6.1.6.9.1.1 LSAPR_AUTH_INFORMATION
The format of the LSAPR_AUTH_INFORMATION structure is as follows.
|
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
1 0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
2 0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
3 0 |
1 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
LastUpdateTime |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
AuthType |
|||||||||||||||||||||||||||||||
|
AuthInfoLength |
|||||||||||||||||||||||||||||||
|
AuthInfo (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Padding (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
-
LastUpdateTime (8 bytes): This LARGE_INTEGER value represents the last time that the authentication information was set, in FILETIME format, as specified in [MS-DTYP] section 2.3.
-
AuthType (4 bytes): This ULONG value dictates the type of AuthInfo that is being stored. There are four values that are recognized by Windows.
-
Possible Values Meaning TRUST_AUTH_TYPE_NONE
0AuthInfo byte field is invalid/not relevant.
TRUST_AUTH_TYPE_NT4OWF
1AuthInfo byte field contains an RC4 Key [RFC4757].
TRUST_AUTH_TYPE_CLEAR
2AuthInfo byte field contains a cleartext password, encoded as a Unicode string.
TRUST_AUTH_TYPE_VERSION
3AuthInfo byte field contains a version number, used by Netlogon for versioning interdomain trust secrets.
-
AuthInfoLength (4 bytes): A ULONG count of bytes in AuthInfo.
-
AuthInfo (variable): A BYTE field containing authentication data. Its size is [1...AuthInfoLength].
-
Padding (variable): Some number of bytes used to align the end of the LSAPR_AUTH_INFORMATION structure to a ULONG boundary. This padding is not included in the AuthInfoLength and consists of zeros.
