[cifs-protocol] Status: Please clarify LSA and OsVersion behaviour in MS-NRPC (SRX090713600128)

[Bill Wesse]

Andrew - thanks for focusing me - I assume you are referring to the quoted text below:

OsVersion: ... "The DC that receives this data structure updates the operatingSystemVersion attribute of the client's machine account object in Active Directory with this value, unchanged and uninterpreted, as specified in [MS-ADTS]."

I find that OSVERSIONINFOEX is equivalent to NL_OSVERSIONINFO_V1, which is documented as shown below - and contains the information you are seeking.

I have already advised the bug/TDI owner concerning this.

==============================================================================
[MS-NRPC]: Netlogon Remote Protocol Specification
2.2.1.3.14 NL_IN_CHAIN_SET_CLIENT_ATTRIBUTES_V1
http://msdn.microsoft.com/en-us/library/dd240432.aspx

OsVersionInfo: If not NULL, the attribute operatingSystemVersion on the client's computer account in Active Directory (using the ABNF Syntax as specified in [RFC2234]) is set to:

If OsVersionInfo.dwBuildNumber is 0:

   operatingSystemVersion = MajorVersion "." MinorVersion
   MajorVersion = OsVersionInfo.dwMajorVersion
   MinorVersion = OsVersionInfo.dwMinorVersion

Otherwise:

   operatingSystemVersion = MajorVersion "." MinorVersion "."
                            BuildNumber
   MajorVersion = OsVersionInfo.dwMajorVersion
   MinorVersion = OsVersionInfo.dwMinorVersion
   BuildNumber = OsVersionInfo.dwBuildNumber

OsName: NULL or a null-terminated Unicode string that is used to update the attribute operatingSystem on the client's computer account object in Active Directory. <37>

<37> Section 2.2.1.3.16: Added in Windows Server 2008.

==============================================================================
[MS-NRPC]: Netlogon Remote Protocol Specification
2.2.1.3.15 NL_OSVERSIONINFO_V1
http://msdn.microsoft.com/en-us/library/dd240431.aspx
typedef struct _NL_OSVERSIONINFO_V1 {
  DWORD dwOSVersionInfoSize;
  DWORD dwMajorVersion;
  DWORD dwMinorVersion;
  DWORD dwBuildNumber;
  DWORD dwPlatformId;
  wchar_t szCSDVersion[128];
  unsigned short wServicePackMajor;
  unsigned short wServicePackMinor;
  unsigned short wSuiteMask;
  unsigned char wProductType;
  unsigned char wReserved;
} NL_OSVERSIONINFO_V1;

==============================================================================
Example:
==============================================================================
[MS-DRSR]: Directory Replication Service (DRS) Remote Protocol Specification
4.1.5.3.1 Initial State
http://msdn.microsoft.com/en-us/library/cc228355.aspx

1> operatingSystem: Windows Server 2003;
1> operatingSystemVersion: 5.2 (3790);
1> operatingSystemServicePack: Service Pack 1;

Regards,
Bill Wesse
MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  +1(980) 776-8200
CELL: +1(704) 661-5438
FAX:  +1(704) 665-9606


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org] 
Sent: Tuesday, August 25, 2009 9:18 PM
To: Bill Wesse
Cc: pfif at tridgell.net; cifs-protocol at samba.org; Matthias Dieter Wallnöfer
Subject: RE: Status: Please clarify LSA and OsVersion behaviour in MS-NRPC (SRX090713600128)

On Tue, 2009-08-25 at 07:17 -0700, Bill Wesse wrote:
> Thanks again for your input; my response interpolated below...
> 
> >> Good morning Andrew - I have attached a pdf showing the changes that will be in the next update to [MS-NRPC] concerning section 2.2.1.3.6 NETLOGON_WORKSTATION_INFO OsVersion field description.
> >> 
> >> These changes will reference [MS-RPRN], which has a full definition for the OSVERSIONINFOEX structure; I have provided a link for this:
> >> 
> >> [MS-RPRN]: Print System Remote Protocol Specification
> >> 2.2.3.10.2 OSVERSIONINFOEX
> >> http://msdn.microsoft.com/en-us/library/cc669279.aspx
> >> 
> >> Please let me know if this answers your question satisfactorily; if so, I will consider the case resolved. Thanks for helping us improve our documentation!
> 
> >While the proposed changes remove the outright incorrect information, I don't see how they help us populate the >operatingSystemVersion attribute.  The references to the update, and the rules by which it is processed need to be >corrected rather than just removed. 
> 
> I'm not sure I understand what is not specified in '[MS-RPRN] 2.2.3.10.2 OSVERSIONINFOEX'. After running down the links in that topic, I see they contain essentially the same information as the MSDN 'OSVERSIONINFOEX Structure' (link shown below, not included in the doc, since we cannot cite MSDN content as normative).
> 
> OSVERSIONINFOEX Structure
> http://msdn.microsoft.com/en-us/library/ms724833.aspx
> 
> Could you elaborate on what sort of processing you are referring to (beyond the implicit matching between the OsName text and OsVersion structured data)?

No, it is the removal of the explanation of how the OS version specified here is translated into the operatingSystemVersion attribute, and how/when that is done that seems to have been removed. 

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Cisco Inc.