unknown RPC opcodes during join+logon

[Luke Howard]

>I think the uint32 is the return code since I have 0xC0000022 (access denied) from my trace. My 
>question is regarding this. Is the algorithm for calculating client credentials in Authenticate3 
>different from the one in Authenticate2? If so, can somebody give me pointers to where I can find 
>the algo ? 

The return code always follows the last top-level [out] value, but there
is an additional [out] ULONG in NetrServerAuthenticate3.

The algorithm for calculating credentials is the same.

-- Luke

--
Luke Howard | lukehoward.com
PADL Software | www.padl.com