<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Jo,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I conducted research on these questions you posed and wanted to share my findings with you. </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
In the context of gMSA authentication, we accept only the current and most recent previous password for both NTLM and Kerberos. Also, I was unable to locate any time limitations for the use of the previous password.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Let me know if this answers your questions or if there is further clarification I can provide.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA17dfa6db-5621-18a4-5a20-30221aa17e25" class="OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="appendonsend" style="color: inherit; background-color: inherit;"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Sent:</b> Tuesday, May 14, 2024 8:39 AM<br>
<b>To:</b> Jo Sutton <jsutton@samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> Re: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password - TrackingID#2405140040001588</span>
<div> </div>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[Tom to Bcc]</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Jo,</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks for reaching out with your [MS-ADTS] question. I'll be your point of contact moving forward for this case. I will research this and get back to you with my findings.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA5e46a6d8-25d2-d3c3-d87c-ad7b9d0c77b7" class="x_OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="x_appendonsend" style="color: inherit; background-color: inherit;"></div>
<hr style="direction: ltr; display: inline-block; width: 98%;">
<div id="x_divRplyFwdMsg" dir="ltr" style="color: inherit; background-color: inherit;">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Tom Jebo <tomjebo@microsoft.com><br>
<b>Sent:</b> Monday, May 13, 2024 10:32 PM<br>
<b>To:</b> Jo Sutton <jsutton@samba.org>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> RE: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password - TrackingID#2405140040001588</span>
<div> </div>
</div>
<div style="direction: ltr; font-size: 11pt;">[dochelp to bcc]<br>
[support mail to cc]<br>
<br>
Hey Jo,<br>
<br>
Thanks for your request regarding MS-ADTS. One of the Open Specifications team members will respond to assist you. In the meantime, we’ve created case 2405140040001588 to track this request. Please leave the case number in the subject when communicating with
our team about this request.<br>
<br>
Best regards,<br>
Tom Jebo<br>
Microsoft Open Specifications Support<br>
<br>
-----Original Message-----<br>
From: Jo Sutton <jsutton@samba.org><br>
Sent: Monday, May 13, 2024 9:59 PM<br>
To: cifs-protocol@lists.samba.org; Interoperability Documentation Help <dochelp@microsoft.com><br>
Subject: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password<br>
<br>
[Some people who received this message don't often get email from jsutton@samba.org. Learn why this is important at
<a href="https://aka.ms/LearnAboutSenderIdentification" id="OWAc4fb5010-404c-7304-11c7-98ed52ac38ba" class="OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly">
https://aka.ms/LearnAboutSenderIdentification</a> ]<br>
<br>
Hi dochelp,<br>
<br>
I can’t find any mention in Microsoft’s documentation of what should happen when a Group Managed Service Account authenticates with a previous password — i.e. via NTLM with an NT hash from ntPwdHistory, or via Kerberos with a key from the OldCredentials part
of a Primary:Kerberos-Newer-Keys blob.<br>
<br>
Should the previous password be accepted for NTLM logons? For Kerberos logons? Should only the immediately previous password be accepted, or should earlier passwords be accepted too? And during what period should the previous password(s) be accepted — for example,
the five minutes immediately following the time specified by pwdLastSet?<br>
<br>
Any information you can provide to shine light on these questions would be welcome.<br>
<br>
Cheers,<br>
Jo (she/her)</div>
</body>
</html>