ticket-granting ticket (TGT): A special type of ticket that can be used to obtain other tickets. The TGT is obtained after the initial authentication in the Authentication Service (AS) exchange; thereafter, users do not need to present their credentials, but can use the TGT to obtain subsequent tickets. trusted domain object (TDO): A collection of properties that define a trust relationship with another domain, such as direction (outbound, inbound, or both), trust attributes, name, and security identifier of the other domain. For more information, see [MS-ADTS]. UNC path: The location of a file in a network of computers as specified in the Universal Naming Convention (UNC) syntax. Also known as UncPath. MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as defined in . All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT. References to a document in the Microsoft Open Specifications library point to the correct section in the most recently published version of the referenced document. However, because individual documents in the library are not updated at the same time, the section numbers in the documents may not match. You can confirm the correct section numbering by checking the . Normative References We conduct frequent surveys of the normative references to assure their continued availability. If you have any issue with finding a normative reference, please contact . We will assist you in finding the relevant information. [C706] The Open Group, "DCE 1.1: Remote Procedure Call", C706, August 1997, [MS-ADA1] Microsoft Corporation, "". [MS-ADA2] Microsoft Corporation, "". [MS-ADA3] Microsoft Corporation, "". [MS-ADTS] Microsoft Corporation, "". [MS-APDS] Microsoft Corporation, "". [MS-DTYP] Microsoft Corporation, "". [MS-KILE] Microsoft Corporation, "". [MS-NLMP] Microsoft Corporation, "". [MS-NRPC] Microsoft Corporation, "". [MS-PKCA] Microsoft Corporation, "". [MS-RCMP] Microsoft Corporation, "". [MS-RPCE] Microsoft Corporation, "". [MS-SAMR] Microsoft Corporation, "". [MS-SFU] Microsoft Corporation, "".
S-1-5-18 Local System AlwaysFilter S-1-5-19 Local Service AlwaysFilter S-1-5-20 Network Service AlwaysFilter S-1-5-21 NT Account Domain AlwaysFilter S-1-5-21-x Partially formed SID AlwaysFilter Partially formed SID AlwaysFilter Invalid domain SID (too many RIDs) AlwaysFilter Identifies a domain, not a principal AlwaysFilter Compounded Authentication NeverFilter<27> Claims Valid NeverFilter<28> R<500 SID range ForestSpecific Administrator ForestSpecific<29> Guest ForestSpecific<30> Krbtgt ForestSpecific<31> Domain Admins ForestSpecific<32> Domain Users ForestSpecific<33> Domain Guests ForestSpecific<34> 500 R X-Y-Z
Domain Computers ForestSpecific<35> Domain Controllers ForestSpecific<36> Cert Publishers ForestSpecific<37> Schema Admins ForestSpecific<38> Enterprise Admins ForestSpecific<39> Group Policy Creator Owners ForestSpecific<40> <= < 1000 Except and above Reserved values. Never assigned as primary identities to user accounts. ForestSpecific<41> R >= 1000 Identifiers for end domain identities and domain groups. Not filtered at domain and external trust boundaries. May be filtered at member, quarantined, and cross-forest boundaries. does not match this <domain>. All Except on trusted domain object (TDO) If the trusting domain is configured to filter all except on (TDO), then the domain controller filters all SIDs that are not from the trusted domain. where does not All Except on Forest Information (FtInfo) If the trusting domain is configured to filter all except on R
match identities of the domains in a trusted forest that have been selected as trusted. Identities from other forests. FtInfo, then the domain controller filters all SIDs that are not from the trusted domains in the trusted forest. The FtInfo is the collection of domain SIDs in the forest. By default, the FtInfo is the list of all domains in the trusted forest, but it can be configured to be a subset of domain SIDs trusted by the domain. S-1-5-32 Built-in Domain AlwaysFilter Administrators AlwaysFilter Users AlwaysFilter Guests AlwaysFilter Power Users AlwaysFilter Account Operators AlwaysFilter System Operators AlwaysFilter Print Operators AlwaysFilter Backup Operators AlwaysFilter Replicator AlwaysFilter Ras Servers AlwaysFilter Pre-Win 2k Compatible AlwaysFilter Remote Desktop AlwaysFilter Network Configuration Operators AlwaysFilter
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type SID Filtering and Claims Transformation Updated content for Windows Server 2016 Technical Preview. Y Content update. Appendix A: Product Behavior Updated the product applicability list to include Windows 10 operating system. Y Content update. 5 Appendix A: Product Behavior Updated the product behavior notes to include Windows Server 2016 Technical Preview operating system. Y Content update.