Revision Summary Date Revision History Revision Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 2.0 Added example. 7/20/2007 3.0 Major Rewrite of keying algorithms; clarification of user account enabling. 8/10/2007 3.0.1 Editorial Changed language and formatting in the technical content. 9/28/2007 3.0.2 Editorial Changed language and formatting in the technical content. 10/23/2007 3.1 Minor Clarified the meaning of the technical content. 11/30/2007 3.2 Minor Clarified the meaning of the technical content. 1/25/2008 4.0 Major Updated and revised the technical content. 3/14/2008 4.1 Clarified the meaning of the
technical content. 5/16/2008 4.1.1 Editorial Changed language and formatting in the technical content. 6/20/2008 5.0 Major Updated and revised the technical content. 7/25/2008 6.0 Major Updated and revised the technical content. 8/29/2008 7.0 Major Updated and revised the technical content. 10/24/2008 8.0 Major Updated and revised the technical content. 12/5/2008 9.0 Major Updated and revised the technical content. 1/16/2009 10.0 Major Updated and revised the technical content. 2/27/2009 11.0 Major Updated and revised the technical content. 4/10/2009 12.0 Major Updated and revised the technical content. 5/22/2009 13.0 Major Updated and revised the
8/27/2010 23.1 Minor Clarified the meaning of the technical content. 10/8/2010 24.0 Major Updated and revised the technical content. 11/19/2010 25.0 Major Updated and revised the technical content. 1/7/2011 26.0 Major Updated and revised the technical content. 2/11/2011 27.0 Major Updated and revised the technical content. 3/25/2011 28.0 Major Updated and revised the technical content. 5/6/2011 29.0 Major Updated and revised the technical content. 6/17/2011 29.1 Clarified the meaning of the technical content. 9/23/2011 30.0 Major Updated and revised the technical content. 12/16/2011 31.0 Major Updated and revised the technical content. 3/30/2012 31.0 None No changes to the
meaning, language, or formatting of the technical content. 7/12/2012 31.1 Minor Clarified the meaning of the technical content. 10/25/2012 32.0 Major Updated and revised the technical content. 1/31/2013 33.0 Major Updated and revised the technical content. 8/8/2013 34.0 Major Updated and revised the technical content. 11/14/2013 34.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 34.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 34.0 None No changes to the meaning, language, or formatting of the technical content.
Constant Definitions This section is used as a reference from one or more message syntax and message processing sections. Common ACCESS_MASK Values These values specify an access control that is applicable to all object types exposed by this protocol. These values can appear in the Mask field of an or in methods to obtain a handle (for example, ). Constant/value Description DELETE 0x00010000 Specifies the ability to delete the object. READ_CONTROL 0x00020000 Specifies the ability to read the . WRITE_DAC 0x00040000 Specifies the ability to update the of the security descriptor. WRITE_OWNER 0x00080000 Specifies the ability to update the Owner field of the security descriptor. ACCESS_SYSTEM_SECURITY 0x01000000 Specifies access to the system security portion of the security descriptor. MAXIMUM_ALLOWED 0x02000000 Indicates that the caller is requesting the most access possible to the object. For more information, see section 2.4.3. Values that are not listed have no meaning in this protocol. Generic ACCESS_MASK Values values appear in methods that are used to obtain a handle (for example, ). They are translated by the server into specific ACCESS_MASK values. For more information on object-specific semantics, see sections , , , , and . Constant/value Description GENERIC_READ 0x80000000 Specifies access control suitable for reading the object. GENERIC_WRITE 0x40000000 Specifies access control suitable for updating attributes on the object. GENERIC_EXECUTE 0x20000000 Specifies access control suitable for executing an action on the object. GENERIC_ALL 0x10000000 Specifies all defined access control on the object.
Server ACCESS_MASK Values These are the specific values available to describe the access control on a server object. A bitwise OR operation can be performed on these values, along with values from section . For more information on the message processing of these values, see section . Constant/value Description SAM_SERVER_CONNECT 0x00000001 Specifies access control to obtain a server handle. SAM_SERVER_SHUTDOWN 0x00000002 Does not specify any access control. SAM_SERVER_INITIALIZE 0x00000004 Does not specify any access control. SAM_SERVER_CREATE_DOMAIN 0x00000008 Does not specify any access control. SAM_SERVER_ENUMERATE_DOMAINS 0x00000010 Specifies access control to view domain objects. SAM_SERVER_LOOKUP_DOMAIN 0x00000020 Specifies access control to perform SID-to-name translation. SAM_SERVER_ALL_ACCESS 0x000F003F The specified accesses for a GENERIC_ALL request. SAM_SERVER_READ 0x00020010 The specified accesses for a GENERIC_READ request. SAM_SERVER_WRITE 0x0002000E The specified accesses for a GENERIC_WRITE request. SAM_SERVER_EXECUTE 0x00020021 The specified accesses for a GENERIC_EXECUTE request. Domain ACCESS_MASK Values These are the specific values available to describe the access control on a domain object. A bitwise OR operation can be performed on these values, along with values from section . For more information on the message processing of these values, see section . Constant/value Description DOMAIN_READ_PASSWORD_PARAMETERS 0x00000001 Specifies access control to read password policy. DOMAIN_WRITE_PASSWORD_PARAMS 0x00000002 Specifies access control to write password policy. DOMAIN_READ_OTHER_PARAMETERS 0x00000004 Specifies access control to read attributes not
related to password policy. DOMAIN_WRITE_OTHER_PARAMETERS 0x00000008 Specifies access control to attributes not related to password policy. DOMAIN_CREATE_USER 0x00000010 Specifies access control to create a user object. DOMAIN_CREATE_GROUP 0x00000020 Specifies access control to create a group object. DOMAIN_CREATE_ALIAS 0x00000040 Specifies access control to create an alias object. DOMAIN_GET_ALIAS_MEMBERSHIP 0x00000080 Specifies access control to read the membership of a set of SIDs. DOMAIN_LIST_ACCOUNTS 0x00000100 Specifies access control to enumerate objects. DOMAIN_LOOKUP 0x00000200 Specifies access control to look up objects by name and SID. DOMAIN_ADMINISTER_SERVER 0x00000400 Specifies access control to various administrative operations on the server. DOMAIN_ALL_ACCESS 0x000F07FF The specified accesses for a GENERIC_ALL request. DOMAIN_READ 0x00020084 The specified accesses for a GENERIC_READ request. DOMAIN_WRITE 0x0002047A The specified accesses for a GENERIC_WRITE request. DOMAIN_EXECUTE 0x00020301 The specified accesses for a GENERIC_EXECUTE request.
Group ACCESS_MASK Values These are the specific values available to describe the access control on a group object. A bitwise OR operation can be performed on these values, along with values from section . For more information on the message processing of these values, see section . Description GROUP_READ_INFORMATION 0x00000001 Specifies the ability to read various attributes. GROUP_WRITE_ACCOUNT 0x00000002 Specifies the ability to various attributes, not including the member attribute. GROUP_ADD_MEMBER 0x00000004 Specifies the ability to add a value to the member attribute. GROUP_REMOVE_MEMBER 0x00000008 Specifies the ability to remove a value from the member attribute. GROUP_LIST_MEMBERS 0x00000010 Specifies the ability to read the values of the member attribute. GROUP_ALL_ACCESS 0x000F001F The specified accesses for a GENERIC_ALL request. GROUP_READ 0x00020010 The specified accesses for a GENERIC_READ request. GROUP_WRITE 0x0002000E The specified accesses for a GENERIC_WRITE request. GROUP_EXECUTE 0x00020001 The specified accesses for a GENERIC_EXECUTE request. Alias ACCESS_MASK Values These are the specific values available to describe the access control on an alias object. A bitwise OR operation can be performed on these values, along with values from section . For more information on the message processing of these values, see section . Constant/value Description
ALIAS_ADD_MEMBER 0x00000001 Specifies the ability to add a value to the member attribute. ALIAS_REMOVE_MEMBER 0x00000002 Specifies the ability to remove a value from the member attribute. ALIAS_LIST_MEMBERS 0x00000004 Specifies the ability to read the member attribute. ALIAS_READ_INFORMATION 0x00000008 Specifies the ability to read various attributes, not including the member attribute. ALIAS_WRITE_ACCOUNT 0x00000010 Specifies the ability to write various attributes, not including the member attribute. ALIAS_ALL_ACCESS 0x000F001F The specified accesses for a GENERIC_ALL request. ALIAS_READ 0x00020004 The specified accesses for a GENERIC_READ request. ALIAS_WRITE 0x00020013 The specified accesses for a GENERIC_WRITE request. ALIAS_EXECUTE 0x00020008 The specified accesses for a GENERIC_EXECUTE request. User ACCESS_MASK Values These are the specific values available to describe the access control on a user object. A bitwise OR operation can be performed on these values, along with values from section . For more information on the message processing of these values, see section . Description USER_READ_GENERAL 0x00000001 Specifies the ability to read sundry attributes.
USER_READ_PREFERENCES 0x00000002 Specifies the ability to read general information attributes. USER_WRITE_PREFERENCES 0x00000004 Specifies the ability to general information attributes. USER_READ_LOGON 0x00000008 Specifies the ability to read attributes related to logon statistics. USER_READ_ACCOUNT 0x00000010 Specifies the ability to read attributes related to the administration of the user object. USER_WRITE_ACCOUNT 0x00000020 Specifies the ability to write attributes related to the administration of the user object. USER_CHANGE_PASSWORD 0x00000040 Specifies the ability to change the user's password. USER_FORCE_PASSWORD_CHANGE 0x00000080 Specifies the ability to set the user's password. USER_LIST_GROUPS 0x00000100 Specifies the ability to query the membership of the user object. USER_READ_GROUP_INFORMATION 0x00000200 Does not specify any access control. USER_WRITE_GROUP_INFORMATION 0x00000400 Does not specify any access control. USER_ALL_ACCESS 0x000F07FF The specified accesses for a GENERIC_ALL request. USER_READ 0x0002031A The specified accesses for a GENERIC_READ request. USER_WRITE 0x00020044 The specified accesses for a GENERIC_WRITE request.
USER_ALL_LOGONHOURS 0x00002000 LogonHours USER_ALL_BADPASSWORDCOUNT 0x00004000 BadPasswordCount USER_ALL_LOGONCOUNT 0x00008000 LogonCount USER_ALL_PASSWORDCANCHANGE 0x00010000 PasswordCanChange USER_ALL_PASSWORDMUSTCHANGE 0x00020000 PasswordMustChange USER_ALL_PASSWORDLASTSET 0x00040000 PasswordLastSet USER_ALL_ACCOUNTEXPIRES 0x00080000 AccountExpires USER_ALL_USERACCOUNTCONTROL 0x00100000 UserAccountControl USER_ALL_PARAMETERS 0x00200000 Parameters USER_ALL_COUNTRYCODE 0x00400000 CountryCode USER_ALL_CODEPAGE 0x00800000 CodePage USER_ALL_NTPASSWORDPRESENT 0x01000000 NtPasswordPresent USER_ALL_LMPASSWORDPRESENT 0x02000000 LmPasswordPresent USER_ALL_PRIVATEDATA 0x04000000 PrivateData USER_ALL_PASSWORDEXPIRED 0x08000000 PasswordExpired USER_ALL_SECURITYDESCRIPTOR 0x10000000 SecurityDescriptor USER_ALL_UNDEFINED_MASK 0xC0000000 Undefined mask.
ACCOUNT_TYPE Values Account type values are associated with and indicate the type of account. These values are not to be combined through logical operations. Constant/value Description SAM_DOMAIN_OBJECT 0x00000000 Represents a domain object. SAM_GROUP_OBJECT 0x10000000 Represents a object. SAM_NON_SECURITY_GROUP_OBJECT 0x10000001 Represents a group object that is not used for generation. SAM_ALIAS_OBJECT 0x20000000 Represents an alias object. SAM_NON_SECURITY_ALIAS_OBJECT 0x20000001 Represents an alias object that is not used for authorization context generation. SAM_USER_OBJECT 0x30000000 Represents a user object. SAM_MACHINE_ACCOUNT 0x30000001 Represents a computer object. SAM_TRUST_ACCOUNT 0x30000002 Represents a user object that is used for domain trusts. SAM_APP_BASIC_GROUP 0x40000000 Represents an group. SAM_APP_QUERY_GROUP 0x40000001 Represents an whose members are determined by the results of a query.
DOMAIN_GROUP_RID_READONLY_CONTROLLERS 0x00000209 Name: Domain Controllers A group that represents all RODCs in the domain. STATUS_ These values are return status codes from the server. This section is provided as a reference for the message processing sections in section . Constant/value Description STATUS_ACCESS_DENIED 0xC0000022 Returned when a client has requested access to an object but has not been granted those access rights. STATUS_MORE_ENTRIES 0x00000105 Returned by enumeration methods to indicate that more information is available. STATUS_NO_MORE_ENTRIES 0x8000001A Returned by enumeration methods to indicate that no more information is available. STATUS_SOME_NOT_MAPPED 0x00000107 Returned when some of the information to be translated has not been translated. STATUS_NONE_MAPPED 0xC0000073 Returned when none of the information to be translated
has been translated. STATUS_WRONG_PASSWORD 0xC000006A Returned when trying to update a password and the value provided as the current password is not correct. STATUS_ACCOUNT_LOCKED_OUT 0xC0000234 Returned when the user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. STATUS_GROUP_EXISTS 0xC0000065 Returned when the specified group already exists. STATUS_USER_EXISTS 0xC0000063 Returned when the specified account already exists. STATUS_LM_CROSS_ENCRYPTION_REQUIRED 0xC000017F Returned when the client is to retry the request using the current password as an encryption key. See section for details. STATUS_NT_CROSS_ENCRYPTION_REQUIRED 0xC000015D Returned when the client is to the request
Hash6 (16 bytes) ... ... Hash7 (16 bytes) ... ... Hash8 (16 bytes) ... ... Hash9 (16 bytes) ... ... Hash10 (16 bytes) ... ... Hash11 (16 ... ... Hash12 (16 bytes) ... ... Hash13 (16 bytes) ... ... Hash14 (16 bytes)
0x0027 ' 0x003c < 0x003e > 0x002c , 0x002e . 0x003f ? 0x0029 ) 0x002f / Attribute Triggers for Originating Updates The following attribute-scoped triggers MUST be executed during originating updates to the database. The term "previous" refers to the value at the beginning of the transaction, before any updates occurred. Unless otherwise specified, other attributes referenced for a particular trigger refer to the attribute on the same object as the attribute whose trigger is currently being executed. objectClass If the objectClass attribute is user or computer, or derived from either of these classes, all of the following constraints MUST be satisfied: The objectSid attribute MUST be updated according to the supplemental trigger specified in section . The following attributes MUST be updated with the associated values if no value is present in the database. Attribute Value badPwdCount 0 codePage 0 countryCode 0 badPasswordTime 0 lastLogoff 0 lastLogon 0 pwdLastSet 0 accountExpires 0x7FFFFFFF FFFFFFFF (default value) logonCount 0
If the Effective-PasswordReversibleEncryptionEnabled value (see section 3.1.1.5) is set, PasswordInformation.PasswordProperties MUST contain DOMAIN_PASSWORD_STORE_CLEARTEXT. SamrGetDomainPasswordInformation (Opnum 56) The SamrGetDomainPasswordInformation method obtains select password policy information (without authenticating to the server). long SamrGetDomainPasswordInformation( [in] handle_t BindingHandle, [in, unique] PRPC_UNICODE_STRING Unused, [out] PUSER_DOMAIN_PASSWORD_INFORMATION PasswordInformation ); BindingHandle: An RPC binding handle parameter, as specified in section 1. Unused: A string that is unused by the protocol. It is ignored by the server. The client MAY<62> set any value. PasswordInformation: Password policy information from the account domain. is no security enforced for this method. Upon receiving this message, the server MUST process the data from the message subject to the following constraints: The output parameter PasswordInformation.MinPasswordLength MUST be set to the minPwdLength attribute value on the account domain object. The output parameter PasswordInformation.PasswordProperties MUST be set to the pwdProperties attribute value on the account domain object. The method MUST return STATUS_SUCCESS. SamrRidToSid (Opnum 65) The SamrRidToSid method obtains the SID of an account, given a RID. long SamrRidToSid( [in] SAMPR_HANDLE ObjectHandle, [in] unsigned long Rid, [out] PRPC_SID* Sid ); ObjectHandle: An RPC context handle, as specified in section . The message processing shown later in this section contains details on which types of ObjectHandle are accepted by the server. Rid: A RID of an account. Sid: The SID of the account referenced by Rid. This protocol asks the RPC runtime, via the strict_context_handle attribute, to reject the use of context handles created by a method of a different RPC interface than this one, as specified in section 3. Upon receiving this message, the server MUST process the data from the message subject to the following constraints:
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type Normative References Added normative reference Y Content update. 1.2.1 Normative References 5355 : Updated to include references to [MS-CIFS] and Y Content update. Informative References 73154 : Added the [SCHNEIER] reference. N Content update. Relationship to Protocols 5355 : Updated the figures to include [MS-SMB2]. Y Content update. Prerequisites/Preconditions 5355 : Updated to reference Content update. Transport Updated the authentication level details for the transport requirements, and added a new product behavior note. Y Content update. SAMPR_USER_ALL_INFORMATION 5355 : Updated to indicate that the 16-byte SMB session key is obtained as specified in either section 3.1.2.3 or section 3.2.2.3. Y Content update. SAMPR_USER_INTERNAL1_INFORMATION 5355 : Updated to indicate that the 16-byte SMB session key is obtained as specified in either section 3.1.2.3 or section 3.2.2.3. Y Content update. SAMPR_USER_INTERNAL5_INFORMATION 5355 : Updated to indicate that the 16-byte SMB session key is obtained as specified in either section 3.1.2.3 or section 3.2.2.3. Y Content update. SAMPR_USER_INTERNAL5_INFORMATION_NEW 5355 : Updated to indicate that the 16-byte SMB session key is obtained as specified in either section 3.1.2.3 or section 3.2.2.3. Y Content update. NTLM-Strong-NTOWF Added section with content for this version of Windows Server. Y New content added. Attribute Listing 72743 : Updated the character case of the lockOutObservationWindow attribute. N Content update.
Password Settings Attributes for Originating Update Constraints 72743 : Updated the character case of the lockOutObservationWindow attribute. N Content update. Attribute Constraints for Originating Updates Documented AD behavior changes to support fixes made in MRC 21141: unlimited cascading account creation is allowed in certain products. Y Content update. 3.1.1.6 Attribute Constraints for Originating Updates 72743 : Updated the character case of the lockOutObservationWindow attribute. N Content update. supplementalCredentials Added content for this version of Windows Server. Y Content update. Packages Property Added content for this version of Windows Server. Y Content update. Property Added section with content for this version of Windows Server. Y New content added. Acquiring an SMB Session Key 5355 : this section to specify how the server retrieves an SMB session key. Y New content added. Selective Enumerate Pattern 72639 : Added content to clarify implicit constraints for use patterns utilized for deterministic results. Y Content update. SamrQueryDisplayInformation3 (Opnum 51) : Clarified the return value of TotalAvailable when the DisplayInformationClass is not set to the DomainDisplayUser. Y Content update. SamrCreateUser2InDomain (Opnum 50) Documented AD behavior changes to support fixes made to MRC 21141: unlimited cascading account creation is allowed for certain products. Y Content update. UserInternal4Information 5355 : Updated to indicate that the 16-byte SMB session key is obtained as specified in section 3.1.2.3. Y Content update. SamrGetGroupsForUser (Opnum 39) 72638 : Clarified the SamrGetGroupsForUser text criteria for when the server determines the union of all database objects. Y Content update. SamrSetSecurityObject (DC Configuration) 72690 : Revised content to indicate that the server does not ignore the request when Y Content update.
Index A Abstract data 224 97 129 Access checks 129 123 29 129 42 42 42 42 42 Algorithms 94 94 Alias 158 59 58 32 32 32 60 32 32 32 32 32 32 26 Attributes 102 99 101 110 B 42 C 26 191 191 269 101 Client 224 225 226 225 224 225 226 225 28 29 102 158 158 227 227 84 D Data abstract 224 97 122 Data model - abstract 224 97 Data types 58 42 28 29 49 56 44 79 74 84 60 129 129 29 181 181 96 Domain 49 49 30 40 30 30 30 30 78 30 30 40 40 40 40 54 30 52 30 52 52 51 30 30
30 51 51 52 51 40 40 40 30 30 30 E 96 229 229 44 44 231 231 148 148 Events 226 226 223 Examples 227 227 229 229 231 231 F Fields 59 49 56 74 61 27 27 235 G 29 29 29 29 11 Group 158 56 56 31 31 57 31 57 31 47 31 31 31 37 37 37 37 37 37 37 31 31 H 123 98 I 235 234 234 27 17 Initialization 225 129 11 K 91 93 89 91 94 L 99 231 Local events 226 server 223 224 197 197 M 98 29 225 183 183 189 189 Message processing 225 132 218 Messages
28 28 28 21 Methods 191 158 181 148 27 197 183 189 209 137 26 164 201 153 172 26 209 209 N 15 231 O 101 18 42 137 137 17 P 234 234 101 83 Pattern 191 158 181 148 197 183 189 209 137 164 201 153 172 52 52 52 51 52 51 44 44 57 47 42 26 26 158 256 44 43 42 81 82 79 82 79 81 59 59 59 75 77 75 77 76 77 76 77 75 76 53 53 54 54 54 54 68 69 46 47 47 57 57 57 63 45 45 46 48 46 45 46 45 66 66 68 63 66 65 67 70 70 70 71 71
68 65 67 65 65 67 67 68 62 48 63 62 Q 164 164 R 225 29 15 17 15 25 41 43 42 S 35 35 35 35 35 35 35 35 30 30 30 30 30 30 30 30 30 30 35 35 81 82 79 82 79 81 80 122 59 59 59 75 77 75 77 76 77 76 77 75 76 53 53 54 54 54 54 68 69 46 47 47 57 57 57 63 45 45 46 48 46 45 46 45 66 66 68 63 66 65 67 70 70 70 71 71 68 65 67 65 65 67 67 68 186 184 188 191 209 140 139 139 137 160 159 160 163 182
181 183 151 148 150 152 190 158 156 210 189 187 185 210 197 199 198 194 145 141 144 146 156 155 153 168 166 164 167 171 169 205 186 188 184 188 211 211 174 172 174 181 175 209 201 195 79 212 96 36 36 36 Security 234 234 Security model 224 123 201 201 74 74 153 153 Sequencing rules 225 132 Server 97 191 158 181 148 129 local events 223 224 197 183 189 132 209 137 97 164 123 201 153 132 172 218 223 129 172 172 43 27 41 41 41 41 41 41 41 41 41 41 41 String 98 98 T events 226 223 Timers 225 129 269 28 Triggers 110 121 U 39 39
39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 Update constraints 121 110 attributes ( 101, 102) 106 User 61 60 User account 227 229 37 37 33 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 33 62 48 37 37 37 33 63 33 37 71 37 33 37 37 37 37 37 37 37 62 84 85 33 33 33 33 33 33 37 37 37 37 37 37 37 37 33 33 33 33 V 27 26 W 85 29 29