RootDSE netlogon attribute NtVer values?

[Michael B Allen]

On 10/12/07, Andrew Bartlett <abartlet at samba.org> wrote:
>
> On Fri, 2007-10-12 at 18:27 -0400, Michael B Allen wrote:
> > Hi,
> >
> > Hope you don't mind a protocol question but ...
> >
> > Regarding the cldap query for the netlogon attribute of the RootDSE,
> > I'm trying to find a value for the NtVer filter parameter that works
> > with both Windows 2003 and Windows 2000. I've been using \06\00\00\02
> > like:
> >
> > (&(DnsDomain=W.NET)(NtVer=\06\00\00\02))
> >
> > simply because that is what I observed from XP but apparently Windows
> > 2000 SP4 doesn't return a match for this at all. Or perhaps the
> > problem is that I used regular ldap and not cldap?
>
> CLDAP queries that include the netlogon attribute are not normal LDAP
> filters in any sense.  They are just queries with a few name-value pairs
> included (the | and & are ignored), that expect sort-of-ldap like
> responses.

Hey Andrew,

So it sounds like the NtVer value is not fully understood at this point?

To that end, if anyone's interested, the following .NET program
provokes the cldap request (I tried a DsGetDcName Win32 program too
but it just did a DsrGetDcNameEx2 RPC).

If anyone has a capture of this request w/ Windows 2000 I would be
very interested in seeing it. I only have Windows 2003 here :-(

Later,
Mike

// csc /out:locate.exe locate.cs

using System;
using System.DirectoryServices.ActiveDirectory;

public class Locate {

	public void Run() {
	try {
		DirectoryContext ctx = new DirectoryContext(
			DirectoryContextType.Domain,
			"NBTDOMNAME"
		);
		using (DomainController dc = DomainController.FindOne(
			ctx,
			LocatorOptions.ForceRediscovery)
		)
		{
			Console.WriteLine(dc.Name);
		}
	} catch (Exception ex) {
		Console.WriteLine(ex.ToString());
	}
	}

	public static void Main() {
		Locate l = new Locate();
		l.Run();
	}
}