<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Jo, Have you used the new IDL file from the updated MS-NRPC specification? Please feel free to collect the data and upload it to the workspace shared with you.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Regards,</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Sreekanth Nadendla</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Microsoft Windows Open
Specifications</span></p>
</div>
<div id="appendonsend"></div>
<div id="appendonsend"></div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Jo Sutton <jsutton@samba.org><br>
<b>Sent:</b> Friday, July 19, 2024 12:31 AM<br>
<b>To:</b> Sreekanth Nadendla <srenaden@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Cc:</b> Microsoft Support <supportmail@microsoft.com><br>
<b>Subject:</b> [EXTERNAL] Re: [cifs-protocol] [MS-APDS] NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Hi Sreekanth,<br>
<br>
Thank you for your helpful response! It seems I still haven$B!G(Bt got it <br>
quite right, as Windows responds with RPC_NT_BAD_STUB_DATA when I send <br>
the NetlogonTicketLogonInformation message. May I upload more traces <br>
next week so I can find out where I$B!G(Bve gone wrong?<br>
<br>
Cheers,<br>
Jo (she/her)<br>
<br>
On 19/07/24 6:40 am, Sreekanth Nadendla wrote:<br>
> Hello Jo, please review the latest copy of [MS-NRPC]. It has the <br>
> updated IDL definitions as well. As of now, [MS-APDS] is still being <br>
> updated. The following information should be helpful in the meantime.<br>
> <br>
> MS-APDS Section 3.2.5.1 shows messagetype field should be set to <br>
> 0x00000026. The actual design did not introduce such message type. We <br>
> are using a new logonlevel i.e. NETLOGON_LEVEL of <br>
> NetlogonTicketLogonInformation and a new validationLevel i.e. <br>
> NETLOGON_VALIDATION of NetlogonValidationTicketLogon.<br>
> <br>
> 1.<br>
> From MS-APDS Section 3.2.5.1, we see the<br>
> NETLOGON_TICKET_LOGON_INFO is layered on top of generic pass<br>
> through structure however MS-NRPC section 2.2.1.4.6 defines<br>
> TicketLogon as a new NETLOGON_LEVEL struct which refers<br>
> to NETLOGON_TICKET_LOGON_INFO.<br>
> The NETLOGON_TICKET_LOGON_INFO message does not utilize<br>
> Generic Passthrough as described in MS-APDS 3.2.5.1. Instead, you <br>
> will be using /LogonLevel/ parameter 8<br>
> (_NetlogonTicketLogonInformation<br>
> <<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/8c7808e5-4e5c-420e-9c90-47286da2218f" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fopenspecs%2Fwindows_protocols%2Fms-nrpc%2F8c7808e5-4e5c-420e-9c90-47286da2218f&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359118378%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=%2FtE6Ss0vWtLxTmXsBSe5ohH1goBxxe2Y3V0B0sw6Grk%3D&reserved=0>_</a>)<br>
> 1.<br>
> <br>
> 2.<br>
> Generic Passthrough returns<br>
> NETLOGON_VALIDATION_GENERIC_INFO2. But the new TicketLogon will<br>
> return NETLOGON_VALIDATION_TICKET_LOGON.<br>
> 1.<br>
> As NETLOGON_TICKET_LOGON_INFO message does not actually utilize<br>
> Generic Passthrough, you will use /ValidationLevel/ parameter is<br>
> 7 (_NetLogonValidationTicketLogon<br>
> <<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/95154ae4-d305-43e5-82e4-d5353e0f117c" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fopenspecs%2Fwindows_protocols%2Fms-nrpc%2F95154ae4-d305-43e5-82e4-d5353e0f117c&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359128324%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=HEAC75E4vE%2FFZ1zNL%2FybUhn2cuJWnBwK7kF5eCiJ5fA%3D&reserved=0>_</a>),<br>
> 1.<br>
> <br>
> 2.<br>
> <br>
> You can find a list of applicable Windows OS versions that have this <br>
> security update from the following link (click the $B!H(BMore$B!D!I(B link below <br>
> the title)<br>
> <br>
> 3.<br>
> _https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Ftopic%2Fkb5037754-how-to-manage-pac-validation-changes-related-to-cve-2024-26248-and-cve-2024-29056-6e661d4f-799a-4217-b948-be0a1943fef1&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359131478%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=lGbdEN3ijr6GYYLFlXxh59zHmrZX4EPcCxraajgVBmY%3D&reserved=0
<<a href="https://support.microsoft.com/en-us/topic/kb5037754-how-to-manage-pac-validation-changes-related-to-cve-2024-26248-and-cve-2024-29056-6e661d4f-799a-4217-b948-be0a1943fef1" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Ftopic%2Fkb5037754-how-to-manage-pac-validation-changes-related-to-cve-2024-26248-and-cve-2024-29056-6e661d4f-799a-4217-b948-be0a1943fef1&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359134592%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Xzicp6rrAiWgKaKG78mgejCwXErzG%2BktBsTJBGvPAtQ%3D&reserved=0</a>>_<br>
> <br>
> This list does not include Server 2025, but it also contains this<br>
> update.<br>
> <br>
> <br>
> Please let me know if you have additional questions.<br>
> <br>
> Regards,<br>
> <br>
> Sreekanth Nadendla<br>
> <br>
> Microsoft Windows Open Specifications<br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Jo Sutton <jsutton@samba.org><br>
> *Sent:* Tuesday, July 16, 2024 12:33 AM<br>
> *To:* Sreekanth Nadendla <srenaden@microsoft.com>; <br>
> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
> *Cc:* Microsoft Support <supportmail@microsoft.com><br>
> *Subject:* Re: [cifs-protocol] [EXTERNAL] Re: [MS-APDS] <br>
> NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397<br>
> For completeness$B!G(B sake, I ran the same procedure against a Windows<br>
> Server 2022 host, and got exactly the same STATUS_INVALID_PARAMETER<br>
> error. For MessageType I tried both 0x00000003 and 0x00000026 (and many<br>
> other values, for good measure).<br>
> <br>
> Cheers,<br>
> Jo (she/her)<br>
> <br>
> On 10/07/24 2:08 pm, Jo Sutton via cifs-protocol wrote:<br>
> > Hi Sreekanth,<br>
> ><br>
> > I$B!G(Bm afraid that using 0x03 for the message type still gets me<br>
> > STATUS_INVALID_PARAMETER codes.<br>
> ><br>
> > 0x03 is the message type corresponding to KERB_VERIFY_PAC_REQUEST, which<br>
> > is used for the older method of PAC verification. But the message I$B!G(Bm<br>
> > attempting to send is NETLOGON_TICKET_LOGON_INFO ([MS-APDS] 2.2.2.1),<br>
> > which includes the entire Kerberos ticket and is used in the newer<br>
> > method of PAC verification.<br>
> ><br>
> > What do I need to do to get Windows Server 2019 to accept a<br>
> > NETLOGON_TICKET_LOGON_INFO message? I don$B!G(Bt see any information<br>
> > indicating that Windows Server 2019 doesn$B!G(Bt support such messages.<br>
> ><br>
> > Cheers,<br>
> > Jo (she/her)<br>
> ><br>
> > On 10/07/24 7:12 am, Sreekanth Nadendla wrote:<br>
> >> Hello Jo, can you change the message type from 0x00000026 ( byte<br>
> >> sequence seen as 26 00 00 00 below) to 0x00000003 (to indicate<br>
> >> message type of KerbVerifyPacMessage) and try this again ?<br>
> >><br>
> >> 0:002> db ProtocolSubmitBuffer L0x5e0<br>
> >><br>
> >> 00000218`69819c80 26 00 00 00 00 00 11 00-21 00 31 00 c0 05 00 00<br>
> >> &.......!.1.....<br>
> >> 00000218`69819c90 00 00 02 00 00 00 00 00-00 00 00 00 c0 05 00 00<br>
> >> ................<br>
> >> 00000218`69819ca0 61 82 05 bc 30 82 05 b8-a0 03 02 01 05 a1 0d 1b<br>
> >> a...0...........<br>
> >> .. ..... .. ..... .. .....<br>
> >> .. ..... .. ..... .. .....<br>
> >> .. ..... .. ..... .. .....<br>
> >> 00000218`6981a250 85 1d 35 87 38 7d b1 5b-52 c0 c3 e4 30 c8 77 7d<br>
> >> ..5.8}.[R...0.w}<br>
> >><br>
> >> Regards,<br>
> >><br>
> >> Sreekanth Nadendla<br>
> >><br>
> >> Microsoft Windows Open Specifications<br>
> >><br>
> >><br>
> >> ------------------------------------------------------------------------<br>
> >> *From:* Jo Sutton <jsutton@samba.org><br>
> >> *Sent:* Tuesday, July 2, 2024 6:23 PM<br>
> >> *To:* Sreekanth Nadendla <srenaden@microsoft.com>;<br>
> >> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
> >> *Cc:* Microsoft Support <supportmail@microsoft.com><br>
> >> *Subject:* [EXTERNAL] Re: [cifs-protocol] [MS-APDS]<br>
> >> NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397<br>
> >> Thank you, Sreekanth. I$B!G(Bve uploaded a trace and network capture of a<br>
> >> call to NetrLogonSamLogonEx() attempting to validate a service ticket.<br>
> >><br>
> >> Cheers,<br>
> >> Jo (she/her)<br>
> >><br>
> >> On 3/07/24 2:02 am, Sreekanth Nadendla wrote:<br>
> >> > Hello Jo, you may have gotten an invitation to upload files by now.<br>
> >> > Please check your e-mail folders and let me know otherwise.<br>
> >> ><br>
> >> > Regards,<br>
> >> ><br>
> >> > Sreekanth Nadendla<br>
> >> ><br>
> >> > Microsoft Windows Open Specifications<br>
> >> ><br>
> >> ><br>
> >> ------------------------------------------------------------------------<br>
> >> > *From:* Jo Sutton <jsutton@samba.org><br>
> >> > *Sent:* Monday, July 1, 2024 10:01 PM<br>
> >> > *To:* Sreekanth Nadendla <srenaden@microsoft.com>;<br>
> >> > cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
> >> > *Cc:* Microsoft Support <supportmail@microsoft.com><br>
> >> > *Subject:* [EXTERNAL] Re: [cifs-protocol] [MS-APDS]<br>
> >> > NETLOGON_TICKET_LOGON_INFO message - TrackingID#2405210040011397<br>
> >> > On second thoughts, I$B!G(Bd rather not send traces via unencrypted email.<br>
> >> > Can you provide somewhere for me to upload them?<br>
> >> ><br>
> >> > Cheers,<br>
> >> > Jo (she/her)<br>
> >> ><br>
> >> > On 2/07/24 1:57 pm, Jo Sutton via cifs-protocol wrote:<br>
> >> >> [moving back to cifs-protocol]<br>
> >> >><br>
> >> >> Hi Sreekanth,<br>
> >> >><br>
> >> >> Call me Jo :)<br>
> >> >><br>
> >> >> As I can$B!G(Bt seem to upload the traces via the link you sent me,<br>
> >> I$B!G(Bll try<br>
> >> >> to email them to you directly.<br>
> >> >><br>
> >> >> The reason for asking about NETLOGON_TICKET_LOGON_INFO is that we$B!G(Bre<br>
> >> >> looking to address<br>
> >> <br>
> <a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" data-auth="NotApplicable">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359137640%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=7XY3SGgdQpHefyyQ%2F9Ty2l0sjhU9spfRNiJXzdurNdU%3D&reserved=0</a>
<<a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359140497%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=P7Er2U7F%2FiCKPw%2B6F4JlERaJeZe038mtuGXjjVFmh9s%3D&reserved=0</a>> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359143252%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=hAveIaSvu7oBnJbP6ZaYUJSkaRDT9fPlNxevg7YyXPs%3D&reserved=0
<<a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359146018%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=yk%2BHKoqtQ%2FIj9gDibqKzOJ72O1mCxvMFSl%2BYAAmhv24%3D&reserved=0</a>>> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359148736%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=XJlJJhKHczhzw5c%2BvtFBIaDQCTnNscJXtCA2TPUPC%2Fk%3D&reserved=0
<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359151445%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=WHzdEQPRmyxUB6aQjv9Qj4LPu1uwlW47hjC7SiCCohE%3D&reserved=0
<<a href="https://bugzilla.samba.org/show_bug.cgi?id=15249" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.samba.org%2Fshow_bug.cgi%3Fid%3D15249&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359154173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3GWeALNrJs73UjUgcBMjrRxdME4SoGlf%2FNsDrgjArDo%3D&reserved=0</a>>>>.<br>
> >> >><br>
> >> >> Cheers,<br>
> >> >> Jo (she/her)<br>
> >> >><br>
> >> >> On 14/06/24 3:39 am, Sreekanth Nadendla wrote:<br>
> >> >>> Hello Joseph, I've sent you instructions to download time travel<br>
> >> trace<br>
> >> >>> tool to collect traces for lass process earlier. But we were<br>
> >> informed<br>
> >> >>> by Andrew Bartlet that the reason why you've raised the login issue<br>
> >> >>> with [MS-APDS] NETLOGON_TICKET_LOGON_INFO is that you are <br>
> looking to<br>
> >> >>> resolve a privilege escalation problem via enforcement of PAC<br>
> >> >>> verification. I could not see how these two issues are connected<br>
> >> >>> hence I'm unable to continue the investigation on my own (while you<br>
> >> >>> are away dealing with a personal issue).<br>
> >> >>> Please let us know whenever you are ready and we will gather the<br>
> >> >>> details, data to investigate the issue you are experiencing.<br>
> >> >>><br>
> >> >>> Regards,<br>
> >> >>><br>
> >> >>> Sreekanth Nadendla<br>
> >> >>><br>
> >> >>> Microsoft Windows Open Specifications<br>
> >> >>><br>
> >> >>><br>
> >> >>><br>
> >> >>><br>
> >> >>><br>
> >> >>><br>
> >> >>> From: Jo Sutton <jsutton@samba.org><br>
> >> >>><br>
> >> >>> Sent: Monday, May 20, 2024 9:49 PM<br>
> >> >>> To: cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org>;<br>
> >> >>> Interoperability Documentation Help <dochelp@microsoft.com><br>
> >> >>> Subject: [EXTERNAL] [MS-APDS] NETLOGON_TICKET_LOGON_INFO message<br>
> >> >>> [Some people who received this message don't often get email from<br>
> >> >>> jsutton@samba.org. Learn why this is important at<br>
> >> >>> <a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable">
https://aka.ms/LearnAboutSenderIdentification</a> <br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable">https://aka.ms/LearnAboutSenderIdentification</a>><br>
> >> <https://aka.ms/LearnAboutSenderIdentification <br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable">https://aka.ms/LearnAboutSenderIdentification</a>>><br>
> >> > <https://aka.ms/LearnAboutSenderIdentification<br>
> >> <https://aka.ms/LearnAboutSenderIdentification <br>
> <<a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable">https://aka.ms/LearnAboutSenderIdentification</a>>>> ]<br>
> >> >>><br>
> >> >>> Hi dochelp,<br>
> >> >>><br>
> >> >>> I$B!G(Bm trying to follow [MS-APDS] 2.2.2.1, $B!H(BNETLOGON_TICKET_LOGON_INFO<br>
> >> >>> Message$B!I(B, in order to create a NETLOGON_TICKET_LOGON_INFO message<br>
> >> that<br>
> >> >>> will be accepted by Windows Server 2019. However, in my attempts<br>
> >> so far,<br>
> >> >>> all I$B!G(Bve got is STATUS_INVALID_PARAMETER codes from<br>
> >> NetrLogonSamLogonEx.<br>
> >> >>><br>
> >> >>> Although [MS-APDS] doesn$B!G(Bt mention it, I assume<br>
> >> >>> NETLOGON_TICKET_LOGON_INFO should contain an unsigned 32$B!>(Bbit<br>
> >> MessageType<br>
> >> >>> field, set to 0x00000026, that indicates the message is a<br>
> >> >>> NETLOGON_TICKET_LOGON_INFO message. Other than that, I$B!G(Bm not sure<br>
> >> what<br>
> >> >>> I$B!G(Bm doing wrong. Are the ticket fields arrays, are depicted in the<br>
> >> >>> diagram, or pointers, as claimed in the documentation?<br>
> >> >>><br>
> >> >>> I can provide traces showing the problem if you would like.<br>
> >> >>><br>
> >> >>> Cheers,<br>
> >> >>> Jo (she/her)<br>
> >> >><br>
> >> >><br>
> >> >> _______________________________________________<br>
> >> >> cifs-protocol mailing list<br>
> >> >> cifs-protocol@lists.samba.org<br>
> >> >><br>
> >> <br>
> <a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359156944%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=EhQT6jFY2Y2nkBHHgbv2sgAAUWswrKJYJEsm9%2B%2BboQA%3D&reserved=0</a>
<<a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359159676%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oyfphvgOYrP1048%2BcS7DSkPNMsu%2Fv9JTsMEcaRQax%2FA%3D&reserved=0</a>> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359162377%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ljYl8cnegs5RL6G5o3elasICBHIzibyS%2Buv%2FPlMR4sQ%3D&reserved=0
<<a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359165080%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=ntn5nGpX2Pdtm9giZ0xVnIwtiSmtz4w8W9tAhxpqLe0%3D&reserved=0</a>>> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359167775%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=JO3PzGktUxz5h7W7NGS1FV17CQPLiM38S09ND2yq%2Bw0%3D&reserved=0
<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359170469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=rB0WKynZuip6%2F5qd6EgAmclKRc7YFLzaOuc%2FBYFn65o%3D&reserved=0
<<a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359173145%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=YzKMSnMPfSK27kJKsxxzBtOEJRvd1zbxbJL%2BJWzKpmU%3D&reserved=0</a>>>><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > cifs-protocol mailing list<br>
> > cifs-protocol@lists.samba.org<br>
> > <br>
> <a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359175873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=DWb6euDhkPfO8oFFd0QVF8nwfJ%2BqM%2FAn3iuy3MyqkLM%3D&reserved=0</a>
<<a href="https://lists.samba.org/mailman/listinfo/cifs-protocol" data-auth="NotApplicable">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.samba.org%2Fmailman%2Flistinfo%2Fcifs-protocol&data=05%7C02%7Csrenaden%40microsoft.com%7C2515a7bc13144af3cc4508dca7abc215%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638569603359178593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=slAyU44l1mxExOPPD0fHFxX3%2FMxehVZFC%2F62ee9%2BRAE%3D&reserved=0</a>><br>
</div>
</span></font></div>
</body>
</html>