RootDSE netlogon attribute NtVer values?

[Michael B Allen]

Hi,

Hope you don't mind a protocol question but ...

Regarding the cldap query for the netlogon attribute of the RootDSE,
I'm trying to find a value for the NtVer filter parameter that works
with both Windows 2003 and Windows 2000. I've been using \06\00\00\02
like:

(&(DnsDomain=W.NET)(NtVer=\06\00\00\02))

simply because that is what I observed from XP but apparently Windows
2000 SP4 doesn't return a match for this at all. Or perhaps the
problem is that I used regular ldap and not cldap?

Inlined below are the four distinct structures that I've been able to
get out of this attribute with Windows 2003 Server. It seems they
correspond to bits 0x01000000, 0x02000000, 0x04000000 and 0x08000000
(although I suppose those are unlimately interpreted as low bits). It
doesn't seem like any other bits have any impact on the results.

Does anyone have anymore info on this topic?

Mike

$ ldapxsearch -x
'ldap://dc1.w.net/?netlogon??(&(DnsDomain=W.NET)(NtVer=\00\00\00\00))'
00000:  13 00 5c 00 5c 00 44 00 43 00 31 00 00 00 00 00  |..\.\.D.C.1.....|
00010:  57 00 00 00 01 00 00 00 ff ff ff ff              |W...........    |
$ ldapxsearch -x
'ldap://dc1.w.net/?netlogon??(&(DnsDomain=W.NET)(NtVer=\01\00\00\00))'
00000:  13 00 5c 00 5c 00 44 00 43 00 31 00 00 00 00 00  |..\.\.D.C.1.....|
00010:  57 00 00 00 01 00 00 00 ff ff ff ff              |W...........    |
$ ldapxsearch -x
'ldap://dc1.w.net/?netlogon??(&(DnsDomain=W.NET)(NtVer=\02\00\00\00))'
00000:  13 00 5c 00 5c 00 44 00 43 00 31 00 00 00 00 00  |..\.\.D.C.1.....|
00010:  57 00 00 00 72 31 a6 a6 df 22 c2 4d b3 13 0c ec  |W...r1...".M....|
00020:  62 b4 be ac 00 00 00 00 00 00 00 00 00 00 00 00  |b...............|
00030:  00 00 00 00 01 77 03 6e 65 74 00 c0 34 03 64 63  |.....w.net..4.dc|
00040:  31 c0 34 6e 02 a8 c0 7d 03 00 00 03 00 00 00 ff  |1.4n...}........|
00050:  ff ff ff                                         |...
   |
$ ldapxsearch -x
'ldap://dc1.w.net/?netlogon??(&(DnsDomain=W.NET)(NtVer=\04\00\00\00))'
00000:  17 00 00 00 fd 03 00 00 72 31 a6 a6 df 22 c2 4d  |........r1...".M|
00010:  b3 13 0c ec 62 b4 be ac 01 77 03 6e 65 74 00 c0  |....b....w.net..|
00020:  18 03 64 63 31 c0 18 01 57 00 03 44 43 31 00 00  |..dc1...W..DC1..|
00030:  17 44 65 66 61 75 6c 74 2d 46 69 72 73 74 2d 53  |.Default-First-S|
00040:  69 74 65 2d 4e 61 6d 65 00 c0 30 05 00 00 00 ff  |ite-Name..0.....|
00050:  ff ff ff                                         |...
   |
$ ldapxsearch -x
'ldap://dc1.w.net/?netlogon??(&(DnsDomain=W.NET)(NtVer=\08\00\00\00))'
00000:  17 00 00 00 fd 03 00 00 72 31 a6 a6 df 22 c2 4d  |........r1...".M|
00010:  b3 13 0c ec 62 b4 be ac 01 77 03 6e 65 74 00 c0  |....b....w.net..|
00020:  18 03 64 63 31 c0 18 01 57 00 03 44 43 31 00 00  |..dc1...W..DC1..|
00030:  17 44 65 66 61 75 6c 74 2d 46 69 72 73 74 2d 53  |.Default-First-S|
00040:  69 74 65 2d 4e 61 6d 65 00 c0 30 10 02 00 00 00  |ite-Name..0.....|
00050:  c0 a8 02 6e 00 00 00 00 00 00 00 00 0d 00 00 00  |...n............|
00060:  ff ff ff ff                                      |....            |