<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Jo,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Thanks for letting me know that you're not able to reproduce this behavior. The best way for me to troubleshoot would be to have an LSASS trace and a network trace. Can you please repro the issue
<b><i>when trying to use a previous password with Kerberos</i></b>?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Here are the tracing instructions for LSASS:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<ol start="1" data-editing-info="{"orderedStyleType":1}" data-listchain="__List_Chain_101" style="text-align: left; margin-top: 0in; margin-right: 0in; list-style-type: decimal;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>Tracing Lsass with TTD:</b> This should be conducted on the DC where we are logging in. Note: Run all commands
in an elevated PowerShell prompt on the machine.</span></li><ol start="1" style="list-style-type: lower-alpha;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">Download and install TTD on the DC we're logging into.</span></li><ol start="1" style="list-style-type: lower-roman;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">Direct link to download TTD app installer:
<a href="https://aka.ms/ttd/download" id="OWA08016bf9-953a-c9cb-e703-d8746f371a70" class="x_OWAAutoLink" data-auth="NotApplicable" data-linkindex="0" data-ogsc="" data-loopstyle="linkonly" style="margin: 0px;">
https://aka.ms/ttd/download</a></span></li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">Alternatively, use offline install instructions:
<a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util#how-to-download-and-install-the-ttdexe-command-line-utility-offline-method" id="OWA71af294d-e705-f253-98dd-9dc3984ef20e" class="x_OWAAutoLink" data-auth="NotApplicable" data-linkindex="1" data-ogsc="" data-loopstyle="linkonly" style="margin: 0px;">
https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util#how-to-download-and-install-the-ttdexe-command-line-utility-offline-method</a></span></li></ol>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">When ready to repro the issue, run the following commands to begin the trace.</span></li><ol start="1" style="list-style-type: lower-roman;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">mkdir C:\Traces_$(Get-Date -format "dd-MMM-yyyy")</span></li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">TTD.exe -Attach ([int](Get-Process -NAME LSASS | Format-Wide -Property ID).formatEntryInfo.formatPropertyField.propertyValue)
-out C:\Traces_$(Get-Date -format "dd-MMM-yyyy")\LSASS_Kerb_Server.run</span></li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">When the following small window pops up, the trace has begun and
<b>you can now reproduce the issue</b>. To end the trace, simply click “Tracing Off”.</span></li><ol start="1" style="list-style-type: decimal;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><img id="image_0" width="110" height="101" size="19860" contenttype="image/png" style="width: 110px; height: 101px;" data-outlook-trace="F:2|T:2" src="cid:f1c3ebfc-3b7f-4550-8079-0eb79e6fc2bd"><br>
</span></li></ol>
</ol>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">Once the trace operation is complete, we need to compress the .run file created by TTD for easy transfer.</span></li><ol start="1" style="list-style-type: lower-roman;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">Compress-Archive -Path C:\Traces_$(Get-Date -format "dd-MMM-yyyy")\ -DestinationPath C:\Traces_$(Get-Date -format
"dd-MMM-yyyy").zip</span></li></ol>
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); line-height: 15.6933px; margin: 0in 0in 8pt;">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Upload C:\Traces_dd-MMM-yyyy.zip to the secure file share link below</div>
</li><ol start="1" data-editing-info="{"applyListStyleFromLevel":true}" style="list-style-type: lower-roman;">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<div class="elementToProof" style="text-align: left; text-indent: 0px; line-height: 1.1; margin-top: 10px; margin-bottom: 15px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(21, 112, 166);">
<span style="font-weight: 500;"><a href="https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTctMjgwYTIxMGNjZjE3IiwiYXBwaWQiOiI0ZTc2ODkxZC04NDUwLTRlNWUtYmUzOC1lYTNiZDZlZjIxZTUiLCJpc3MiOiJodHRwczovL2FwaS5kdG1uZWJ1bGEubWljcm9zb2Z0LmNvbSIsImF1ZCI6Imh0dHA6Ly9zbWMiLCJleHAiOjE3MjQxNjkwNDgsIm5iZiI6MTcxNjM5MzA0OH0.ci6jGrcT9SKnyRccEfDUuEOJv7LMBa_6tgF_xkAFq1fJrpI6nSjVGprJiduohlKKoRLe9W0juQNlEf5LaMOgYSDOLKXuxF5EzY5S1DmSVvWQ6bBrPYniK6EApehMHNA6xJ_YjM9i20YuRqfY_r6NPU6BEPWaXb2LQCzcEv-PhzU0AqEerW3SutZgrU3O7XkvUxbOUW1R_jfo2IAETBFnDLdHOQzpmbj7Ty_cI9WBvyeTzQmp0slUofLBpzLXZb6qSwYk3_FgYLNU0muDt3yz8hib2RLoDWqIdkrJIVmkwF6b2v226QMoU2Ge0dxEShT7sClptzVUV0QoTK0aYCxczQ&wid=6ad02fe8-3357-427d-9925-d8f6f81ec400" id="LPlnk308841" class="OWAAutoLink" title="https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTctMjgwYTIxMGNjZjE3IiwiYXBwaWQiOiI0ZTc2ODkxZC04NDUwLTRlNWUtYmUzOC1lYTNiZDZlZjIxZTUiLCJpc3MiOiJodHRwczovL2FwaS5kdG1uZWJ1bGEubWljcm9zb2Z0LmNvbSIsImF1ZCI6Imh0dHA6Ly9zbWMiLCJleHAiOjE3MjQxNjkwNDgsIm5iZiI6MTcxNjM5MzA0OH0.ci6jGrcT9SKnyRccEfDUuEOJv7LMBa_6tgF_xkAFq1fJrpI6nSjVGprJiduohlKKoRLe9W0juQNlEf5LaMOgYSDOLKXuxF5EzY5S1DmSVvWQ6bBrPYniK6EApehMHNA6xJ_YjM9i20YuRqfY_r6NPU6BEPWaXb2LQCzcEv-PhzU0AqEerW3SutZgrU3O7XkvUxbOUW1R_jfo2IAETBFnDLdHOQzpmbj7Ty_cI9WBvyeTzQmp0slUofLBpzLXZb6qSwYk3_FgYLNU0muDt3yz8hib2RLoDWqIdkrJIVmkwF6b2v226QMoU2Ge0dxEShT7sClptzVUV0QoTK0aYCxczQ&wid=6ad02fe8-3357-427d-9925-d8f6f81ec400">https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTctMjgwYTIxMGNjZjE3IiwiYXBwaWQiOiI0ZTc2ODkxZC04NDUwLTRlNWUtYmUzOC1lYTNiZDZlZjIxZTUiLCJpc3MiOiJodHRwczovL2FwaS5kdG1uZWJ1bGEubWljcm9zb2Z0LmNvbSIsImF1ZCI6Imh0dHA6Ly9zbWMiLCJleHAiOjE3MjQxNjkwNDgsIm5iZiI6MTcxNjM5MzA0OH0.ci6jGrcT9SKnyRccEfDUuEOJv7LMBa_6tgF_xkAFq1fJrpI6nSjVGprJiduohlKKoRLe9W0juQNlEf5LaMOgYSDOLKXuxF5EzY5S1DmSVvWQ6bBrPYniK6EApehMHNA6xJ_YjM9i20YuRqfY_r6NPU6BEPWaXb2LQCzcEv-PhzU0AqEerW3SutZgrU3O7XkvUxbOUW1R_jfo2IAETBFnDLdHOQzpmbj7Ty_cI9WBvyeTzQmp0slUofLBpzLXZb6qSwYk3_FgYLNU0muDt3yz8hib2RLoDWqIdkrJIVmkwF6b2v226QMoU2Ge0dxEShT7sClptzVUV0QoTK0aYCxczQ&wid=6ad02fe8-3357-427d-9925-d8f6f81ec400</a></span></div>
</li></ol>
</ol>
</ol>
<div class="elementToProof" style="line-height: 15.6933px; margin: 0in 0in 8pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="line-height: 15.6933px; margin: 0in 0in 8pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
If you are able to include a network/WireShark trace with a keytab file to decrypt, that would be helpful, but may not be entirely necessary. I will be in training for the remainder of the week but will debug the trace next week. Thanks for your patience.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature" style="color: inherit; background-color: inherit;">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Regards,</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Kristian Smith</b></span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;">Support Escalation Engineer | Microsoft® Corporation</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Office phone</b>: +1 425-421-4442</span></p>
<p style="text-align: left; margin-top: 4pt; margin-bottom: 0pt;"><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(47, 47, 47); background-color: white;"><b>Email</b>:
</span><span style="font-family: "Segoe UI"; font-size: 9pt; color: rgb(0, 0, 0); background-color: white;"><a href="mailto:kristian.smith@microsoft.com" id="OWA3c2023e6-4e73-0372-97be-98926cb721f4" class="OWAAutoLink" data-loopstyle="linkonly" style="margin: 0px;">kristian.smith@microsoft.com</a></span></p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Jo Sutton <jsutton@samba.org><br>
<b>Sent:</b> Monday, May 20, 2024 9:19 PM<br>
<b>To:</b> Kristian Smith <Kristian.Smith@microsoft.com><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> Re: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password - TrackingID#2405140040001588</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Thank you, Kristian.<br>
<br>
I’ve had some difficulty trying to replicate these results. After <br>
manually changing the password of a Group Managed Service Account, there <br>
is a five minute interval during which I can use the previous password <br>
to log in via NTLM. However, I have not managed to get a previous <br>
password to work — with NTLM or with Kerberos — following the natural <br>
rollover of a gMSA’s password.<br>
<br>
Cheers,<br>
Jo (she/her)<br>
<br>
On 17/05/24 11:51 am, Kristian Smith wrote:<br>
> Hi Jo,<br>
> <br>
> I conducted research on these questions you posed and wanted to share my <br>
> findings with you.<br>
> <br>
> In the context of gMSA authentication, we accept only the current and <br>
> most recent previous password for both NTLM and Kerberos. Also, I was <br>
> unable to locate any time limitations for the use of the previous password.<br>
> <br>
> Let me know if this answers your questions or if there is further <br>
> clarification I can provide.<br>
> <br>
> *Regards,*<br>
> <br>
> *Kristian Smith*<br>
> <br>
> Support Escalation Engineer | Microsoft® Corporation<br>
> <br>
> *Office phone*: +1 425-421-4442<br>
> <br>
> *Email*: kristian.smith@microsoft.com <<a href="mailto:kristian.smith@microsoft.com">mailto:kristian.smith@microsoft.com</a>><br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Kristian Smith <Kristian.Smith@microsoft.com><br>
> *Sent:* Tuesday, May 14, 2024 8:39 AM<br>
> *To:* Jo Sutton <jsutton@samba.org><br>
> *Cc:* Microsoft Support <supportmail@microsoft.com>; <br>
> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
> *Subject:* Re: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password - TrackingID#2405140040001588<br>
> [Tom to Bcc]<br>
> <br>
> Hi Jo,<br>
> <br>
> Thanks for reaching out with your [MS-ADTS] question. I'll be your point <br>
> of contact moving forward for this case. I will research this and get <br>
> back to you with my findings.<br>
> <br>
> *Regards,*<br>
> <br>
> *Kristian Smith*<br>
> <br>
> Support Escalation Engineer | Microsoft® Corporation<br>
> <br>
> *Office phone*: +1 425-421-4442<br>
> <br>
> *Email*: kristian.smith@microsoft.com <<a href="mailto:kristian.smith@microsoft.com">mailto:kristian.smith@microsoft.com</a>><br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Tom Jebo <tomjebo@microsoft.com><br>
> *Sent:* Monday, May 13, 2024 10:32 PM<br>
> *To:* Jo Sutton <jsutton@samba.org>; cifs-protocol@lists.samba.org <br>
> <cifs-protocol@lists.samba.org><br>
> *Cc:* Microsoft Support <supportmail@microsoft.com><br>
> *Subject:* RE: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password - TrackingID#2405140040001588<br>
> [dochelp to bcc]<br>
> [support mail to cc]<br>
> <br>
> Hey Jo,<br>
> <br>
> Thanks for your request regarding MS-ADTS. One of the Open <br>
> Specifications team members will respond to assist you. In the meantime, <br>
> we’ve created case 2405140040001588 to track this request. Please leave <br>
> the case number in the subject when communicating with our team about <br>
> this request.<br>
> <br>
> Best regards,<br>
> Tom Jebo<br>
> Microsoft Open Specifications Support<br>
> <br>
> -----Original Message-----<br>
> From: Jo Sutton <jsutton@samba.org><br>
> Sent: Monday, May 13, 2024 9:59 PM<br>
> To: cifs-protocol@lists.samba.org; Interoperability Documentation Help <br>
> <dochelp@microsoft.com><br>
> Subject: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password<br>
> <br>
> [Some people who received this message don't often get email from <br>
> jsutton@samba.org. Learn why this is important at <br>
> <a href="https://aka.ms/LearnAboutSenderIdentification">https://aka.ms/LearnAboutSenderIdentification</a>
<br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification> ">https://aka.ms/LearnAboutSenderIdentification> </a>]<br>
> <br>
> Hi dochelp,<br>
> <br>
> I can’t find any mention in Microsoft’s documentation of what should <br>
> happen when a Group Managed Service Account authenticates with a <br>
> previous password — i.e. via NTLM with an NT hash from ntPwdHistory, or <br>
> via Kerberos with a key from the OldCredentials part of a <br>
> Primary:Kerberos-Newer-Keys blob.<br>
> <br>
> Should the previous password be accepted for NTLM logons? For Kerberos <br>
> logons? Should only the immediately previous password be accepted, or <br>
> should earlier passwords be accepted too? And during what period should <br>
> the previous password(s) be accepted — for example, the five minutes <br>
> immediately following the time specified by pwdLastSet?<br>
> <br>
> Any information you can provide to shine light on these questions would <br>
> be welcome.<br>
> <br>
> Cheers,<br>
> Jo (she/her)<br>
<br>
</div>
</span></font></div>
</body>
</html>