<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:395083214;
mso-list-template-ids:1235369046;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:1.5in;
mso-level-number-position:right;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi Jo,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Please let me know if you have any trouble gathering the Lsass trace. I’m happy to help if you encounter any issues.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Regards,</span></b><o:p></o:p></p>
<p class="MsoNormal" style="margin-top:4.0pt"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Kristian Smith</span></b><o:p></o:p></p>
<p class="MsoNormal" style="margin-top:4.0pt"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Support Escalation Engineer | Microsoft® Corporation</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-top:4.0pt"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Office phone</span></b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">:
+1 425-421-4442</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Email</span></b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">:
</span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:black;background:white"><a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Kristian Smith <Kristian.Smith@microsoft.com>
<br>
<b>Sent:</b> Wednesday, May 22, 2024 10:00 AM<br>
<b>To:</b> Jo Sutton <jsutton@samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com>; cifs-protocol@lists.samba.org<br>
<b>Subject:</b> Re: [EXTERNAL] [MS-ADTS] gMSA previous password - time interval & post rollover - TrackingID#2405210040011844<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Hi Jo,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Thanks for letting me know that you're not able to reproduce this behavior. The best way for me to troubleshoot would be to have an LSASS trace and a network trace. Can you please repro the issue
<b><i>when trying to use a previous password with Kerberos</i></b>?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Here are the tracing instructions for LSASS:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level1 lfo1">
<b><span style="font-size:11.0pt">Tracing Lsass with TTD:</span></b><span style="font-size:11.0pt"> This should be conducted on the DC where we are logging in. Note: Run all commands in an elevated PowerShell prompt on the machine.<o:p></o:p></span></li><ol style="margin-top:0in" start="1" type="a">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level2 lfo1">
<span style="font-size:11.0pt">Download and install TTD on the DC we're logging into.<o:p></o:p></span></li><ol style="margin-top:0in" start="1" type="i">
<li class="MsoNormal" style="color:black;line-height:11.75pt;mso-list:l0 level3 lfo1">
<span style="font-size:11.0pt">Direct link to download TTD app installer: <a href="https://aka.ms/ttd/download">
https://aka.ms/ttd/download</a><o:p></o:p></span></li><li class="MsoNormal" style="color:black;line-height:11.75pt;mso-list:l0 level3 lfo1">
<span style="font-size:11.0pt">Alternatively, use offline install instructions: <a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util#how-to-download-and-install-the-ttdexe-command-line-utility-offline-method">
https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util#how-to-download-and-install-the-ttdexe-command-line-utility-offline-method</a><o:p></o:p></span></li></ol>
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level2 lfo1">
<span style="font-size:11.0pt">When ready to repro the issue, run the following commands to begin the trace.<o:p></o:p></span></li></ol>
</ol>
<ol style="margin-top:0in" start="1" type="1">
<ol style="margin-top:0in" start="2" type="a">
<ol style="margin-top:0in" start="1" type="i">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level3 lfo2">
<span style="font-size:11.0pt">mkdir C:\Traces_$(Get-Date -format "dd-MMM-yyyy")<o:p></o:p></span></li><li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level3 lfo2">
<span style="font-size:11.0pt">TTD.exe -Attach ([int](Get-Process -NAME LSASS | Format-Wide -Property ID).formatEntryInfo.formatPropertyField.propertyValue) -out C:\Traces_$(Get-Date -format "dd-MMM-yyyy")\LSASS_Kerb_Server.run<o:p></o:p></span></li><li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level3 lfo2">
<span style="font-size:11.0pt">When the following small window pops up, the trace has begun and
<b>you can now reproduce the issue</b>. To end the trace, simply click “Tracing Off”.<o:p></o:p></span></li><ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level4 lfo2">
<span style="font-size:11.0pt"><img border="0" width="110" height="101" style="width:1.1458in;height:1.0555in" id="image_0" src="cid:image001.png@01DAB11D.F9D402C0"></span><span style="font-size:11.0pt"><o:p></o:p></span></li></ol>
</ol>
</ol>
</ol>
<ol style="margin-top:0in" start="1" type="1">
<ol style="margin-top:0in" start="3" type="a">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level2 lfo1">
<span style="font-size:11.0pt">Once the trace operation is complete, we need to compress the .run file created by TTD for easy transfer.<o:p></o:p></span></li></ol>
</ol>
<ol style="margin-top:0in" start="1" type="1">
<ol style="margin-top:0in" start="3" type="a">
<ol style="margin-top:0in" start="1" type="i">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level3 lfo3">
<span style="font-size:11.0pt">Compress-Archive -Path C:\Traces_$(Get-Date -format "dd-MMM-yyyy")\ -DestinationPath C:\Traces_$(Get-Date -format "dd-MMM-yyyy").zip<o:p></o:p></span></li></ol>
</ol>
</ol>
<div>
<ol style="margin-top:0in" start="1" type="1">
<ol style="margin-top:0in" start="4" type="a">
<li class="MsoNormal" style="color:black;margin-bottom:8.0pt;line-height:11.75pt;mso-list:l0 level2 lfo1">
<span style="font-size:11.0pt">Upload C:\Traces_dd-MMM-yyyy.zip to the secure file share link below<o:p></o:p></span></li></ol>
</ol>
</div>
<div style="margin-top:7.5pt;margin-bottom:11.25pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.5in;text-indent:-1.5in;mso-text-indent-alt:0in;mso-list:l0 level3 lfo4">
<![if !supportLists]><span style="font-size:11.0pt;color:#1570A6"><span style="mso-list:Ignore"><span style="font:7.0pt "Times New Roman"">
</span>i.</span></span><![endif]><span style="font-size:11.0pt;color:#1570A6"><a href="https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTctMjgwYTIxMGNjZjE3IiwiYXBwaWQiOiI0ZTc2ODkxZC04NDUwLTRlNWUtYmUzOC1lYTNiZDZlZjIxZTUiLCJpc3MiOiJodHRwczovL2FwaS5kdG1uZWJ1bGEubWljcm9zb2Z0LmNvbSIsImF1ZCI6Imh0dHA6Ly9zbWMiLCJleHAiOjE3MjQxNjkwNDgsIm5iZiI6MTcxNjM5MzA0OH0.ci6jGrcT9SKnyRccEfDUuEOJv7LMBa_6tgF_xkAFq1fJrpI6nSjVGprJiduohlKKoRLe9W0juQNlEf5LaMOgYSDOLKXuxF5EzY5S1DmSVvWQ6bBrPYniK6EApehMHNA6xJ_YjM9i20YuRqfY_r6NPU6BEPWaXb2LQCzcEv-PhzU0AqEerW3SutZgrU3O7XkvUxbOUW1R_jfo2IAETBFnDLdHOQzpmbj7Ty_cI9WBvyeTzQmp0slUofLBpzLXZb6qSwYk3_FgYLNU0muDt3yz8hib2RLoDWqIdkrJIVmkwF6b2v226QMoU2Ge0dxEShT7sClptzVUV0QoTK0aYCxczQ&wid=6ad02fe8-3357-427d-9925-d8f6f81ec400" title="https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTct">https://support.microsoft.com/files?workspace=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ3c2lkIjoiNmFkMDJmZTgtMzM1Ny00MjdkLTk5MjUtZDhmNmY4MWVjNDAwIiwic3IiOiIyNDA1MjEwMDQwMDExODQ0Iiwic3YiOiJ2MSIsInJzIjoiRXh0ZXJuYWwiLCJ3dGlkIjoiNzI1Nzc1NDMtZTBhNy00OWM5LWE5OTctMjgwYTIxMGNjZjE3IiwiYXBwaWQiOiI0ZTc2ODkxZC04NDUwLTRlNWUtYmUzOC1lYTNiZDZlZjIxZTUiLCJpc3MiOiJodHRwczovL2FwaS5kdG1uZWJ1bGEubWljcm9zb2Z0LmNvbSIsImF1ZCI6Imh0dHA6Ly9zbWMiLCJleHAiOjE3MjQxNjkwNDgsIm5iZiI6MTcxNjM5MzA0OH0.ci6jGrcT9SKnyRccEfDUuEOJv7LMBa_6tgF_xkAFq1fJrpI6nSjVGprJiduohlKKoRLe9W0juQNlEf5LaMOgYSDOLKXuxF5EzY5S1DmSVvWQ6bBrPYniK6EApehMHNA6xJ_YjM9i20YuRqfY_r6NPU6BEPWaXb2LQCzcEv-PhzU0AqEerW3SutZgrU3O7XkvUxbOUW1R_jfo2IAETBFnDLdHOQzpmbj7Ty_cI9WBvyeTzQmp0slUofLBpzLXZb6qSwYk3_FgYLNU0muDt3yz8hib2RLoDWqIdkrJIVmkwF6b2v226QMoU2Ge0dxEShT7sClptzVUV0QoTK0aYCxczQ&wid=6ad02fe8-3357-427d-9925-d8f6f81ec400</a><o:p></o:p></span></p>
</div>
<div style="margin-bottom:8.0pt">
<p class="MsoNormal" style="line-height:11.75pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div style="margin-bottom:8.0pt">
<p class="MsoNormal" style="line-height:11.75pt"><span style="font-size:11.0pt;color:black">If you are able to include a network/WireShark trace with a keytab file to decrypt, that would be helpful, but may not be entirely necessary. I will be in training for
the remainder of the week but will debug the trace next week. Thanks for your patience.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<p><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Regards,</span></b><o:p></o:p></p>
<p style="margin-top:4.0pt"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Kristian Smith</span></b><o:p></o:p></p>
<p style="margin-top:4.0pt"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Support Escalation Engineer | Microsoft® Corporation</span><o:p></o:p></p>
<p style="margin-top:4.0pt"><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Office phone</span></b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">: +1 425-421-4442</span><o:p></o:p></p>
<p><b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">Email</span></b><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#2F2F2F;background:white">:
</span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:black;background:white"><a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a></span><o:p></o:p></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> Jo Sutton <<a href="mailto:jsutton@samba.org">jsutton@samba.org</a>><br>
<b>Sent:</b> Monday, May 20, 2024 9:19 PM<br>
<b>To:</b> Kristian Smith <<a href="mailto:Kristian.Smith@microsoft.com">Kristian.Smith@microsoft.com</a>><br>
<b>Cc:</b> Microsoft Support <<a href="mailto:supportmail@microsoft.com">supportmail@microsoft.com</a>>;
<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a> <<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a>><br>
<b>Subject:</b> Re: [EXTERNAL] [MS-ADTS] A Group Managed Service Account authenticating with a previous password - TrackingID#2405140040001588</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">Thank you, Kristian.<br>
<br>
I’ve had some difficulty trying to replicate these results. After <br>
manually changing the password of a Group Managed Service Account, there <br>
is a five minute interval during which I can use the previous password <br>
to log in via NTLM. However, I have not managed to get a previous <br>
password to work — with NTLM or with Kerberos — following the natural <br>
rollover of a gMSA’s password.<br>
<br>
Cheers,<br>
Jo (she/her)<br>
<br>
On 17/05/24 11:51 am, Kristian Smith wrote:<br>
> Hi Jo,<br>
> <br>
> I conducted research on these questions you posed and wanted to share my <br>
> findings with you.<br>
> <br>
> In the context of gMSA authentication, we accept only the current and <br>
> most recent previous password for both NTLM and Kerberos. Also, I was <br>
> unable to locate any time limitations for the use of the previous password.<br>
> <br>
> Let me know if this answers your questions or if there is further <br>
> clarification I can provide.<br>
> <br>
> *Regards,*<br>
> <br>
> *Kristian Smith*<br>
> <br>
> Support Escalation Engineer | Microsoft® Corporation<br>
> <br>
> *Office phone*: +1 425-421-4442<br>
> <br>
> *Email*: <a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a> <<a href="mailto:kristian.smith@microsoft.com">mailto:kristian.smith@microsoft.com</a>><br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Kristian Smith <<a href="mailto:Kristian.Smith@microsoft.com">Kristian.Smith@microsoft.com</a>><br>
> *Sent:* Tuesday, May 14, 2024 8:39 AM<br>
> *To:* Jo Sutton <<a href="mailto:jsutton@samba.org">jsutton@samba.org</a>><br>
> *Cc:* Microsoft Support <<a href="mailto:supportmail@microsoft.com">supportmail@microsoft.com</a>>;
<br>
> <a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a> <<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a>><br>
> *Subject:* Re: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password - TrackingID#2405140040001588<br>
> [Tom to Bcc]<br>
> <br>
> Hi Jo,<br>
> <br>
> Thanks for reaching out with your [MS-ADTS] question. I'll be your point <br>
> of contact moving forward for this case. I will research this and get <br>
> back to you with my findings.<br>
> <br>
> *Regards,*<br>
> <br>
> *Kristian Smith*<br>
> <br>
> Support Escalation Engineer | Microsoft® Corporation<br>
> <br>
> *Office phone*: +1 425-421-4442<br>
> <br>
> *Email*: <a href="mailto:kristian.smith@microsoft.com">kristian.smith@microsoft.com</a> <<a href="mailto:kristian.smith@microsoft.com">mailto:kristian.smith@microsoft.com</a>><br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Tom Jebo <<a href="mailto:tomjebo@microsoft.com">tomjebo@microsoft.com</a>><br>
> *Sent:* Monday, May 13, 2024 10:32 PM<br>
> *To:* Jo Sutton <<a href="mailto:jsutton@samba.org">jsutton@samba.org</a>>; <a href="mailto:cifs-protocol@lists.samba.org">
cifs-protocol@lists.samba.org</a> <br>
> <<a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a>><br>
> *Cc:* Microsoft Support <<a href="mailto:supportmail@microsoft.com">supportmail@microsoft.com</a>><br>
> *Subject:* RE: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password - TrackingID#2405140040001588<br>
> [dochelp to bcc]<br>
> [support mail to cc]<br>
> <br>
> Hey Jo,<br>
> <br>
> Thanks for your request regarding MS-ADTS. One of the Open <br>
> Specifications team members will respond to assist you. In the meantime, <br>
> we’ve created case 2405140040001588 to track this request. Please leave <br>
> the case number in the subject when communicating with our team about <br>
> this request.<br>
> <br>
> Best regards,<br>
> Tom Jebo<br>
> Microsoft Open Specifications Support<br>
> <br>
> -----Original Message-----<br>
> From: Jo Sutton <<a href="mailto:jsutton@samba.org">jsutton@samba.org</a>><br>
> Sent: Monday, May 13, 2024 9:59 PM<br>
> To: <a href="mailto:cifs-protocol@lists.samba.org">cifs-protocol@lists.samba.org</a>; Interoperability Documentation Help
<br>
> <<a href="mailto:dochelp@microsoft.com">dochelp@microsoft.com</a>><br>
> Subject: [EXTERNAL] [MS-ADTS] A Group Managed Service Account <br>
> authenticating with a previous password<br>
> <br>
> [Some people who received this message don't often get email from <br>
> <a href="mailto:jsutton@samba.org">jsutton@samba.org</a>. Learn why this is important at
<br>
> <a href="https://aka.ms/LearnAboutSenderIdentification">https://aka.ms/LearnAboutSenderIdentification</a>
<br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification%3e ">https://aka.ms/LearnAboutSenderIdentification> </a>]<br>
> <br>
> Hi dochelp,<br>
> <br>
> I can’t find any mention in Microsoft’s documentation of what should <br>
> happen when a Group Managed Service Account authenticates with a <br>
> previous password — i.e. via NTLM with an NT hash from ntPwdHistory, or <br>
> via Kerberos with a key from the OldCredentials part of a <br>
> Primary:Kerberos-Newer-Keys blob.<br>
> <br>
> Should the previous password be accepted for NTLM logons? For Kerberos <br>
> logons? Should only the immediately previous password be accepted, or <br>
> should earlier passwords be accepted too? And during what period should <br>
> the previous password(s) be accepted — for example, the five minutes <br>
> immediately following the time specified by pwdLastSet?<br>
> <br>
> Any information you can provide to shine light on these questions would <br>
> be welcome.<br>
> <br>
> Cheers,<br>
> Jo (she/her)<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>