Calling NetrLogonSamLogonEx

The client MUST do the following:

If the NegotiateFlags bit V is not set, then the read-only domain controller (RODC) SHOULD NOT set ExtraFlags C or D.

If the NegotiateFlags bit P is set, then the client SHOULD convert:

  • NetlogonInteractiveInformation to NetlogonInteractiveTransitiveInformation

  • NetlogonNetworkInformation to NetlogonNetworkTransitiveInformation

  • NetlogonServiceInformation to NetlogonServiceTransitiveInformation

If the NegotiateFlags bit G is not set and LogonLevel is not NetlogonGenericInformation, then the ValidationLevel parameter MUST be set to 2 (NETLOGON_VALIDATION_SAM_INFO (section

The LogonLevel, LogonInformation, ValidationLevel, and ValidationInformation parameters are specified in [MS-APDS] for NTLM, Kerberos, and Digest, and in [MS-RCMP] for TLS/SSL.

To call for Generic-Passthrough to authentication packages, the LogonLevel parameter MUST be set to 4 (NetlogonGenericInformation), and the ValidationLevel parameter MUST be set to 5 (NetlogonValidationGenericInfo2). The LogonInformation parameter MUST be a NETLOGON_GENERIC_INFO structure, as specified in section

After the method returns, the client MUST:

  • If the LogonLevel is NetlogonNetworkInformation or NetlogonNetworkTransitiveInformation, the client MUST decrypt the UserSessionKey and the first two elements of the ExpansionRoom array in the NETLOGON_VALIDATION_SAM_INFO (section or in the NETLOGON_VALIDATION_SAM_INFO2 (section structure.

  • Verify that it received an authoritative response by checking the Authoritative parameter. If the Authoritative parameter is TRUE, the client MUST treat the result as final. If the Authoritative parameter is FALSE, the client SHOULD retry the call at a later time or at a different domain controller.

On receiving STATUS_ACCESS_DENIED, the client SHOULD re-establish the secure channel with the DC. <133>