<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Case number in subject]</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Casemail to cc]</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Dochelp to bcc]</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thank you for your request. The case number 2404240040010190 has been created for this inquiry. One of our team members will follow up with you soon.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Best regards, </div>
<div id="Signature">
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51); background-color: white;">Mike Bowen</span><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51);"><br>
</span><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51); background-color: white;">Sr. Escalation Engineer - Microsoft® Corporation</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"> </p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Sent:</b> Tuesday, April 23, 2024 5:52 PM<br>
<b>To:</b> Interoperability Documentation Help <dochelp@microsoft.com><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [EXTERNAL] Protocol documentation for automatic rollover of expired passwords with UF_SMARTCARD_REQUIRED</font>
<div> </div>
</div>
<div style="text-align:left; direction:ltr">
<div>Kia Ora Dochelp!</div>
<div><br>
</div>
<div>I'm looking for any documentation as to the finer details of</div>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid; padding-left:1ex">
<div>
<div style="color:rgb(0,0,0); font-family:Ubuntu; font-size:14.666667px; font-style:normal; font-variant-caps:normal; font-weight:400; letter-spacing:normal; orphans:auto; text-align:left; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; background-color:rgb(255,255,255); text-decoration:none">
DCs can support automatic rolling of the NTLM and other password-based secrets on a user account configured to require PKI authentication. This configuration is also known as "Smart card required for interactive logon"</div>
<div style="color:rgb(0,0,0); font-family:Ubuntu; font-size:14.666667px; font-style:normal; font-variant-caps:normal; font-weight:400; letter-spacing:normal; orphans:auto; text-align:left; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; background-color:rgb(255,255,255); text-decoration:none">
</div>
</div>
</blockquote>
<div><br>
</div>
<div>from</div>
<div><br>
</div>
<div> <a href="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features" originalsrc="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features" shash="OtxJzSZb6WI01h+CXjugWalU/W/Rg2qeR8+vFVP90fr24Z4IXqBP45m2/XYK19QSdUOIBC8KXEoR9tu16FCZE0EFjVfTv0NUKUjcSb8Hc93wA8SBUBcEirlf79HpzNTCLDnpGpqiHX/mR0mAVj0xtD5rWudAJqbhnWwcwg9Bsx8=" originalsrc="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features" shash="MqTtoDmz9Hou5BPNaQELz3yeQh6Q0x/puLqchC60GJkTSGt6URZR6dK4OFVzptvsKOPmFKeFH0u4EdYBErTMSjXZ9mcxp6TH4MlISlS6pIQbb+RUoY1CwjrF25Ft7yzVvyLkRC/upH8Z/uBA4Soq6gp5p3RQrocat1vIiIlAYb8=">https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features</a></div>
<div><br>
</div>
<div>I don't see any mention of this in MS-ADPS, but am not sure where next to check.</div>
<div><br>
</div>
<div>In particular, while I have reproduced the rollover for 'must change now', I'm wondering when the password otherwise rolls over, is it before the expiry (eg with the 'old password allowed time' grace of 60mins for example, or at the expiry?</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Andrew Bartlett</div>
<div><span></span></div>
</div>
</body>
</html>