<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-family:Calibri,sans-serif; font-size:11pt">Thanks for confirmation.<br>
<br>
Regards<br>
Tarun Chopra<br>
<br>
Sent from my Windows Phone<br>
</div>
</div>
<hr>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">From:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">Matthieu Patou</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Sent:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">10/29/2012 9:16 PM</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">To:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">Tarun Chopra</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Cc:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">Edgar Olougouna; cifs-protocol@samba.org</span><br>
<span style="font-family:Tahoma,sans-serif; font-size:10pt; font-weight:bold">Subject:
</span><span style="font-family:Tahoma,sans-serif; font-size:10pt">Re: GetRevealSecretsPolicyForUser</span><br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 10/25/2012 08:52 AM, Tarun Chopra wrote:<br>
> Hi Matthieu<br>
><br>
> We have updated MS-ADTS specification with 2 new groups [Allowed RODC Password Replication Group and Denied RODC Password Replication Group] in section 6.1.1.6 (Well-Known Domain-Relative Security Principals), details as follows :<br>
><br>
><br>
> 6.1.1.6.16 Allowed RODC Password Replication Group<br>
> name: Allowed RODC Password Replication Group<br>
> objectClass: group<br>
> RID: 571<br>
> groupType: { GROUP_TYPE_RESOURCE_GROUP | GROUP_TYPE_SECURITY_ENABLED }<br>
><br>
><br>
><br>
> 6.1.1.6.17 Denied RODC Password Replication Group<br>
> name: Denied RODC Password Replication Group<br>
> objectClass: group<br>
> RID: 572<br>
> groupType: { GROUP_TYPE_RESOURCE_GROUP | GROUP_TYPE_SECURITY_ENABLED }<br>
><br>
><br>
> Allowed RODC Password Replication Group and Denied RODC Password Replication Group are, by default, added to attributes msDS-RevealOnDemandGroup and msDS-NeverRevealGroup respectively during dcpromo; therefore, there is no extra processing needed---following
the processing rules as documented in MS-DRSR section 4.1.10.5.14 and MS-ADTS section 3.1.1.4.5.32 will give the correct results.<br>
Oh I missed this point, is it also in the changes that you'll publish <br>
for MS-ADTS ?<br>
> These attributes (msDS-RevealOnDemandGroup and msDS-NeverRevealGroup) are maintained by an administrator and implementations must not take a dependency on any specifics of their contents. Also see section 6.1.1.3.2 of MS-ADTS for more information related
to these attributes.<br>
><br>
> Kindly let us know if above information resolves your query or you require any further clarification.<br>
Yes all of this make sense now that I understand that it's the group <br>
that is added to the msDS-[RevealOnDeman|NeverReveal]Group not the <br>
content of the group.<br>
<br>
Matthieu.<br>
> Thanks<br>
> Tarun Chopra.<br>
><br>
> From: Edgar Olougouna<br>
> Sent: Friday, October 19, 2012 8:08 AM<br>
> To: mat@samba.org; cifs-protocol@samba.org; Tarun Chopra<br>
> Subject: RE: GetRevealSecretsPolicyForUser<br>
><br>
> Matthieu,<br>
> I am adding my colleague Tarun Chopra who will take care of this while I will be on vacation.<br>
><br>
> Thanks,<br>
> Edgar<br>
> ________________________________<br>
> From: Matthieu Patou<br>
> Sent: 10/18/2012 1:06 PM<br>
> To: Edgar Olougouna; cifs-protocol@samba.org<mailto:cifs-protocol@samba.org><br>
> Subject: Re: GetRevealSecretsPolicyForUser<br>
> Hello Edgar,<br>
><br>
> On 10/17/2012 10:21 AM, Edgar Olougouna wrote:<br>
>> Matthieu,<br>
>><br>
>> There will be an update to MS-ADTS and I will communicate the change as soon as the draft is ready.<br>
>> However, the algorithm in MS-DRSR already covers the required processing.<br>
>> Allowed RODC Password Replication Group and Denied RODC Password Replication Group are by default added to attributes msDS-RevealOnDemandGroup and msDS-NeverRevealGroup respectively during dcpromo, therefore there is no extra processing needed, following
the processing rules as documented in MS-DRSR 4.1.10.5.14 GetRevealSecretsPolicyForUser will get the right results. These attributes (msDS-RevealOnDemandGroup and msDS-NeverRevealGroup) are maintained by an administrator and implementations must not take a
dependency on any specifics of their contents. More information relating to these attributes can be found in 6.1.1.3.2 MS-ADTS 6.1.1.3.2 Read-Only Domain Controller Object .<br>
> So if I read you right then it means that those groups are used only at<br>
> (rodc)dcpromo to populate the attributes that are used for checking in<br>
> MS-DRSR 4.1.10.5.14.<br>
><br>
> Did you verify this behavior ?<br>
> This article:<br>
> <a href="http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication-policy%28v=ws.10%29.aspx">
http://technet.microsoft.com/en-us/library/rodc-guidance-for-administering-the-password-replication-policy%28v=ws.10%29.aspx</a>,<br>
> seems to indicate that it's a constant check<br>
> " <javascript:void(0)><br>
> Reviewing the accounts that are authenticated to an RODC<br>
> <javascript:void(0)><br>
> ------------------------------------------------------------------------<br>
><br>
> You should periodically review the accounts that have been authenticated<br>
> to an RODC. This information can help you plan updates that you intend<br>
> to make to the existing PRP. For example, you may want to review which<br>
> user and computer accounts have authenticated to an RODC so that you can<br>
> add those accounts to the Allowed List.<br>
><br>
> ImportantImportant<br>
> You will probably see more accounts in the *Accounts that have been<br>
> authenticated to this Read-only Domain Controller* list than will have<br>
> passwords cached. Although you may see accounts of writeable domain<br>
> controllers or members of the Domain Admins group in the list of<br>
> authenticated accounts, it does not necessarily indicate that those<br>
> accounts authenticated to the domain through the RODC. Instead, it means<br>
> that the RODC in one way or another verified the credentials of those<br>
> accounts. All default administrative accounts and domain controllers are<br>
> denied explicitly or through their membership from having their<br>
> passwords cached. If there are additional accounts that you want to make<br>
> sure are not cached, include them in the Deny list or make them members<br>
> of the Denied RODC Password Replication Group. The Deny list comprises<br>
> of the accounts that are specifically denied in the PRP from caching<br>
> their credentials on the RODC.<br>
><br>
> "<br>
><br>
> Thanks.<br>
><br>
> Matthieu<br>
><br>
> --<br>
> Matthieu Patou<br>
> Samba Team<br>
> <a href="http://samba.org">http://samba.org</a><br>
><br>
><br>
<br>
<br>
-- <br>
Matthieu Patou<br>
Samba Team<br>
<a href="http://samba.org">http://samba.org</a><br>
<br>
</div>
</span></font>
</body>
</html>