Identity Flow: logon and network context
Distinguish account authority, local tokens, network identity and resource authorization in a bounded teaching model.
Distinguish local identity from network identity.
- Choose a logon type and read the account authority in the initial state.
- Advance through the steps; compare the local token with the identity observed by the target.
- Choose a different logon type and inspect which context changes at the same target.
Explain why a token on one computer does not automatically grant rights on another.
The mechanism explained by this model
The model is a synthetic teaching example. It does not execute Windows API calls or real cryptography. Interactive controls require JavaScript; the mechanism is also explained in the linked lessons.
The differences between a local account, domain account, SYSTEM, and service identity
The identity chain between the Service Control Manager (SCM), LSA security functions, the service process, and any remote resource it accesses. This lesson compares account authority with local and network context; access-token internals are covered in 02.03, and the service-account lifecycle in 08.04.
Logon session and access token: How are a process’s identity and permissions formed?
After successful authentication, the authentication package creates a logon session in LSA and supplies information used to create a token. Every process has a primary token; a thread impersonating a client may also use an impersonation token. This lesson examines how access control selects an existing security context, not how directory membership changes.