3.5.3 Initialization

  • Article

The server side registers an endpoint with RPC over named pipes transport, using the NETLOGON named pipe<132> and an endpoint with RPC over TCP/IP. When DCRPCPort is present and is not NULL, and the server is a domain controller, then the DC MUST also register the port listed in DCRPCPort ([MS-RPCE] section 3.3.3.3.1.4). The server side MUST register the Netlogon security support provider (SSP) authentication_type constant [0x44] as the security provider ([MS-RPCE] section 3.3.3.3.1.3) used by the RPC interface.

NetlogonSecurityDescriptor: Initialized to the following value, expressed in Security Descriptor Description Language (SDDL) ([MS-DTYP] section 2.5.1): D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

ChallengeTable MUST be empty.

ClientSessionInfo MUST be empty.

RefusePasswordChange SHOULD be FALSE.

The ServerCapabilities field is initialized to reflect the capabilities offered by that server implementation.

RejectMD5Clients SHOULD<133> be initialized in an implementation-specific way and set to TRUE.

SealSecureChannel MUST be TRUE.

SignSecureChannel SHOULD<134> be initialized in an implementation-specific way and set to TRUE. Any changes made to the SignSecureChannel registry keys are reflected in the ADM elements when a PolicyChange event is received (section 3.1.6). This setting is deprecated, as SealSecureChannel MUST be true.

StrongKeySupport SHOULD<135> be TRUE.

NetbiosDomainName is a shared ADM element with DomainName.NetBIOS ([MS-WKST] section 3.2.1.6).

DomainGuid: Prior to the initialization of the Netlogon Remote Protocol, DomainGuid has already been initialized, as specified in [MS-WKST] section 3.2.1.6, since Netlogon Remote Protocol is running on a system already joined to a domain.

DomainSid: Prior to the initialization of the Netlogon Remote Protocol, DomainSid has already been initialized, as specified in [MS-WKST] section 3.2.1.6, since Netlogon Remote Protocol is running on a system already joined to a domain.

AllowSingleLabelDNSDomain SHOULD<136> be set to a locally configured value.

AllowDnsSuffixSearch SHOULD<137> be set to TRUE.

SiteName SHOULD<138> be initialized from msDS-SiteName ([MS-ADTS] section 3.1.1.4.5.29) of the computer object if the server is a DC. If the server is not a DC, this ADM element is set to a locally configured value.

NextClosestSiteName Initialized as follows: If the server is a DC, the server invokes IDL_DRSQuerySitesByCost ([MS-DRSR] section 4.1.16), setting NextClosestSiteName to the site that is closest to SiteName but not equal to SiteName. If the server is not a DC, this ADM element is initialized to NULL.

DynamicSiteNameSetTime MUST be set to a value such that DynamicSiteNameSetTime plus DynamicSiteNameTimeout is less than the current time.

FailedDiscoveryCachePeriod SHOULD<139> be set to a locally configured value.

CacheEntryValidityPeriod SHOULD<140> be set to a locally configured value.

CacheEntryPingValidityPeriod SHOULD<141> be set to a locally configured value.

If the NRPC server is a DC, then the following abstract data model variables are initialized:

  • DCRPCPort SHOULD<142> be initialized in an implementation-specific way and MUST default to NULL.

  • DnsForestName is initialized from the FQDN of rootDomainNamingContext ([MS-ADTS] section 3.1.1.3.2.16).

  • The objects in TrustedDomainObjectsCollection are initialized as specified in [MS-LSAD] section 3.1.1.5.

  • The NT4Emulator field is set to FALSE.

  • RejectDES SHOULD<143> be initialized in an implementation-specific way and SHOULD<144> default to TRUE.

  • ServerServiceBits is initialized to zero.

  • SiteCoverage is initialized in an implementation-specific way and MUST default to NULL. Implementations SHOULD<145> persistently store and retrieve the SiteCoverage variable.