Revision Summary Date Revision History Revision Class Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 1.0.1 Editorial Changed language and formatting in the technical content. 7/20/2007 2.0 Major Updated and revised the technical content. 8/10/2007 3.0 Updated and revised the technical content. 9/28/2007 4.0 Updated and revised the technical content. 10/23/2007 5.0 Updated and revised the technical content. 11/30/2007 6.0 Major Updated and revised the technical content. 1/25/2008 6.0.1 Editorial Changed language and formatting in the technical content. 3/14/2008 6.0.2 Editorial Changed language and
formatting in the technical content. 5/16/2008 6.0.3 Editorial Changed language and formatting in the technical content. 6/20/2008 7.0 Major Updated and revised the technical content. 7/25/2008 8.0 Major Updated and revised the technical content. 8/29/2008 9.0 Updated and revised the technical content. 10/24/2008 9.0.1 Editorial Changed language and formatting in the technical content. 12/5/2008 10.0 Major Updated and revised the technical content. 1/16/2009 11.0 Major Updated and revised the technical content. 2/27/2009 12.0 Major Updated and revised the technical content. 4/10/2009 12.1 Minor Clarified the meaning of the technical content.
5/22/2009 13.0 Major Updated and revised the technical content. 7/2/2009 13.1 Minor Clarified the meaning of the technical content. 8/14/2009 13.2 Clarified the meaning of the technical content. 9/25/2009 14.0 Major Updated and revised the technical content. 11/6/2009 15.0 Major Updated and revised the technical content. 12/18/2009 15.1 Minor Clarified the meaning of the technical content. 1/29/2010 15.2 Minor Clarified the meaning of the technical content. 3/12/2010 16.0 Updated and revised the technical content. 4/23/2010 16.1 Clarified the meaning of the technical content. 6/4/2010 16.2 Clarified the meaning of the technical content. 7/16/2010 16.2 None No changes to the
meaning, language, or formatting of the technical content. 8/27/2010 16.2 None No changes to the meaning, language, or formatting of the technical content. 10/8/2010 16.2 None No changes to the meaning, language, or formatting of the technical content. 11/19/2010 17.0 Major Updated and revised the technical content. 1/7/2011 17.1 Minor Clarified the meaning of the technical content. 2/11/2011 17.2 Minor Clarified the meaning of the technical content. 3/25/2011 17.3 Minor Clarified the meaning of the technical content. 5/6/2011 17.3 None No changes to the meaning, language, or formatting of the technical content.
6/17/2011 17.4 Minor Clarified the meaning of the technical content. 9/23/2011 18.0 Major Updated and revised the technical content. 12/16/2011 19.0 Updated and revised the technical content. 3/30/2012 20.0 Updated and revised the technical content. 7/12/2012 21.0 Updated and revised the technical content. 10/25/2012 22.0 Major Updated and revised the technical content. 1/31/2013 23.0 Updated and revised the technical content. 8/8/2013 24.0 Major Updated and revised the technical content. 11/14/2013 25.0 Major Updated and revised the technical content. 2/13/2014 26.0 Major Updated and revised the technical content. 5/15/2014 26.0 None No changes to the
meaning, language, or formatting of the technical content. 6/30/2015 27.0 Major Significantly changed the technical content. 10/16/2015 27.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 28.0 Major Significantly changed the technical content.
VERSION The VERSION structure contains Windows version information that SHOULD be ignored. This structure is used for debugging purposes only and its value does not affect NTLM message processing. It is populated in the , , and messages only if NTLMSSP_NEGOTIATE_VERSION is negotiated.<30><31> 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 ProductMajorVersion ProductMinorVersion ProductBuild Reserved NTLMRevisionCurrent ProductMajorVersion (1 byte): An 8-bit unsigned integer that contains the major version number of the Windows operating system in use. This field SHOULD contain one of the following values: Value Meaning WINDOWS_MAJOR_VERSION_5 0x05 The major version of the Windows operating system is 0x05. WINDOWS_MAJOR_VERSION_6 0x06 The major version of the Windows operating system is 0x06. WINDOWS_MAJOR_VERSION_10 0x0A The major version of the Windows operating system is 0x0A. ProductMinorVersion (1 byte): An 8-bit unsigned integer that contains the minor version number of the Windows operating system in use. This field SHOULD contain one of the following values: Value Meaning WINDOWS_MINOR_VERSION_0 0x00 The minor version of the Windows operating system is 0x00. WINDOWS_MINOR_VERSION_1 0x01 The version of the Windows operating system is 0x01. WINDOWS_MINOR_VERSION_2 0x02 The minor version of the Windows operating system is 0x02. WINDOWS_MINOR_VERSION_3 0x03 The minor version of the Windows operating system is 0x03. ProductBuild (2 A 16-bit unsigned integer that contains the build number of the Windows operating system in use. This field SHOULD be set to a 16-bit quantity that identifies the operating system build number. Reserved (3 bytes): A 24-bit data area that SHOULD be set to zero and MUST be ignored by the recipient.
A Abstract data model 39 39 variables 40 39 47 47 variables 48 47 59 15 23 Authentication 55 57 28 C Call flow 14 13 12 15 20 92 Client 39 39 variables 40 39 41 41 47 42 45 42 42 47 42 45 42 42 47 41 70 60 14 13 Cryptographic 82 70 D Data - abstract 39 39 variables 40 39 47 47 variables 48 47 59 E Examples 70 70 69 NTLMv1 authentication 73 73 71 client challenge 76 75 74 NTLMv2 authentication 79 78 77 F 15 G 7 GSS_GetMICEx() 67 67 GSS_UnwrapEx() 66 67 GSS_VerifyMICEx() 67 68 GSS_WrapEx() 65 66 H Higher-layer triggered events 41 48 I
81 81 11 Initialization 41 48 7 K ( 62, 63) L 31 31 Local events 47 55 M Message processing 42 45 42 42 49 54 49 49 Messages 16 16 N 31 17 10 NTLM 12 14 13 69 34 16 36 37 36 NTLMv1 55 71 73 73 client challenge 74 76 75 55 NTLMv2 57 77 79 78 55 34 35 O Other local events 47 55 11 P 81 15 15 85 Protocol Details 39 R 10 11 10 14 30 S SEALKEY ( 62, 64) Security 81 81 58 Sequencing rules 42 45 42 42 49 54 49 49 Server 47 47 variables 48 47 48 48 55 49 54 49 49 55 49 54 49 49 55 48 Session security