Question

Can someone tell me how Active Directory stores it’s passwords for users?

Is it like this answer : storing passwords in SQL Server

Is it a hash and a salt or multiple hashes?

EDIT

I ask because I want to mimic the way they store them for a custom authorization application I want to build. Or if someone can offer a existing framework or class that handles user authorization for a web application. If I can use asp.net membership for multiple applications using web service that would be even better.

Answer 1

The best way to mimic the way Microsoft store the password for a custom authorization is to setup Active Directory Lightweight Directory Services (AD LDS) on Windows Server 2008 R2 or Active Directory Application Mode (ADAM) on Windows Server 2003. LDS and ADAM are Lightweight Directory Access Protocol (LDAP) directory services in the Windows Server 2008 R2 and Windows Server 2003 operating system that provides flexible support for directory-enabled applications, without the dependencies and domain-related restrictions of Active Directory Domain Services (AD DS). You can run them on member servers or stand-alone servers. You can also run multiple instances of AD LDS—each with its own independently managed schema—on one server.

Using Fine-Grained password policies which is provided by AD DS of Windows Server 2008, you can have different password policies. However, the AD LDS doesn’t provide the function of Fine-Grained password policy. But you can install your LDS on a Workgroup server it will have his own policy.