cee4d..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-ct.svg +++ /dev/null @@ -1,541 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - auth-hybrid-join-ct - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Winlogon - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Winlogon - - - Object lifeline.1020 - Microsoft Entra ID - - Sheet.1021 - - - - Sheet.1022 - - - - Sheet.1023 - - - Sheet.1024 - - - - - Microsoft Entra ID - - - Object lifeline.1025 - LSA - - Sheet.1026 - - - - Sheet.1027 - - - - Sheet.1028 - - - Sheet.1029 - - - - - LSA - - - Object lifeline.1030 - Credential Provider - - Sheet.1031 - - - - Sheet.1032 - - - - Sheet.1033 - - - Sheet.1034 - - - - - CredentialProvider - - - Object lifeline.1035 - Cloud Auth provider - - Sheet.1036 - - - - Sheet.1037 - - - - Sheet.1038 - - - Sheet.1039 - - - - - Cloud Authprovider - - - Object lifeline.1040 - Kerberos provider - - Sheet.1041 - - - - Sheet.1042 - - - - Sheet.1043 - - - Sheet.1044 - - - - - Kerberosprovider - - - Self Message.1020 - User provides gesture - - - User provides gesture - - Message.1021 - Collected Credentials - - - Collected Credentials - - Return Message.1028 - Collected Credentials - - - Collected Credentials - - Message.1029 - Collected Credentials - - - Collected Credentials - - Message.1027 - Show the WHFB Cred Prov - - - Show the WHFB Cred Prov - - Self Message.1036 - Get domain hint from computer - - - Get domain hint from computer - - Return Message.1051 - return list of domain controlers - - - return list of domain controlers - - Message.1052 - KRB_AS_REQ w/signed preAuth data - - - KRB_AS_REQ w/signed preAuth data - - Self Message.1030 - PreAuth data validation - - - PreAuth datavalidation - - Return Message.1031 - KRB_AS_REP w/KDC cert and TGT - - - KRB_AS_REP w/KDC cert and TGT - - Self Message.1033 - Kdc cert chains and validates - - - Kdc cert chains and validates - - Self Message.1034 - KDC cert include KDC Authentication EKU (1.3.6.1.5.2.3.5) - - - KDC cert include KDC Authentication EKU(1.3.6.1.5.2.3.5) - - Self Message.1035 - KDC cert subject alternate name matches domain DNS - - - KDC cert subject alternate namematches domain DNS - - Self Message.1037 - WHFB privKey signs preAuth data - - - WHFB privKeysigns preAuth data - - Message.1060 - DcLocator via DNS - - - DcLocator via DNS - - Return Message.1061 - TGT - - - TGT - - Message.1062 - Collected Credentials - - - Collected Credentials - - Message.1030 - Request Nonce - - - Request Nonce - - Return Message.1033 - Nonce - - - Nonce - - Return Message.1034 - PRT w/Session key - - - PRT w/Session key - - Self Message.1066 - Sign nonce WHFB privkey - - - Sign nonce WHFB privkey - - Message.1037 - Signed Nonce - - - Signed Nonce - - Self Message.1038 - Validate signature WHFB pubkey - - - Validate signature WHFB pubkey - - Self Message.1039 - Validate Nonce - - - Validate Nonce - - Self Message.1040 - Decrypt Session key w/ Transport key - - - Decrypt Session key w/ Transport key - - Self Message.1041 - Import Session Key to TPM - - - Import Session Keyto TPM - - Return Message.1035 - Successful Authentication - - - Successful Authentication - - Self Message.1043 - Load User Desktop - - - Load User Desktop - - Return Message.1075 - Success - - - Success - - State.1090 - A - - A - - State.1077 - E - - E - - State.1078 - B - - B - - State.1079 - C - - C - - State.1080 - D - - D - - State.1081 - F - - F - - State.1082 - G - - G - - Object lifeline.1083 - Domain Controller - - Sheet.1084 - - - - Sheet.1085 - - - - Sheet.1086 - - - - Domain Controller - - - Object lifeline.1088 - Winlogon - - Sheet.1089 - - - - Sheet.1090 - - - - Sheet.1091 - - - - Winlogon - - - Object lifeline.1093 - Microsoft Entra ID - - Sheet.1094 - - - - Sheet.1095 - - - - Sheet.1096 - - - - Microsoft Entra ID - - - Object lifeline.1098 - LSA - - Sheet.1099 - - - - Sheet.1100 - - - - Sheet.1101 - - - - LSA - - - Object lifeline.1103 - Credential Provider - - Sheet.1104 - - - - Sheet.1105 - - - - Sheet.1106 - - - - CredentialProvider - - - Object lifeline.1108 - Cloud Auth provider - - Sheet.1109 - - - - Sheet.1110 - - - - Sheet.1111 - - - - Cloud Authprovider - - - Object lifeline.1113 - Kerberos provider - - Sheet.1114 - - - - Sheet.1115 - - - - Sheet.1116 - - - - Kerberosprovider - - - diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.png b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.png new file mode 100644 index 0000000000..9f085f40e9 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.svg deleted file mode 100644 index 05f8168142..0000000000 --- a/windows/security/identity-protection/hello-for-business/images/howitworks/auth/hybrid-entra-join-kt.svg +++ /dev/null @@ -1,540 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - auth-hybrid-join-kt - - Object lifeline.1005 - Domain Controller - - Sheet.1006 - - - - Sheet.1007 - - - - Sheet.1008 - - - Sheet.1009 - - - - - Domain Controller - - - Object lifeline.1015 - Winlogon - - Sheet.1016 - - - - Sheet.1017 - - - - Sheet.1018 - - - Sheet.1019 - - - - - Winlogon - - - Object lifeline.1020 - Microsoft Entra ID - - Sheet.1021 - - - - Sheet.1022 - - - - Sheet.1023 - - - Sheet.1024 - - - - - Microsoft Entra ID - - - Object lifeline.1025 - LSA - - Sheet.1026 - - - - Sheet.1027 - - - - Sheet.1028 - - - Sheet.1029 - - - - - LSA - - - Object lifeline.1030 - Credential Provider - - Sheet.1031 - - - - Sheet.1032 - - - - Sheet.1033 - - - Sheet.1034 - - - - - CredentialProvider - - - Object lifeline.1035 - Cloud Auth provider - - Sheet.1036 - - - - Sheet.1037 - - - - Sheet.1038 - - - Sheet.1039 - - - - - Cloud Authprovider - - - Object lifeline.1040 - Kerberos provider - - Sheet.1041 - - - - Sheet.1042 - - - - Sheet.1043 - - - Sheet.1044 - - - - - Kerberosprovider - - - Self Message.1020 - User provides gesture - - - User provides gesture - - Message.1021 - Collected Credentials - - - Collected Credentials - - Return Message.1028 - Collected Credentials - - - Collected Credentials - - Message.1029 - Collected Credentials - - - Collected Credentials - - Message.1027 - Show the WHFB Cred Prov - - - Show the WHFB Cred Prov - - Self Message.1036 - Get domain hint from computer - - - Get domain hint from computer - - Return Message.1051 - return list of domain controlers - - - return list of domain controlers - - Message.1052 - KRB_AS_REQ w/signed preAuth data - - - KRB_AS_REQ w/signed preAuth data - - Self Message.1030 - PreAuth data validation - - - PreAuth datavalidation - - Return Message.1031 - KRB_AS_REP w/KDC cert and TGT - - - KRB_AS_REP w/KDC cert and TGT - - Self Message.1033 - Kdc cert chains and validates - - - Kdc cert chains and validates - - Self Message.1034 - KDC cert include KDC Authentication EKU (1.3.6.1.5.2.3.5) - - - KDC cert include KDC Authentication EKU(1.3.6.1.5.2.3.5) - - Self Message.1035 - KDC certsubject alternate name matches domain DNS - - - KDC certsubject alternate namematches domain DNS - - Self Message.1037 - WHFB privKey signs preAuth data - - - WHFB privKeysigns preAuth data - - Message.1060 - DcLocator via DNS - - - DcLocator via DNS - - Return Message.1061 - TGT - - - TGT - - Message.1062 - Collected Credentials - - - Collected Credentials - - Message.1030 - Request Nonce - - - Request Nonce - - Return Message.1033 - Nonce - - - Nonce - - Return Message.1034 - PRT w/Session key - - - PRT w/Session key - - Self Message.1066 - Sign nonce WHFB privkey - - - Sign nonce WHFB privkey - - Message.1037 - Signed Nonce - - - Signed Nonce - - Self Message.1038 - Validate signature WHFB pubkey - - - Validate signature WHFB pubkey - - Self Message.1039 - Validate Nonce - - - Validate Nonce - - Self Message.1040 - Decrypt Session key w/ Transport key - - - Decrypt Session key w/ Transport key - - Self Message.1041 - Import Session Key to TPM - - - Import Session Keyto TPM - - Return Message.1035 - Successful Authentication - - - Successful Authentication - - Self Message.1043 - Load User Desktop - - - Load User Desktop - - Return Message.1075 - Success - - - Success - - Object lifeline.1076 - Domain Controller - - Sheet.1077 - - - - Sheet.1078 - - - - Sheet.1079 - - - - Domain Controller - - - Object lifeline.1081 - Winlogon - - Sheet.1082 - - - - Sheet.1083 - - - - Sheet.1084 - - - - Winlogon - - - Object lifeline.1086 - Microsoft Entra ID - - Sheet.1087 - - - - Sheet.1088 - - - - Sheet.1089 - - - - Microsoft Entra ID - - - Object lifeline.1091 - LSA - - Sheet.1092 - - - - Sheet.1093 - - - - Sheet.1094 - - - - LSA - - - Object lifeline.1096 - Credential Provider - - Sheet.1097 - - - - Sheet.1098 - - - - Sheet.1099 - - - - CredentialProvider - - - Object lifeline.1101 - Cloud Auth provider - - Sheet.1102 - - - - Sheet.1103 - - - - Sheet.1104 - - - - Cloud Authprovider - - - Object lifeline.1106 - Kerberos provider - - Sheet.1107 - - - - Sheet.1108 - - - - Sheet.1109 - - - - Kerberosprovider - - - State.1090 - A - - A - - State.1111 - E - - E - - State.1112 - B - - B - - State.1113 - C - - C - - State.1114 - D - - D - - State.1115 - F - - F - - State.1116 - G - - G - -