<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I dug in a bit deeper and it turns out that the password will not roll in the "nearly-expired" case unless we are at least halfway through the password's validity period.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Let me know if you are still unable to repro given this condition.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA2a46f569-210e-77c2-0e2b-2e97f786671e" class="OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="appendonsend" style="color: inherit; background-color: inherit;"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Sent:</b> Wednesday, May 15, 2024 8:52 PM<br>
<b>To:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org>; Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> Re: [cifs-protocol] [EXTERNAL] Re: msDS-ExpirePasswordsOnSmartCardOnlyAccounts - when are passwords rotated? - TrackingID#2404290040010292</span>
<div> </div>
</div>
<div style="direction: ltr; text-align: left;">Can you send me the trace tools and set up a workspace to confirm what I'm seeing, because I just don't see soon-to-expire passwords being rotated. I just see them rotated once they expire.</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Thanks,</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Andrew Bartlett</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">On Wed, 2024-05-15 at 23:39 +0000, Kristian Smith via cifs-protocol wrote:</div>
<blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left: 2px solid rgb(114, 159, 207);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
That was a speedy reply! </div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I just confirmed that all three of the conditions, including the nearing-expiration case, are checked before sending the ticket.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Let me know if you have any other questions/concerns.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA85e8a919-b4fb-cf8d-42bc-ff760ded8c0e" class="x_OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="x_appendonsend" style="color: inherit; background-color: inherit;"></div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="direction: ltr; text-align: left; display: inline-block; width: 98%;">
<div id="x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Sent:</b> Wednesday, May 15, 2024 3:58 PM<br>
<b>To:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org>; Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> [EXTERNAL] Re: msDS-ExpirePasswordsOnSmartCardOnlyAccounts - when are passwords rotated? - TrackingID#2404290040010292</span>
<div> </div>
</div>
<div style="direction: ltr; text-align: left;">Thanks. I don't see the password being rolled in the nearing expiry case. Does that happen before or after the ticket is issued? (I just see a short-life ticket being issued). </div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">I will extend my tests to see if it is rolled after the issue of the ticket, but currently when I check pwdLastSet and the returned NT password hash, neither have changed in the soon-to-expire case, but the ticket
lifetime has shortened so we know it really was soon to expire.</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Andrew Bartlett</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">On Wed, 2024-05-15 at 22:50 +0000, Kristian Smith wrote:</div>
<blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left: 2px solid rgb(114, 159, 207);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I have completed my research on this case and have some answers for you.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Your observation about the DC waiting for the PDC to process is accurate. Here are the circumstances for non-PDC's:</div>
<ul style="direction: ltr; text-align: left;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
A BDC must send the request to a PDC and wait for a response. If the request fails to the PDC, then randomize password locally.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
An RODC must send the request to a PDC, but optionally request a BDC if the PDC call fails.</div>
</li></ul>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
We roll the password in the following circumstances at logon:</div>
<ul style="direction: ltr; text-align: left;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The account has been flagged for a password change at next logon.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The password is expired.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The password is nearing expiration and validity of that ticket would surpass the expiration of the password.</div>
</li></ul>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
If you have any additional questions, please let me know.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA7c5d6d81-3a4c-1c2c-79d5-c00523daabb2" class="x_x_OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Sent:</b> Monday, April 29, 2024 11:46 AM<br>
<b>To:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org>; Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> msDS-ExpirePasswordsOnSmartCardOnlyAccounts - when are passwords rotated? - TrackingID#2404290040010292</span>
<div> </div>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I'm creating two new cases for your inquiries. This one will be for the following component of your question:</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
"Can you clarify which parts of the AD DC calls ResetSmartCardAccountPassword and under what circumstances? Is it just the KDC during PK-INIT AS-REQ processing?</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
Is there anything else that rotates these passwords? The reason I ask is that this being the only case would suggest that where the DC is not the PDC, the PK-INIT AS-REQ processing must wait for the PDC before continuing processing. (We know the local case
does, it gets the new password for return in the PAC)."</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
You will see another email from me soon regarding the other case. I will send an update once I have conducted an investigation into these concerns.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWAd90e7b62-7dfc-0ca1-8bbf-b3763e70a20c" class="x_x_x_OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Sent:</b> Sunday, April 28, 2024 9:14 PM<br>
<b>To:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org>; Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> Re: [EXTERNAL] Protocol documentation for automatic rollover of expired passwords with UF_SMARTCARD_REQUIRED - TrackingID#2404240040010190</span>
<div> </div>
</div>
<table align="left" style="direction: ltr; display: table; width: 100%; table-layout: fixed; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px; color: inherit; background-color: inherit;">
<tbody>
<tr>
<td style="direction: ltr; background-color: rgb(166, 166, 166); padding: 7px 2px; vertical-align: middle; width: 1px;">
</td>
<td style="direction: ltr; text-align: left; background-color: rgb(234, 234, 234); padding: 7px 5px 7px 15px; vertical-align: middle; color: rgb(33, 33, 33); width: 100%;">
<div style="direction: ltr; text-align: left; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 12px;">
You don't often get email from abartlet@samba.org. <a href="https://aka.ms/LearnAboutSenderIdentification" id="OWAd452ce9c-0d54-d410-8e26-2cedb818294d" class="x_x_x_OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly">
Learn why this is important</a></div>
</td>
<td align="left" style="direction: ltr; background-color: rgb(234, 234, 234); padding: 7px 5px; vertical-align: middle; color: rgb(33, 33, 33); width: 75px;">
</td>
</tr>
</tbody>
</table>
<div style="direction: ltr; text-align: left;">Thanks <span style="font-size: 14.6667px;">
Kristian, that is must helpful</span>. </div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Can you clarify which parts of the AD DC calls ResetSmartCardAccountPassword and under what circumstances? Is it just the KDC during PK-INIT AS-REQ processing?</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;">Is there anything else that rotates these passwords? The reason I ask is that this being the only case would suggest that where the DC is not the PDC, the PK-INIT AS-REQ processing must wait
for the PDC before continuing processing. (We know the local case does, it gets the new password for return in the PAC).</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;"><br>
</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;">Finally, the doc needs some correction, the references to pwdLastSet make not sense (it should always be in the past), I think a meta-variable for the calculated password expiry is what is
meant.</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;"><br>
</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;">Thanks!</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;"><br>
</div>
<div style="direction: ltr; text-align: left; font-size: 14.6667px;">Andrew Bartlett</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">On Thu, 2024-04-25 at 21:41 +0000, Kristian Smith wrote:</div>
<blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left: 2px solid rgb(114, 159, 207);">
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Michael to Bcc]</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks for reaching out with your question. The password-rolling attribute you're looking for is "msDS-ExpirePasswordsOnSmartCardOnlyAccounts" </div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>It can be found in the following docs:</b></div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[MS-SAMS] 3.3.5.7.2 Normative Specification</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[MS-ADA2] 2.319 Attribute msDS-ExpirePasswordsOnSmartCardOnlyAccounts</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>To a lesser extent here as well: </b></div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[MS-ADSC] 2.44 Class domainDNS</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Let me know if this answers the question, or if there is anything that can be clarified.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_x_x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA223aef27-9ba7-0810-eb8b-3c66c7eb3ce6" class="x_x_x_x_OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="x_x_x_x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Michael Bowen <Mike.Bowen@microsoft.com><br>
<b>Sent:</b> Wednesday, April 24, 2024 10:39 AM<br>
<b>To:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org>; Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> Re: [EXTERNAL] Protocol documentation for automatic rollover of expired passwords with UF_SMARTCARD_REQUIRED - TrackingID#2404240040010190</span>
<div> </div>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Case number in subject]</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Casemail to cc]</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Dochelp to bcc]</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Andrew,</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thank you for your request. The case number 2404240040010190 has been created for this inquiry. One of our team members will follow up with you soon.</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; text-align: left; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Best regards, </div>
<div id="x_x_x_x_x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51); background-color: white;">Mike Bowen</span><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51);"><br>
</span><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(51, 51, 51); background-color: white;">Sr. Escalation Engineer - Microsoft® Corporation</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"> </p>
</div>
<div id="x_x_x_x_x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Andrew Bartlett <abartlet@samba.org><br>
<b>Sent:</b> Tuesday, April 23, 2024 5:52 PM<br>
<b>To:</b> Interoperability Documentation Help <dochelp@microsoft.com><br>
<b>Cc:</b> cifs-protocol mailing list <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [EXTERNAL] Protocol documentation for automatic rollover of expired passwords with UF_SMARTCARD_REQUIRED</span>
<div> </div>
</div>
<div style="direction: ltr; text-align: left;">Kia Ora Dochelp!</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">I'm looking for any documentation as to the finer details of</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left: 2px solid rgb(114, 159, 207);">
<div style="direction: ltr; text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); font-family: Ubuntu; font-size: 14.6667px; color: rgb(0, 0, 0);">
DCs can support automatic rolling of the NTLM and other password-based secrets on a user account configured to require PKI authentication. This configuration is also known as "Smart card required for interactive logon"</div>
</blockquote>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">from</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;"> <a href="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features" id="OWA867fc7c5-33a5-55c6-f999-643bfccbf1c8" class="x_x_x_OWAAutoLink" shash="qzbeJ4F5mZCU3mWsP0RSioUR0qrk2ZIC3iyqsXiSfbaG3hFO0xWb+v54AjurBC5rlx47jv27hOKQPE+biMLgnSAlSXx8q3SpRv7YsXoxe8NL09TFIYRW0nAQ+RKb53LE5KC4PFa6OMnpqBQ+mqrMTvV8fbz2TvdMSY3Xt8t5mv0=" originalsrc="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features" data-auth="Verified" data-loopstyle="linkonly">https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-domain-functional-level-features</a></div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">I don't see any mention of this in MS-ADPS, but am not sure where next to check.</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">In particular, while I have reproduced the rollover for 'must change now', I'm wondering when the password otherwise rolls over, is it before the expiry (eg with the 'old password allowed time' grace of 60mins
for example, or at the expiry?</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Thanks,</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Andrew Bartlett</div>
</blockquote>
</blockquote>
<pre><div style="direction: ltr; text-align: left;">-- </div></pre>
<div style="direction: ltr; text-align: left;">Andrew Bartlett (he/him) <a href="https://samba.org/~abartlet/" id="OWAebf8260e-15bf-b8af-52c8-75853846821c" class="x_OWAAutoLink" shash="tcsYB/Byc7ObzXRiIVsJ/cqfjnhRtSgUsa5/njHz+AfSr/cjcfNP8fOZfApO3v2p15oySCcGn7BzFSt9as8tkhe8RU1OpZ4BJOHvk9PgO6RrtdDPdFA95f0H0ZaC+RJLR/FjmujGk+BOzoZ1/2B/Q2jGO6q2vYrkPsJeACB22No=" originalsrc="https://samba.org/~abartlet/" data-auth="Verified" data-loopstyle="linkonly">
https://samba.org/~abartlet/</a></div>
<div style="direction: ltr; text-align: left;">Samba Team Member (since 2001) <a href="https://samba.org/" id="OWA0973696e-5648-831c-88a9-8fc1b00ebeec" class="x_OWAAutoLink" shash="ewtnhczzjm2Lm90HwxUevEAzr1mJrXYBDa5QXgEnwjMHIh4OgFNOyMLZDZ/pTqLIs+23JZZUA9rcFoJ1PshbOS83QdX6tjePzQsSzfqZEuzPJVDEZkvGDh1Tb1GDPKEM/aMrMNK9XQh9m3pyA9m9wocRBOX6C7Q+ySO3jgCWWcA=" originalsrc="https://samba.org/" data-auth="Verified" data-loopstyle="linkonly">
https://samba.org</a></div>
<div style="direction: ltr; text-align: left;">Samba Team Lead <a href="https://catalyst.net.nz/services/samba" id="OWAbd2c4fca-a96d-f56a-0371-21b30885e30c" class="x_OWAAutoLink" shash="jp02a2fXe6JdLzwFAxYUNhn2UDpgNMdxJNCNHUfmZjyVD+jcPhE826xTGvkrMrt1cYNcUMCz+X9v7bLUMnQxc8dS244j1coT6cI8UNejOSNm5tskwd2v3u2jUZ7IfReTnbaGawKqZykC3wTrBeDajBuBkv1QO20E+fgz/xISKcg=" originalsrc="https://catalyst.net.nz/services/samba" data-auth="Verified" data-loopstyle="linkonly">
https://catalyst.net.nz/services/samba</a></div>
<div style="direction: ltr; text-align: left;">Catalyst.Net Ltd</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group company</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Samba Development and Support: <a href="https://catalyst.net.nz/services/samba" id="OWA3b872658-6079-ada8-70fb-7a4f99d27c9d" class="x_OWAAutoLink" shash="ZlPGIvtLB18it13XDpXCx4nTU/0mI5lN7J5rnHfuCXjlEvx3Bo+grbwz5rpjvaQ9rXBHCq+wGoOJ8M+2P66HZhIdh9kAuSZy53ZmZ0zhRa99NbIV+5HubXUJrW70jWTAbFJWWABckDT/2ko7hRglATSiSCglmWq1ed4vEcYBmJc=" originalsrc="https://catalyst.net.nz/services/samba" data-auth="Verified" data-loopstyle="linkonly">
https://catalyst.net.nz/services/samba</a></div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Catalyst IT - Expert Open Source Solutions</div>
<pre><div style="direction: ltr; text-align: left;">_______________________________________________</div></pre>
<pre><div style="direction: ltr; text-align: left;">cifs-protocol mailing list</div></pre>
<pre><div style="direction: ltr; text-align: left;"><a href="mailto:cifs-protocol@lists.samba.org" id="OWA9f5f84f9-d625-d521-1aca-e6eb264b5326" class="OWAAutoLink" data-loopstyle="linkonly">cifs-protocol@lists.samba.org</a></div></pre>
<pre><div style="direction: ltr; text-align: left;"><br></div></pre>
<pre><div style="direction: ltr; text-align: left;"><a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" id="OWAd17257c3-bfb6-abd2-dda2-e05a802b6cab" class="OWAAutoLink" shash="jtTaUmpoXbKzKMoGeHZHBjqxnZgBIe2eaLjLGuCbMMktXYWPwbajkaL4bCO653SC+wP4AW9lNzlKSu+jIMitYy/x2KUIfURKd9WqUPoL2HsYi0e4L+FSbscZXXGkWq3HiKErWCjOijlLftJ8ozCQw9ebtl1o16wSg17el5Zj+fY=" originalsrc="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="Verified" data-loopstyle="linkonly">https://lists.samba.org/mailman/listinfo/cifs-protocol</a></div></pre>
<pre><div style="direction: ltr; text-align: left;"><br></div></pre>
</blockquote>
<pre><div style="direction: ltr; text-align: left;">-- </div></pre>
<div style="direction: ltr; text-align: left;">Andrew Bartlett (he/him) <a href="https://samba.org/~abartlet/" id="OWA5c47d7a6-3bf4-b023-f9c7-47d3e465b03e" class="OWAAutoLink" shash="cH/CrjZAIQRONibQ0QeJWznnTS4tvqsZI3giMqBqai1IMLz4o0wjzt6fmtg6FU4j4jCoA16hZ2fPzGSBCEjeAPUic4uff3QQDEVqCLbYt5EY7+KpUy2CITYFg7zYemlUGlV2NqePp5HdvGyE9VFblQIOlM2CAx3chwuugWRejJA=" originalsrc="https://samba.org/~abartlet/" data-auth="Verified" data-loopstyle="linkonly">
https://samba.org/~abartlet/</a></div>
<div style="direction: ltr; text-align: left;">Samba Team Member (since 2001) <a href="https://samba.org/" id="OWA2d0ec348-5689-faba-6070-2d5d4bc7e001" class="OWAAutoLink" shash="kM0jelh7W2zE6JOGHf4PqCHxf84ae2r4tudAghI10KvJKqvUnhZPrz8UJSQigaqbYBCt3wsSLtGkHWNB3PhJFJgvFiLvXEa5J3vShPd0zqtcBtZOu0RYkK7A5xollwNGhfATjCbE3G26T4Gds8qIS36K3CQZ96bzdluPDywl3Tw=" originalsrc="https://samba.org/" data-auth="Verified" data-loopstyle="linkonly">
https://samba.org</a></div>
<div style="direction: ltr; text-align: left;">Samba Team Lead <a href="https://catalyst.net.nz/services/samba" id="OWA48d93b64-5255-5688-4408-3d1a5917c99b" class="OWAAutoLink" shash="xfWJDdOqrO4S7zKTQbmfTVNUCwA7/6Ibm+HDEE8ORniCm5L6ZvVBMTuOzgluRHrk8IUIKuIBXJwZVi9S6Ds2wgiBgB4QY/bO2JaMBSDXCbu8BNps+UexPn26L/zr6LqZ8JQTnO6lbHE2NSNWyY2R8VFcjXgIgz4eZWrik/77Ey4=" originalsrc="https://catalyst.net.nz/services/samba" data-auth="Verified" data-loopstyle="linkonly">
https://catalyst.net.nz/services/samba</a></div>
<div style="direction: ltr; text-align: left;">Catalyst.Net Ltd</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group company</div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Samba Development and Support: <a href="https://catalyst.net.nz/services/samba" id="OWA34e73eda-653e-f886-9025-d9f03d7d0a31" class="OWAAutoLink" shash="q5PP2/A6gkHiKpX+OY/NSzQQJ4A1s8IiEEeg/zUpHvzDbq99VjGSOxuKlOJuxrT4EI6jQjrDuu7C6IJE0oddjgghUMMwzajCUSXu4QNJs358HvUirbGbaO0ZrsLsKKUihbjoY/5iYt7Lh/NSRicAl5YQasSRQWRujWfbBhRX5Lw=" originalsrc="https://catalyst.net.nz/services/samba" data-auth="Verified" data-loopstyle="linkonly">
https://catalyst.net.nz/services/samba</a></div>
<div style="direction: ltr; text-align: left;"><br>
</div>
<div style="direction: ltr; text-align: left;">Catalyst IT - Expert Open Source Solutions</div>
</body>
</html>