Oracle remote OS authentication, security risks with domain users
Beware the OS authentication is done by client machine, not by the database server.

I think that within reasonable pessimism to Oracle tools you could expect that it boils down to this:  database server receives a TCP connection from whichever IP address that might pass the network path, and that connection just claims "I promise I've done OS authentication and, trust me, this connection is made on behalf of OPS$JohnSmithCEO."  Neither the database client or database server is given OS password for additional OS authentication! And you can't even trust that this connection came from a valid Oracle software. It can be man-in-the-middle in reality. It's worse than telnet.

Whatever "Windows-specific" checks are done by Oracle, they seem contrived and you can't really trust they are complete and secure.