[cifs-protocol] [MS-APDS] NETLOGON_TICKET_LOGON_INFO message

[Jo Sutton]

Hi dochelp,

I’m trying to follow [MS-APDS] 2.2.2.1, “NETLOGON_TICKET_LOGON_INFO 
Message”, in order to create a NETLOGON_TICKET_LOGON_INFO message that 
will be accepted by Windows Server 2019. However, in my attempts so far, 
all I’ve got is STATUS_INVALID_PARAMETER codes from NetrLogonSamLogonEx.

Although [MS-APDS] doesn’t mention it, I assume 
NETLOGON_TICKET_LOGON_INFO should contain an unsigned 32‐bit MessageType 
field, set to 0x00000026, that indicates the message is a 
NETLOGON_TICKET_LOGON_INFO message. Other than that, I’m not sure what 
I’m doing wrong. Are the ticket fields arrays, are depicted in the 
diagram, or pointers, as claimed in the documentation?

I can provide traces showing the problem if you would like.

Cheers,
Jo (she/her)