Winlogon and Active Directory

To guarantee secure authentication, Thinfinity® Workspace collaborates directly with Windows’ native credential verification mechanisms. The primary component responsible for this process is Winlogon, which performs user authentication locally or via validation against an Active Directory domain.

How Thinfinity Workspace Uses Winlogon for Authentication

Winlogon is the core subsystem within the Windows operating system responsible for overseeing user authentication and session management. During user authentication via the Thinfinity Workspace login interface, the Winlogon process intercepts the credential input, conducts validation procedures against security accounts, and establishes or terminates user sessions accordingly.

This validation process can follow two main paths:

1. Local Authentication (SAM - Security Account Manager): Winlogon checks the credentials against the server’s own local user database. This method is useful for standalone servers or environments that are not part of a network domain.
2. Domain Authentication: In a corporate network environment, Winlogon forwards the credentials to a domain controller to be validated by AD (Active Directory). This is the most common method in business settings.

In the context of Thinfinity Workspace, Winlogon acts as the default authentication engine, regardless of the validation method used behind the scenes.

How Thinfinity Workspace Integrates Windows Active Directory (AD)

For most enterprise deployments, Thinfinity Workspace is integrated with Windows Active Directory (AD). The Microsoft directory service functions as the backbone for user and resource management on a domain network, allowing administrators to centrally manage:

• User accounts and security groups.
• Computers, servers, and printers.
• Configuration and security policies that apply across the entire network.

Advantages of AD Integration in Thinfinity Workspace

Single Sign-On (SSO): Users authenticate with the same credentials they use to log into their computers and access other network resources, simplifying the user experience.

Centralized Access Management: Administrators can grant or deny access to Thinfinity Workspace’s remote apps and desktops based on existing users and groups in Active Directory, without needing to create duplicate users.

Policy Enforcement: Active Directory’s Group Policies (GPOs) can be used to enforce security and configuration settings for remote sessions.

Authentication Flow in a Domain Environment

When a user connects to Thinfinity Workspace on a corporate network, the process is as follows:

1. The user enters their domain username and password on the Thinfinity Workspace login page.
2. Thinfinity Workspace passes these credentials to the server’s Winlogon process.
3. Winlogon identifies that the user belongs to a domain and communicates with an Active Directory domain controller.
4. Active Directory validates the credentials.
5. Once validated, Thinfinity Workspace grants the user access according to the permissions assigned in the platform’s configuration.

See also

To integrate an Active Directory domain that is not on the same network (for example, a cloud-hosted Workspace authenticating against an on-premises domain), see Understanding AD Cache (RemoteAD).