Windows Protocols Forum

[MS-WMSP] $H and $D packets

Thu, 19 Nov 2009 06:05:31 Z

Hi,

I have the following doubts in [MS-WMSP]
1) Spec says that $D Packet must contain the complete ASF packet. This includes the ASF Header, Data and Index objects.
Why is the ASF Header object sent again in $D packets when it is already sent in $H packet?
2)Why is $H packet sent after both Describe and Play requests?
According to the spec if the URL in the Describe request identifies a server-side playlist, the $H packet MUST pertain to the first entry, or current entry, in the playlist. Same is to be sent as a response to the Play request also. In this case the same packet is sent twice.

Thanks,
Daris

Win7 (SMB1) oplock issues

Sat, 31 Oct 2009 03:04:34 Z

Hi there,

I am observing an issue with Win7 oplock behavior (SMB1 protocol).

Note: i am enforcing SMB1 protocol between Win7 client and Win7 server.

I just copied a file 20MB.doc ( remote write ) from win7 client to win7 server. ( I disabled SMB2 and SMB1 is the protocol used ).
scenario

Win7 client opens the 20mb.doc on Win7 server and acquires a batch oplock
Win7 client writes contents on to the file
Win7 client reads the contest of the file
Win7 client issues QPI File Basic Info request
Win7 server breaks the batch oplock to L2 oplock
Win7 client does seem to ACK the break
Win7 server timed out after 1.2 seconds and responds back to QPI File Basic Info
Win7 closes the handle

Questions

1. Why does a QPI (basic info ) break the batch oplock?

2. Why does win7 client does not respond to break ( batch to L2 ) ?

I have the tcpdump ( 23MB ). I don't know where to attach.

Any help is much appreciated.

MS-RPCE along with PKT_PRIVACY returning SEC_E_MESSAGE_ALTERED

Fri, 06 Nov 2009 07:49:13 Z

I have an RPC question that deals with SSPI. I have written a RPC library for .Net in c#. Everything works pretty well except when the PDU is set with PKT_PRIVACY. This means the stub data is encrypted, and the auth_value is the sec token(I'm guessing) to pass into SSPI's DecryptMessage along with the encrypted stub data. But everytime I call DecryptMessage it returns back with the status SEC_E_MESSAGE_ALTERED. If I pass anything else as the sec token it returns SEC_E_INVALID_TOKEN, so I'm pretty positive I have the token correct. I'm guessing the stub data is incorrect or something.

Anyone think they could shed some light on what I am doing wrong? Or what part of the PDU I am supposed to pass into DecryptMessage.

[MS-CSRA] ICertAdmin::GetCAProperty bugs

Sun, 15 Nov 2009 21:50:12 Z

Hi!
It seems like here is a several bugs in ICertAdmin2::GetCAProperty() that is defined in certadm.dll library.
The issue is associated with following PropID's (as far as I have tested. Perhaps this issue is associated with CR_PROP_CAXCHGCERTCOUNT, nut not tested):

CR_PROP_CASIGCERTCOUNT (0x0b)
CR_PROP_KRACERTUSEDCOUNT (0x18)
CR_PROP_KRACERTCOUNT (0x19)

This method is described in 3.2.5.2.2 ICertAdminD2::GetCAProperty (Opnum 32). All PropID's are described in 3.2.1.4.3.2 ICertRequestD2::GetCAProperty (Opnum 7) and Opnum7 is used for both ICertAdmin2 and ICertRequestD2 interfaces that utilizes the same method. However ICertRequest is defined in certcli.dll library. And the same methods in both interfaces produces different results.

A little info about my test lab CAs
DC1 — Enterprise Root CA with name Contoso CA. Total has 2 CA certificates (renewed) and 1 defined Key Recovery Agent.
DC2 — Entrprise Subordinate CA with name Contoso-DC2-CA. Total has 1 CA certificate and hasn't any defined Key Recovery Agents.

here are examples that shows output using both ICertAdmin2::GetCAProperty() and ICertRequest::GetCAProperty() on both CA servers. All examples provided using Windows PowerShell.

running script on DC1 server using ICertAdmin2 interface:

[Administrator] # instantiate COM object:
[Administrator] $CertAdmin = New-Object -com CertificateAuthority.Admin.1
[Administrator] # retrieve specified properties from local CA:
[Administrator] # we see that CA has 2 signing certificates
[Administrator] $certadmin.GetCAProperty("dc1\contoso ca",0xb,0,1,0)
2
[Administrator] # the same result will be for remote CA:
[Administrator] $certadmin.GetCAProperty("dc2\contoso-dc2-ca",0xb,0,1,0)
2
[Administrator] # now we retrieve all KRA certs count from local CA
[Administrator] $certadmin.GetCAProperty("dc1\contoso ca",0x19,0,1,0)
1
[Administrator] # all ok. And used KRA certs:
[Administrator] $certadmin.GetCAProperty("dc1\contoso ca",0x18,0,1,0)
1
[Administrator] # ok, as mentioned 1 defined KRA.
[Administrator] # however it will return the same numbers for remote CA, where I haven't any KRA certs
[Administrator] $certadmin.GetCAProperty("dc2\contoso-dc2-ca",0x19,0,1,0)
1
[Administrator] $certadmin.GetCAProperty("dc2\contoso-dc2-ca",0x18,0,1,0)
1
[Administrator]

running script on DC2 server:

PS C:\> # instantiate COM object:
PS C:\> $CertAdmin = New-Object -com CertificateAuthority.Admin.1
PS C:\> # retrieve specified properties from local CA:
PS C:\> # we see that CA has 2 signing certificates
PS C:\> $certadmin.GetCAProperty("dc2\contoso-dc2-ca",0xb,0,1,0)
1
PS C:\> # in previous example this line return to us 2 certs. Now we see correct results.
PS C:\> # retrieve the same property from remote CA with 2 certs:
PS C:\> $certadmin.GetCAProperty("dc1\contoso ca",0xb,0,1,0)
1
PS C:\> # wow! Looks like this info is cached. To ensure,now I will retrieve KRA
PS C:\> # certs count from remote CA first:
PS C:\> $certadmin.GetCAProperty("dc1\contoso ca",0x19,0,1,0)
0
PS C:\> $certadmin.GetCAProperty("dc1\contoso ca",0x18,0,1,0)
0
PS C:\> # in previous example we saw that DC1 has 1 defined KRA. Also we saw that DC2 has 1
PS C:\> # defined KRA (that is not true). Now we see correct info:
PS C:\> $certadmin.GetCAProperty("dc2\contoso-dc2-ca",0x19,0,1,0)
0

now we examine the same properties using ICertRequest interface that will show correct results in both cases.

running script from DC1

[Administrator] $request = New-Object -com CertificateAuthority.Request.1
[Administrator] $request.GetCAProperty("dc1\contoso ca",0xb,0,1,0)
2
[Administrator] $request.GetCAProperty("dc2\contoso-dc2-ca",0xb,0,1,0)
1
[Administrator] $request.GetCAProperty("dc1\contoso ca",0x19,0,1,0)
1
[Administrator] $request.GetCAProperty("dc1\contoso ca",0x18,0,1,0)
1
[Administrator] $request.GetCAProperty("dc2\contoso-dc2-ca",0x19,0,1,0)
0
[Administrator] $request.GetCAProperty("dc2\contoso-dc2-ca",0x18,0,1,0)
0
[Administrator]

and correct results from DC2 server:

 PS C:\> $request = New-Object -com CertificateAuthority.Request.1
PS C:\> $request.GetCAProperty("dc2\contoso-dc2-ca",0xb,0,1,0)
1
PS C:\> $request.GetCAProperty("dc1\contoso ca",0xb,0,1,0)
2
PS C:\> $request.GetCAProperty("dc1\contoso ca",0x19,0,1,0)
1
PS C:\> $request.GetCAProperty("dc1\contoso ca",0x18,0,1,0)
1
PS C:\> $request.GetCAProperty("dc2\contoso-dc2-ca",0x19,0,1,0)
0
PS C:\> $request.GetCAProperty("dc2\contoso-dc2-ca",0x18,0,1,0)
0
PS C:\>

it is real bug in ICertAdmin2 interface for me. thanks!

http://www.sysadmins.lv

[MS-CSRA] ICertAdmin::SetCAProperty() issue

Sun, 15 Nov 2009 12:40:38 Z

I have an issue with ICertAdmin::SetCAProerty() (Opnum 33): http://msdn.microsoft.com/en-us/library/aa383252(VS.85).aspx
I'm trying to use this method to add new KRA certificates to CA and with no success. Method states that certificate must be in ASN1 DER encoded format. However I don't know how to figure it. Here are my examples (in PowerShell):

$CertAdmin = new-object -com certificateauthority.admin.1
# read KRA certificate file to byte array
$Cert = [System.IO.File]::ReadAllBytes("kra.cer")
# now I try to write this info to CA:
$CertAdmin.SetCAProprty("servername\caname",0x1A,0,3,$Cert
# and what I get in output:

PS C:\> $CertAdmin = New-Object -com Certificateauthority.admin.1
PS C:\> $Cert = [System.IO.File]::ReadAllBytes("kra.cer")
PS C:\> # $Cert variable is a byte array with 1644 bytes. The same array is stored in AD under KRA objects
PS C:\> $cert.count
1644
PS C:\> # see array first 10 elements
PS C:\> $cert[0..9]
48
130
6
104
48
130
5
80
160
3
PS C:\> $CertAdmin.SetCAProperty("dc2\contoso-dc2-ca",0x1a,0,3,$cert)
Exception calling "SetCAProperty" with "5" argument(s): "CCertAdmin::SetCAProperty: The parameter is incorrect. 0x80070
057 (WIN32: 87)"
At line:1 char:25
+ $CertAdmin.SetCAProperty( <<<< "dc2\contoso-dc2-ca",0x1a,0,3,$cert)

ok, perhaps this is not DER encoded byte array. I try to retrieve KRA certificate in binary format from another CA and put it to particular CA:

PS C:\> $kra = $CertAdmin.GetCAProperty("dc1\contoso ca",0x1a,0,3,4)
PS C:\> $kra
30 82 06 68 30 82 05 50  a0 03 02 01 02 02 0a 15
1d 16 60 00 00 00 00 00  04 30 0d 06 09 2a 86 48
86 f7 0d 01 01 05 05 00  30 43 31 13 30 11 06 0a
09 92 26 89 93 f2 2c 64  01 19 16 03 63 6f 6d 31
17 30 15 06 0a 09 92 26  89 93 f2 2c 64 01 19 16
07 63 6f 6e 74 6f 73 6f  31 13 30 11 06 03 55 04
03 13 0a 43 6f 6e 74 6f  73 6f 20 43 41 30 1e 17
0d 30 39 30 32 31 35 31  35 30 35 32 35 5a 17 0d
31 31 30 32 31 35 31 35  30 35 32 35 5a 30 56 31
13 30 11 06 0a 09 92 26  89 93 f2 2c 64 01 19 16
<...>

now I need to split this string to byte array:

PS C:\Users\administrator.CONTOSO> $kra = $kra.split(" ")
PS C:\> $kra.count
1645
PS C:\> $kra[0..9]
30
82
06
68
30
82
05
50

a0
PS C:\> $CertAdmin.SetCAProperty("dc2\contoso-dc2-ca",0x1a,0,3,$kra)
Exception calling "SetCAProperty" with "5" argument(s): "CCertAdmin::SetCAProperty: The parameter is incorrect. 0x80070
057 (WIN32: 87)"
At line:1 char:25
+ $CertAdmin.SetCAProperty( <<<< "dc2\contoso-dc2-ca",0x1a,0,3,$kra)

How can I get proper ASN1 DER encoded byte array from certificate files or existing certificates that can be retrieved using GetCAProperty? This doesn't matter for PowerShell, I just need methodics..

any help will be gratly appreciated!

http://www.sysadmins.lv

MSDN Release Notes - October 2009

Wed, 18 Nov 2009 02:10:16 Z

This release contains updates made to protocol documents since the last release. The following new documents have been added to the document set:

· Microsoft Communications Protocol Program (MCPP) Documents: MS-CIFS and MS-WFIM

· Work Group Server Protocol Program (WSPP) Documents: MS-CIFS

· Application Services and .NET Framework Protocols: MS-AXDS, MS-FTPS, MS-QLPB, MS-RNDIS, MS-WSPOL, and MS-WSSEC.

Preview versions of the following new documents are located on the Preview Specifications node:

· MS-DISO, MS-FSA, and MS-WSO

The following known issues exist in the October, 2009 release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

Map network drive as a Windows Share

Wed, 21 Oct 2009 22:27:52 Z

I've got a network drive, that is in its nature an SSH accessed directory on Linux machine. Now I need to make a Windows Share on it. Any help would be appreciated. Regards, DI

Licensing inquiry

Tue, 20 Oct 2009 17:56:40 Z

I am interested if there is a web tool in MSDN that will allow me to see the number of activations I have for the products I am priviliged to download and use. Also, I am looking for specific documentation on what I am allowed to download...the products and the # of instances of them if multiple is allowed.

MSDN Release Notes - August 2009

Tue, 13 Oct 2009 21:03:35 Z

This release contains updates made to protocol documents since the last release. The following new documents have been added to the document set:

· Overview Documents: MS-AUTHSO, MS-CAESO, MS-CSSO, MS-FSSO, MS-MSSO, MS-NAPSO, and MS-PSSO

· Microsoft Communications Protocol Program (MCPP) Documents: MS-DCHT and MS-DCLB

The following known issues exist in the August, 2009 release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

S4U2SELF and 2 way trust.

Wed, 16 Sep 2009 22:50:00 Z

I read in some of the forums that a 2 way trust is required for the S4U2SELF to work.

For .e.g. if I have an environment where I have 2 forests.

Forest 1 -----> Domain A

Forest 2 -----> Domain B

and there is a one way outgoing trust between the Domain A and Domain B. Because of the trust Domain B users can access the resources in Domain A but not the vice versa.

Can I use the S4U2Self in this environment where the service is part of domain A and is trying to impersonate the Users from Domain B?

Constrained Delegation : Can Service A decrypt service B’s service ticket ?

Mon, 27 Jul 2009 18:33:27 Z

Hi There,

I was going through the MS-SFU ( Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol Specification) document and I need some help in understanding Constrained Delegation (S4U2Proxy) better.

[ Section 5 Security Considerations

The S4U2proxy extension allows a service to obtain a service ticket to a second service on behalf of a user. When combined with S4U2self, this allows the first service to impersonate any user principal while accessing the second service. This gives any service allowed access to the S4U2proxy extension a degree of power similar to that of the KDC itself.]

Here is the scenario

1. Constrained delegation is configures in Win2003 AD domain Controller for the user “Proxy” and proxy service “A”.

2. Service A acquires its service ticket on behalf of the user U ( using S4U2Self)

3. Service A also acquires the service ticket for Service B on behalf of the user U ( using S4U2proxy).

Here is my question

1. Can Service A decrypt service B’s service ticket ?

2. If yes, how will service A get the service key of service B ?

Regards,

Mohan

MSDN Release Notes - June 2009

Wed, 19 Aug 2009 22:27:12 Z

This release contains updates made to protocol documents since the last release. The following new documents have been added to the document set:

· Overview Documents: MS-RMSO and MS-WSUSO

· Microsoft Communications Protocol Program (MCPP) Documents: MS-NBTE, MS-TSRV, and MS-WSTC

· Work Group Server Protocol Program (WSPP) Documents: MS-NBTE

· Application Services and .NET Framework Protocols: MS-PROPSTORE, MS-SHLLINK, and MS-WDSOSD

The following known issues exist in the June, 2009 release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

ActiveX Controls

Thu, 09 Jul 2009 15:08:24 Z

Hi, I am trying to embed an activex control (.ocx) created using VB6.0. It's a bare bones usercontrol with no extra code, just for testing purposes. But when I embed this control in one of our windows forms in our legacy development environment (Gupta Centura V3.1), running as an MDI child in an MDI context, the main menu bar of our runtime MDI disappears. And to get it back we have to close the container form. I think this to be a bug our development environment, not to support generic cases of activex controls. But the same program when built with some other standard ocx shipped with MS OFFICE 11 (MSCAL.OCX) works all fine and the MDI menu bar stays without any problem. I have checked with all the possible combinations in VB project settings and also from OLE/COM viewer, without any luck. Can someone suggest me if there is anything else that I could do to make it appear to be similar to MSCAL.OCX in order to avoid my MDI menu disappearing once thefocus is passed to the usercontrol? Pls don't tell me to go for MFC or ATL, since this is supposed to be a highly RAD type of work. Thanks.

[MS-DNSP] 4.4 Enumerating Zones ... is there a typo here?

Fri, 05 Jun 2009 18:28:28 Z

LTNS, guys.

I was reading up on MS' DNS implementation and saw that the third parameter used by the function discussed on this page was described as:

"A Unicode string containing the FQDN of the DNS server on which the zone is to be created."

However, the topic is about enumerating zones, not creating them (which was the subject of 4.3), so I'm thinking that this probably should read "[...] of the DNS server to be queried for the zone data" or something like that? If not, I'm unclear as to why a zone would be created in the context of being enumerated.
--
* Helen *

MSDN Release Notes - April 2009

Thu, 11 Jun 2009 05:00:26 Z

This release contains updates made to protocol documents since the last release. The following new documents have been added to the document set:

· Overview Documents: MS-TSSO and MS-WMSO

· MCPP Document: MS-PTPT

· Application Services and .NET Framework Documents: MS-WDSMA, MS-WDSMSI, and MS-WDSMT

The following known issues exist in the April, 2009 release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

[MS-DNSP] 2.1.1 Server Security Settings - possible incorrect and not-clickable link to MS-RPCE

Fri, 05 Jun 2009 18:46:52 Z

The second to last sentence on this page states:

"The DNS server SHOULD support the maximum number of concurrent calls supported by RPC, as specified in section 3.3.1.5.9 in [MS-RPCE]."

1. The link is not hot
2. When I manually navigate there, I don't see information about the maximum number of concurrent calls supported by RPC, so I'm not sure this is the right topic to link to

--
* Helen *

snmp

Tue, 02 Jun 2009 13:17:18 Z

snmp oid to read the mac address corresponding to switch port

Array and its size in EcDoRpcExt2

Sat, 25 Apr 2009 01:50:39 Z

Hi all,

I was trying to parse this MSRPC function in Wireshark-

long __stdcall EcDoRpcExt2(
[in, out, ref] CXH * pcxh, [in, out] unsigned long *pulFlags,
[in, size_is(cbIn)] unsigned char rgbIn[],
[in] unsigned long cbIn, <br/>
[out, length_is(*pcbOut), size_is(*pcbOut)] unsigned char rgbOut[],
[in, out] BIG_RANGE_ULONG *pcbOut, <br/>
[in, size_is(cbAuxIn)] unsigned char rgbAuxIn[],
[in] unsigned long cbAuxIn, [out, length_is(*pcbAuxOut), size_is(*pcbAuxOut)] unsigned char rgbAuxOut[],
[in, out] SMALL_RANGE_ULONG *pcbAuxOut,
[out] unsigned long *pulTransTime
);

I'm stuck trying to parse

[in, size_is(cbIn)] unsigned char rgbIn[],<br/>
[in] unsigned long cbIn,

The problem I see is that we first have the array and then the length. I searched the forums and found the following related link-
http://social.msdn.microsoft.com/Forums/en-US/os_exchangeprotocols/thread/de1da50c-dcaa-4239-9fba-4198afa2ddd8/

I did a quick read of the relevant part of DCE RPC specs, but in all the cases I saw it always had the size and then the array. In these cases it is trivial to use the size for extracting the array contents.

I'm sure it is not a typo in the spec, so clearly I'm missing something. Can someone please clarify how to parse the array field ?

Any pointers/ suggestions/ hints welcome.

Many thanks,
Harsha

[MS-OXORMMS] Incorrect reference

Sat, 25 Apr 2009 10:11:53 Z

Hi,

MS-OXORMMS v2.0 Section 5 makes reference to [MS-OXRMPR]. That probably should be [MS-RMPR].

Brad

Can I interrupt a synchronous RPC call from within the client?

Wed, 22 Apr 2009 12:00:21 Z

I'd prefer as little change to the server as possible. Is there a function that just tells the client to interrupt all its RPC calls?

MSDN Release Notes - March 2009

Thu, 16 Apr 2009 16:39:47 Z

This release contains updates made to protocol documents since the last release. The following new documents have been added to the document set:

· Overview Documents: MS-GPSO and MS-MGSO

· Application Services and .NET Framework Protocols: MC-APDSU, MC-CSDL, MC-EDMX, MC-MQDSRP, and MS-WDSC

In addition, [MS-NETCEX] is now called [MC-NETCEX].

The following known issues exist in the March, 2009 release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

ADAM proxy object add - error 8358

Thu, 09 Apr 2009 15:31:55 Z

Hello,

I am getting an error when trying to add a proxy object in ADAM, using instructions on this page: http://technet.microsoft.com/en-us/library/cc784622.aspx. The test setup is as follows:

AD and ADAM are installed on 2 separate Windows 2003 server hosts. The AD test user account "testuser1" is in an AD domain that is in the same forest as the domain of the ADAM host. The SID of testuser1 is S-1-5-21-2767564697-1885188838-431979746-87783 (as given by dsquery user -samid testuser1 | dsget user -sid). The ADAM instance has a custom objectclass "testproxyclass", which has the following attribute in its LDIF create definition:
systemAuxiliaryClass: msDS-BindProxy

I am using an account with full Admin rights and privileges to bind to ADAM. I tried adding the testuser1 proxy object using LDIFDE with an LDIF file using Base64-encoded binary SID value, and also using LDP using the string representation of the SID. In both cases, I get the same error.

LDIF file =>
dn: cn=testuser1,o=testorg,c=US
changetype: add
objectclass: testproxyclass
cn: testuser1
objectSid:: AQUAAAAAAAUVAAAAma/1pOayXXDifL8Z51YBAA==

LDP Add Child =>
objectclass: testproxyclass
cn: testuser1
objectSid: S-1-5-21-2767564697-1885188838-431979746-87783

Error =>
ldap_add_s(ld, "cn=testuser1,o=testorg,c=US", [3] attrs)
Error: Add: Unwilling To Perform. <53>
Server error: 000020E7: SvcErr: DSID-03152AA9, problem 5003 (WILL_NOT_PERFORM), data 8358

Error 0x20E7 The modification was not permitted for security reasons.

I looked up the error code 8358, it means "It is not permitted to add an attribute which is owned by the system". This is very confusing since the ADAM bind proxy mechanism should allow adding objectSID at create time.

After getting the error, I tried granting all permissions explicitly on objectSid attribute for testproxyclass to the ADAM bind user. I also checked that within the same LDP session, the SID lookup menu option resolves the SID correctly to testuser1. Nothing seems to work and the error persists.

Can someone please help me to resolve this error?

Thank you!!!

MSDN Release Notes - January 2009 (posted 02-04-09)

Wed, 18 Mar 2009 15:44:59 Z

This release contains updates made to protocol documents since the last release.

Windows Server Protocols (WSPP) contains the following new specification:

· [MS-CSSP]: Credential Security Support Provider (CredSSP) Protocol

The following known issues exist in the January, 2009 Release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

Windows Vista Clients' use of LDAP Protocol

Thu, 25 Sep 2008 03:30:30 Z

MS-ADTS - Active Directory Technical Specification Section 7.4.1 - State of a Machine Joined to a Domain documents the required state of a machine that is joined to a domain. Further, it is possible to use LDAP for joining domain; more broadly, any protocol may be used so long as it satisfies the end-state requirements outlined in MS-ADTS section 7.4.2. SAMR or LDAP are the most likely protocol choices.

can Windows Vista client use LDAP protocol for joing domain?

Issue in monitoring LWF filter driver returning ERROR_GEN_FAILURE

Wed, 04 Mar 2009 15:09:14 Z

According to the NDIS documentation only Monitoring LWF driver is able to bind below NDIS IM driver thus Bypassing NDIS IM driver.

So I developed Monitoring LWF based on WDK sample.

I am able to install filter driver and the service is up and running.

Next step is to support IOCTL set/Query.

DispatchTable[IRP_MJ_DEVICE_CONTROL] = FilterDispatch;

In FilterDispatch we switch according to IRP_MJ_DEVICE_CONTROL to FilterDeviceIoControl method.

In FilterDeviceIoControl depend upon IrpSp->Parameters.DevideIoControl.IoControlCode

We switch to either IOCTL_FILTER_SET_OID_VALUE or IOCTL_FILTER_QUERY_OID_VALUE

We do NDIS_OID_REQUEST packet and send via NdisFOidRequest()

The issue is we get status as Error 31 – A device attached to the system is not functioning.

Rathan Raj

gss_wrap token size (Kerberos and rc4-hmac)

Wed, 21 Jan 2009 22:15:13 Z

I have some troubles to use the data encryption feature described in [MS-WSMV] to send data to WinRM service from my Linux based application. Comparing with the same message sent by the Windows winrm command line utility program, my encrypted data length is 4 bytes short. I followed the instructions in MS-WSMV, RFC 4757 and RFC 4121, and could not figure out where the extra 4 bytes come from?

The plain text message length is 198. The encrypted data sent by winrm is 258 bytes (60 extra bytes). And I expect the encrypted data length is 254 (56 extra bytes).

Here is how I get the extra 56 bytes,

1. RFC 4757 section 5 adds 24 bytes to the message.

2. RFC 4121 section 4.2.4 adds 32 bytes to the message.

The total extra bytes are 56.

I provide the network trace below.

Thanks for your help,

HW

----------------------------
Example,

Plain text message sent by winrm command line utility

0000 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e <s:Envelope xmln

0010 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e s:s="http://www.

0020 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 w3.org/2003/05/s

0030 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d oap-envelope" xm

0040 6c 6e 73 3a 77 73 6d 69 64 3d 22 68 74 74 70 3a lns:wsmid="http:

0050 2f 2f 73 63 68 65 6d 61 73 2e 64 6d 74 66 2e 6f //schemas.dmtf.o

0060 72 67 2f 77 62 65 6d 2f 77 73 6d 61 6e 2f 69 64 rg/wbem/wsman/id

0070 65 6e 74 69 74 79 2f 31 2f 77 73 6d 61 6e 69 64 entity/1/wsmanid

0080 65 6e 74 69 74 79 2e 78 73 64 22 3e 3c 73 3a 48 entity.xsd"><s:H

0090 65 61 64 65 72 2f 3e 3c 73 3a 42 6f 64 79 3e 3c eader/><s:Body><

00a0 77 73 6d 69 64 3a 49 64 65 6e 74 69 66 79 2f 3e wsmid:Identify/>

00b0 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 </s:Body></s:Env

00c0 65 6c 6f 70 65 3e elope>

The same message encrypted (the bold part) and sent by winrm command line utility

0000 2d 2d 20 45 6e 63 72 79 70 74 65 64 20 42 6f 75 -- Encrypted Bou

0010 6e 64 61 72 79 0d 0a 09 43 6f 6e 74 65 6e 74 2d ndary...Content-

0020 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f Type: applicatio

0030 6e 2f 48 54 54 50 2d 53 50 4e 45 47 4f 2d 73 65 n/HTTP-SPNEGO-se

0040 73 73 69 6f 6e 2d 65 6e 63 72 79 70 74 65 64 0d ssion-encrypted.

0050 0a 09 4f 72 69 67 69 6e 61 6c 43 6f 6e 74 65 6e ..OriginalConten

0060 74 3a 20 74 79 70 65 3d 61 70 70 6c 69 63 61 74 t: type=applicat

0070 69 6f 6e 2f 73 6f 61 70 2b 78 6d 6c 3b 63 68 61 ion/soap+xml;cha

0080 72 73 65 74 3d 55 54 46 2d 38 3b 4c 65 6e 67 74 rset=UTF-8;Lengt

0090 68 3d 31 39 38 0d 0a 2d 2d 20 45 6e 63 72 79 70 h=198..-- Encryp

00a0 74 65 64 20 42 6f 75 6e 64 61 72 79 0d 0a 09 43 ted Boundary...C

00b0 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 ontent-Type: app

00c0 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 lication/octet-s

00d0 74 72 65 61 6d 0d 0a 3c 00 00 00 05 04 06 ff 00 tream..<........

00e0 00 00 1c 00 00 00 00 1b 81 53 ef b7 a6 4c c8 6f .........S...L.o

00f0 32 8b 0e 84 79 af be ae 2c 0c 3f 04 02 34 1f 08 2...y...,.?..4..

0100 f7 fe aa 8a bc ce 71 f3 13 63 02 11 33 8a 5a c4 ......q..c..3.Z.

0110 2f 77 88 59 30 37 20 d1 fe f9 db b3 b9 eb ad 52 /w.Y07 ........R

0120 28 27 92 8a 13 e3 83 aa 02 ae 04 eb 39 68 90 f1 ('..........9h..

0130 01 2e 25 6d 32 b5 a8 09 f5 1d bd ae da 05 e4 a0 ..%m2...........

0140 3f a0 b9 e4 f8 29 37 b5 09 79 13 44 a2 a8 1c 06 ?....)7..y.D....

0150 4d 6e 66 a9 3b 63 e1 6b c2 58 48 41 27 f6 e5 ae Mnf.;c.k.XHA'...

0160 c1 cb 3d ee a6 0d 50 73 49 4f 51 9f 1b a7 67 ee ..=...PsIOQ...g.

0170 75 61 98 a7 42 ea 3f fd b9 74 d1 fe 29 24 b6 e0 ua..B.?..t..)$..

0180 3c 65 e7 cc 3f 0b e3 3c 7b ee fe cd 92 05 42 0e <e..?..<{.....B.

0190 ce 3d 40 9d 30 45 cc 12 3d 4e f8 73 1f 41 df e0 .=@.0E..=N.s.A..

01a0 81 6e 64 f6 34 fd 66 dd 51 df 57 5c 72 01 cf 3f .nd.4.f.Q.W\r..?

01b0 8f 79 cd c9 3e 61 50 2e 89 73 4b ae d2 6b 33 26 .y..>aP..sK..k3&

01c0 83 f0 d4 31 8e 12 ef 14 04 11 b6 e4 02 a4 95 61 ...1...........a

01d0 b2 c2 cb da 9f b8 3a dc b1 2d 59 9b a2 2d 2d 20 ......:..-Y..--

01e0 45 6e 63 72 79 70 74 65 64 20 42 6f 75 6e 64 61 Encrypted Bounda

01f0 72 79 0d 0a ry..

[MS-LCID] Language / Country for 0x2801?

Sun, 01 Feb 2009 02:13:04 Z

Hi,

I'm looking at MS-LCID, v20090114 Section 2.2

It shows this:
0x2801 tk-TM
should that be ar-SY?

(I note that tk-TM is also shown with a language code of 0x0442).

Brad

[MS-LCID] Tag for Afrikaans

Sat, 31 Jan 2009 23:59:13 Z

Hi,

I'm looking at MS-LCID, v20090114, Section 2.2.

It shows this:
0x0436 Af-ZA
should that be af-ZA? (i.e. language in lower case)

Brad

MSDN Release Notes — December 2008 (posted on 01-07-09)

Wed, 18 Feb 2009 16:48:14 Z

MSDN Release Notes — December 2008

This release includes document changes made since the previous release. A major change for this release is the addition of new protocol documents for Windows 7 Beta 1. This release also contains a new version of [MS-SMB2]: Server Message Block (SMB) Version 2 Protocol Specification.

Issues specific to the December release include:

1. References to [MS-SMB2] are not consistent in the document set with respect to identifying the version of the protocol. All references will be changed from Version 2.0 to Version 2 for the January release.

2. Links to [MS-SMB] and [MS-SMB2] do not work in certain specific contexts—for example, when they appear in [MS-REF] or in Section 1.2 References within some protocol specifications. The January release will contain working links.

The following known issues exist in the December Release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.
2. In the Categories list, click Documents.
3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

MAXOBJIDSIZE in winshmp.h

Tue, 10 Feb 2009 17:46:57 Z

Hi,

Is there a way to work with OIDs that have greater than 128 components.
MAXOBJIDSIZE in winshmp.h limits this to 128.

I have an OID :

>>1.3.6.1.4.1.2272.1.69.19.1.2.32.84.82.71.45.49.80.82.73.45.84.79.82.67.79.86.48.48.80.80.56.45.84.79.82.67.79.86.57.52.80.80.54

The "1.3.6.1.4.1.2272.1.69.19.1.2" part points to the leaf and rest is the Index.

When I use SnmpStrToOid() on this OID, following error is generated:

>> Failed to convert string into OID: Snmp Error = 11

Error 11 is "SNMP_ERROR_NOCREATION"

Any ideas ??

Thanks

MS-TDS AcceptSecurityContext

Sat, 31 Jan 2009 10:22:12 Z

Hello,

What parameters should our server use for AcquireCredentialsHandle and AcceptSecurityContext when processing the PreLogin TLS exchange from clients? For example, principle name or NULL, NTLMSP_NAME, ASC_REQ_STREAM, SECURITY_NATIVE_DREP, etc.

Thanks for your help.

MSDN Release Notes - November 2008 (released 11-10-08)

Wed, 04 Feb 2009 16:24:24 Z

This release includes document changes made since the September release. A major change for this release is the addition of new protocol documents:

Windows Communication Protocols (MCPP): MS-CTAP, MS-HNDS, MS-L2TPIE, MS-LLMNRP, and MS-TLSP.
Windows Server Protocols (WSPP): MS-ADFWAP, MS-CTAP, MS-LLMNRP, MS-MFPP, MS-SCMP, and MS-TLSP.

Note: Two specifications in this release, MS-CTAP and MS-MWBF contain preliminary content for the release code-named Geneva.

The following known issues exist in the MSDN November 2008 Release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two PDF pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

Note: Links in the PDFs don’t resolve in Adobe Reader 9 because Adobe has changed the default setting for view mode in Adobe Reader 9. To access links, perform the following procedure:

1. In Adobe Reader 9, go to the Edit menu and click Preferences.

2. In the Categories list, click Documents.

3. Under PDF/A View Mode, change the selection from Only for PDF/A documents to Never, and click OK.

Additional details on changing the setting can be located via the Adobe help site: http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS3E0E8467-B787-4020-A1D3-6BC762A42DF2.w.html

MSDN Release Notes — September 2008 (released 9-16-08)

Wed, 04 Feb 2009 16:22:42 Z

MSDN Release Notes — September 2008

MSDN Release Notes for September

This release includes document changes made since the previous release. A major change for this release is the addition of Active Directory Schema attributes and classes in section 2 in protocol specifications where that information applies.

The following known issues exist in the MSDN September Release:

Underscore characters are not always visible in code in the PDF files depending on the magnification selected by the user. Those characters are present in printed versions.
Information in a table row may split across two PDF pages.
Table borders are not always visible depending upon the magnification selected by the user. Borders are present in printed versions of the PDF.
Cross-protocol links are only functional when the PDF files for the protocols are in the same folder.

LDAP Triggering My PC to be at Top Firewall Denial Report

Fri, 30 Jan 2009 14:25:47 Z

Im running Server 2003 Active Directory enviroment, with Win Xp computers. My PC is the only Vista(business) client.

On our our Daily Firewall denial report...My pc has been at the top of the list.

The total denial count for my pc is reaching 931, Port 389, Description Lightweight Directory Access Protocol

So my is How can I determine what Application is triggering the use of LDAP on my Vista PC?

My VP has continued to ask me and I need to find an explanation.

Virus scans detect nothing, but I am runninf Symantec EndPoint Protection on my PC, It installed in its entirety not Install or manged from a Server because of version we are runnning. I need to update or version of symantec to be able to deploy to vista pc's....

any help woulkd be great

thanx

APDU - iClass - Contactless

Mon, 26 Jan 2009 15:33:20 Z

I am using an OmniKey Prox Reader and currently through code I acknowledge if the card is present or not.

However, I would like to read the card number which is stored on the card in an unknown location.

Therefore, I need an APDU command which will read the cards contents.

I am having trouble understanding the following document.

CardMan 5x21-CL Reader Developer’s Guide

Everything is possible for him who believes.

Inconsistent key exchange key in [MS-NLMP]

Thu, 23 Oct 2008 22:34:11 Z

[MS-NLMP] section 4.2.3 uses NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY, and lists session base key in 4.2.3.1.2 as

0000000: d8 72 62 b0 cd e4 b1 cb 74 99 be cc cd f1 07 84 .rb.═...t.......

and lists the key exchange key in section 4.2.3.1.3 as

0000000: eb 93 42 9a 8b d9 52 f8 b8 9c 55 b8 7f 47 5e dc ..B...R...U..G..

Section 3.4.5.1 says that “If NTLM v2 session security is negotiated, the key exchange key MUST be the 128-bit session base key.”

If 3.4.5.1 is correct, should the key exchange key and session base key above be the same?

Thanks,

HW

Not able to connet Server through RDC

Wed, 21 Jan 2009 06:44:00 Z

Dear All,

I restart my Server because I was not able to get any shared folder on server. After restarting it problem is solve but now I am not able to get remote desktop connection from anywhere. Though I am able to ping and getting all shared folder of that server.

I re-added administrator user as remote desktop user.
OS is windows 2003 enterprise edition 64 bit.

Please help me how i can solve this problem.

Warm Regards,

Pramod Mishra

ldap filter

Mon, 12 Jan 2009 13:13:30 Z

Hello,

lets say I have users who are members of many groups and some of those groups are members of specific group (lets say "group1"). How to write ldap filter to get all users who are members of groups which are member of "group1"? "(&(objectClass=user)(memberOf=CN=group1,OU=recipients,DC=second_domain,DC=domain))" - this filter doesn't work, because, as I guess, this filter looks users who are members of "group1". How can I "extend" this filter, that it worked corectly?
Can anybody help me?

Thanks in advance.

[RDPBCGR] What library you use for RC4() and InitRC4().

Mon, 15 Dec 2008 19:38:28 Z

Thanks John,

That helps a lot.

I still have one question for you. The following red words quoted from your last reply.
**************************************************
S-TableEncrypt = InitRC4(TempKey128)

RC4 is then used to encrypt TempKey128 to obtain the new 128-bit encryption key.

NewEncryptKey128 = RC4(TempKey128, S-TableEncrypt)

Finally, the associated RC4 substitution table is reinitialized with the new encryption key (NewEncryptKey128) which can then be used to encrypt a further 4096 packets.

S-Table = InitRC4(NewEncryptKey128)
***************************************************
What library you use for RC4() and InitRC4(). I only found the RC4() in "openssl/rc4.h". But there is no definitiion for InitRC4(). Where can I find the definition of InitRC4()? Any library could I use for it?

Thanks,
Bill

[RDPBCGR] location for spec file [APPLIED-CRYPTO]

Mon, 15 Dec 2008 19:43:52 Z

Hi John,

How and where can I find the spec file [APPLIED-CRYPTO]?

Thanks,
Bill