<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Tom to Bcc]</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Jo,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks for reaching out with your [MS-ADTS] question. I'll be your point of contact moving forward for this case. I will research this and get back to you with my findings.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA3c2023e6-4e73-0372-97be-98926cb721f4" class="OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Tom Jebo <tomjebo@microsoft.com><br>
<b>Sent:</b> Monday, May 13, 2024 10:32 PM<br>
<b>To:</b> Jo Sutton <jsutton@samba.org>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> RE: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password - TrackingID#2405140040001588
</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[dochelp to bcc]<br>
[support mail to cc]<br>
<br>
Hey Jo,<br>
<br>
Thanks for your request regarding MS-ADTS. One of the Open Specifications team members will respond to assist you. In the meantime, we’ve created case 2405140040001588 to track this request. Please leave the case number in the subject when communicating with
our team about this request.<br>
<br>
Best regards,<br>
Tom Jebo<br>
Microsoft Open Specifications Support<br>
<br>
-----Original Message-----<br>
From: Jo Sutton <jsutton@samba.org><br>
Sent: Monday, May 13, 2024 9:59 PM<br>
To: cifs-protocol@lists.samba.org; Interoperability Documentation Help <dochelp@microsoft.com><br>
Subject: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password<br>
<br>
[Some people who received this message don't often get email from jsutton@samba.org. Learn why this is important at
<a href="https://aka.ms/LearnAboutSenderIdentification">https://aka.ms/LearnAboutSenderIdentification</a> ]<br>
<br>
Hi dochelp,<br>
<br>
I can’t find any mention in Microsoft’s documentation of what should happen when a Group Managed Service Account authenticates with a previous password — i.e. via NTLM with an NT hash from ntPwdHistory, or via Kerberos with a key from the OldCredentials part
of a Primary:Kerberos-Newer-Keys blob.<br>
<br>
Should the previous password be accepted for NTLM logons? For Kerberos logons? Should only the immediately previous password be accepted, or should earlier passwords be accepted too? And during what period should the previous password(s) be accepted — for example,
the five minutes immediately following the time specified by pwdLastSet?<br>
<br>
Any information you can provide to shine light on these questions would be welcome.<br>
<br>
Cheers,<br>
Jo (she/her)<br>
</div>
</span></font></div>
</body>
</html>