[cifs-protocol] [EXTERNAL] Re: [MS-ADTS] SID as DN alternative for querying groups by member - TrackingID#2209290040008412

Christof Schmitt cs at samba.org
Wed Oct 5 16:24:40 UTC 2022

On Tue, Oct 04, 2022 at 09:38:39PM +0000, Jeff McCashland (He/him) wrote:
> Hi Christof,
> Try these 2 steps instead of the previous step 1: 
> 	1. From an elevated command prompt, run "tasklist /FI "IMAGENAME eq lsass.exe" and note the PID number
> 	2. Run the command (using the PID from step 1): "C:\TTD\TTTracer.exe -attach [PID]"
> Best regards,
> Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team 

Hi Jeff,

that worked, thank you. Please see the zip file uploaded to the
workspace. It shows the three LDAP queries run from the Windows client,
the network packet capture and the lsa trace.

Please let me know if anything else would be required.

Thank you,


More information about the cifs-protocol mailing list