Supports KERB_CHECKSUM_HMAC_MD5 Does not support and supports AES256 HMAC_SHA1_96_AES256<14> Does not support or and supports HMAC_SHA1_96_AES128<15> Does not support or None. The checksum operation will fail. The resulting hash is placed in the Signature field of the KDC's PAC_SIGNATURE_DATA structure. Constrained Delegation Information The S4U_DELEGATION_INFO structure lists the services that have been delegated through this Kerberos client and subsequent services or servers. The list is used only in a Service for User to Proxy (S4U2proxy) request. This feature could be used multiple times in succession from service to service, which is useful for auditing purposes.<16> The S4U_DELEGATION_INFO structure is marshaled by RPC . typedef struct _S4U_DELEGATION_INFO { RPC_UNICODE_STRING S4U2proxyTarget; ULONG TransitedListSize; [size_is(TransitedListSize)] PRPC_UNICODE_STRING S4UTransitedServices; } S4U_DELEGATION_INFO, *PS4U_DELEGATION_INFO;
S-1-5-18 Local System AlwaysFilter S-1-5-19 Local Service AlwaysFilter S-1-5-20 Network Service AlwaysFilter S-1-5-21 NT Account Domain AlwaysFilter S-1-5-21-x Partially formed SID AlwaysFilter Partially formed SID AlwaysFilter Invalid domain SID (too many RIDs) AlwaysFilter Identifies a domain, not a principal AlwaysFilter Compounded Authentication NeverFilter<27> Claims Valid NeverFilter<28> R<500 SID range ForestSpecific Administrator ForestSpecific<29> ForestSpecific<30> Krbtgt ForestSpecific<31> Domain Admins ForestSpecific<32> Domain Users ForestSpecific<33> Domain Guests ForestSpecific<34> 500 R X-Y-Z
Domain Computers ForestSpecific<35> Domain Controllers ForestSpecific<36> Cert Publishers ForestSpecific<37> Schema Admins ForestSpecific<38> Enterprise Admins ForestSpecific<39> Policy Creator Owners ForestSpecific<40> <= < 1000 Except and above Reserved values. Never assigned as primary identities to user accounts. ForestSpecific<41> R >= 1000 Identifiers for end domain identities and domain groups. Not filtered at domain and external trust boundaries. May be filtered at member, quarantined, and cross-forest boundaries. where does not match this <domain>. All Except on trusted domain object (TDO) If the trusting domain is configured to filter all except on TDO, then the domain controller filters all SIDs that are not from the trusted domain. X-Y-Z does not All Except on Forest Trust Information (FtInfo) If the trusting domain is configured to filter all except on R
match identities of the domains in a trusted forest that have been selected as trusted. Identities from other forests. FtInfo, then the domain controller filters all SIDs that are not from the trusted domains in the trusted forest. The FtInfo is the collection of domain SIDs in the forest. By default, the FtInfo is the list of all domains in the trusted forest, but it can be configured to be a subset of domain SIDs trusted by the domain. S-1-5-32 Built-in Domain AlwaysFilter Administrators AlwaysFilter Users AlwaysFilter Guests AlwaysFilter Power Users AlwaysFilter Account Operators AlwaysFilter System Operators AlwaysFilter Print Operators AlwaysFilter Backup Operators AlwaysFilter Replicator AlwaysFilter Ras Servers AlwaysFilter Pre-Win 2k Compatible AlwaysFilter Remote Desktop Users AlwaysFilter Network Configuration Operators AlwaysFilter
Index A 9 35 C 46 34 Common data types and fields ( 10, 11) 24 Constructed security types 12 12 11 40 18 D Data types and fields common ( 10, 11) 24 Details 10 12 E 30 34 32 30 34 F 41 9 Filtering 40 35 35 G 5 12 I 41 41 8 5 K 11 14 L 9 32 N 7 21 O 8 P 18 35 25 22 20 19 27 26 13 22 12 41 12 12 11 21 20 42 24 21 7 8 7 9 S 24 21 Security 35 40 41 35 41 35 35 structure types 12 12 11 35 SID 35