Export (0) Print
Expand All

2.2.1.5.1 NETLOGON_DB_CHANGE (Announcement) Message

The following is the format of the payload of a mailslot message used in Netlogon replication, as specified in section 3.6. The message is used to indicate that one or more changes have taken place in the account database, and carries an indication of the changes from the PDC to the BDC. Because it is sent in the open, this is a hint, and the BDC must connect to the PDC over a reliable transport and secure connection to obtain the actual change.

The DBChangeInfo field represents information about a state of one of the databases (Security Account Manager Built-in, Security Account Manager, or Local Security Authority). The number of DBChangeInfo fields is specified by the DBCount field. The format of the DBChangeInfo field is described below.

The fields in the above diagram are in little-endian format and have the following meanings:


0

1

2

3

4

5

6

7

8

9
1
0

1

2

3

4

5

6

7

8

9
2
0

1

2

3

4

5

6

7

8

9
3
0

1

MessageType

LowSerialNumber

...

DateAndTime

...

Pulse

...

Random

...

PrimaryDCName (variable)

...

DomainName (variable)

...

UnicodePrimaryDCName (variable)

...

UnicodeDomainName (variable)

...

DBCount

DBChangeInfo (variable)

...

DomainSidSize

DomainSid (variable)

...

MessageFormatVersion

MessageToken

MessageType (2 bytes): A two-byte field identifying the message. MUST be set to 0x000A.

 

LowSerialNumber (4 bytes): The low DWORD part of the 64-bit database serial number of the SAM database.

DateAndTime (4 bytes): An unsigned 32-bit value representing the time stamp for the SAM database creation time. This MUST be expressed as the number of seconds elapsed since midnight of January 1, 1970.

Pulse (4 bytes): An unsigned 32-bit value that specifies the message interval in seconds between change announcements sent to the BDCs.

Random (4 bytes): An unsigned 32-bit value that indicates the number of seconds the recipient of the message SHOULD <54> wait before contacting the sender.

PrimaryDCName (variable): The null-terminated name of the PDC sending the message. MUST be encoded in the original equipment manufacturer (OEM) character set.

DomainName (variable): The null-terminated domain name encoded in the OEM character set. The domain name is padded to a multiple of 2 bytes for alignment reasons.

UnicodePrimaryDCName (variable): The null-terminated name of the PDC sending the message. MUST be encoded in the Unicode character set.

UnicodeDomainName (variable): The null-terminated domain name. MUST be encoded in the Unicode character set.

DBCount (4 bytes): An unsigned 32-bit value representing the number of DBChangeInfo fields in the message.

DBChangeInfo (variable): A set of DBChangeInfo messages, specified below, that indicate the changes that are pending replication. There are DBCount entries in this set.


0

1

2

3

4

5

6

7

8

9
1
0

1

2

3

4

5

6

7

8

9
2
0

1

2

3

4

5

6

7

8

9
3
0

1

DBIndex

LargeSerialNumber

...

DateAndTime

...

DBIndex (4 bytes): A 32-bit value that identifies the database as follows:

Value Meaning

0x00000000

Indicates the SAM database.

0x00000001

Indicates the SAM built-in database.

0x00000002

Indicates the LSA database.

LargeSerialNumber (8 bytes): A 64-bit value that contains the database serial number for the database identified by the DBIndex field.

DateAndTime (8 bytes): The time in UTC of the database creation expressed as an 8-byte value in the TIME format in a FILETIME structure, as specified in [MS-RPCE]Appendix A (section 6).

In what follows, the above message is referred to as the announcement message.

DomainSidSize (4 bytes): An unsigned 32-bit value specifying the size in bytes of the DomainSid field.

DomainSid (variable): The SID of the domain.

MessageFormatVersion (4 bytes): An unsigned 32-bit value containing the version of the message format. MUST be set to 0x00000001.

 

MessageToken (4 bytes): An unsigned 32-bit field identifying the message. MUST be set to 0xFFFFFFFF.

 
 
Show:
© 2015 Microsoft