[cifs-protocol] [MS-SAMR] SamrSetInformationUser2 over an authenticated DCERPC connection [119040819792364]

[Obaid Farooqi]

Hi Andreas:
The two network traces you sent, both use RPC over SMB i.e. named pipe. I was thinking that systemLibraryDTC one will be using TCP instead of named pipe. 

Regards,
Obaid Farooqi
Escalation Engineer | Microsoft

Exceeding your expectations is my highest priority.  If you would like to provide feedback on your case you may contact my manager at ramagane at Microsoft dot com

-----Original Message-----
From: Andreas Schneider <asn at samba.org> 
Sent: Wednesday, April 10, 2019 4:43 PM
To: Obaid Farooqi <obaidf at microsoft.com>
Cc: cifs-protocol <cifs-protocol at lists.samba.org>; support at mail.support.microsoft.com
Subject: Re: [MS-SAMR] SamrSetInformationUser2 over an authenticated DCERPC connection [119040819792364]

On Wednesday, 10 April 2019 23:06:21 CEST Obaid Farooqi wrote:
> Hi Andreas,
> What is the difference b/w 2008R2 and 2012/2016?

Using the fixed "SystemLibraryDTC" session_key doesn't work on 2008R2, but it works on 2012 and 2012.

> 
> -----Original Message-----
> From: Andreas Schneider <asn at samba.org>
> Sent: Wednesday, April 10, 2019 3:50 PM
> To: Obaid Farooqi <obaidf at microsoft.com>
> Cc: cifs-protocol <cifs-protocol at lists.samba.org>; 
> support at mail.support.microsoft.com Subject: Re: [MS-SAMR]
> SamrSetInformationUser2 over an authenticated DCERPC connection 
> [119040819792364] On Wednesday, 10 April 2019 21:48:42 CEST Obaid 
> Farooqi wrote:
> > Hi Andreas:
> Hello Obaid,
> 
> > I am not aware of this 50 MB limit. I'll investigate what's going on.
> > Only a week ago or so a customer sent me a trace which was 800 MB 
> > and that is the zipped size. The uncompressed size was 3+ GB.
> > 
> > I was able to download and open the trace. I am looking into it and 
> > will be in touch as soon as I have an answer.
> 
> Great. I've also discovered, that Windows 2008R2 behaves differently 
> than Windows Server 2012/2016.
> 
> 
> Cheers,
> 
> 
> 	Andreas