Windows Hello for Business
The most common way of protecting access to a system or resource is to introduce authentication and authorization processes. This is exactly what AD does as well; when a user logs in to a domain-joined device, AD first authenticates the user to see whether they're the user they claim to be. Once authentication is successful, it then checks what the user is allowed to do (authorization). For the authentication process, we use usernames and passwords. This is what all identity infrastructure attackers are after. They need some kind of username and password to get into the system. A password is a symmetric secret that is transmitted to the server every time we authenticate. When passwords appear in different systems, they can be stolen or intercepted on transmission. Back in 2004 at the RSA Security conference, Bill Gates said "People use the same password on different systems; they write them down and they just don't meet the challenge for anything...