6.1.6.9.1.1 LSAPR_AUTH_INFORMATION
The format of the LSAPR_AUTH_INFORMATION structure is as follows.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
LastUpdateTime |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
AuthType |
|||||||||||||||||||||||||||||||
|
AuthInfoLength |
|||||||||||||||||||||||||||||||
|
AuthInfo (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Padding (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
LastUpdateTime (8 bytes): This LARGE_INTEGER value represents the last time that the authentication information was set, in FILETIME format, as specified in [MS-DTYP] section 2.3.
AuthType (4 bytes): This ULONG value dictates the type of AuthInfo that is being stored. There are four values that are recognized by Windows.
-
Possible Values
Meaning
TRUST_AUTH_TYPE_NONE
0
AuthInfo byte field is invalid/not relevant.
TRUST_AUTH_TYPE_NT4OWF
1
AuthInfo byte field contains an RC4 Key [RFC4757].
TRUST_AUTH_TYPE_CLEAR
2
AuthInfo byte field contains a cleartext password, encoded as a Unicode string.
TRUST_AUTH_TYPE_VERSION
3
AuthInfo byte field contains a version number, used by Netlogon for versioning interdomain trust secrets.
AuthInfoLength (4 bytes): A ULONG count of bytes in AuthInfo.
AuthInfo (variable): A BYTE field containing authentication data. Its size is [1...AuthInfoLength].
Padding (variable): Some number of bytes used to align the end of the LSAPR_AUTH_INFORMATION structure to a ULONG boundary. This padding is not included in the AuthInfoLength and consists of zeros.