winprotocoldoc.blob.core.windows.netms-adt… · web view[ms-adts]: active directory technical...
TRANSCRIPT
[MS-ADTS]:
Active Directory Technical Specification
Intellectual Property Rights Notice for Open Specifications Documentation
· Technical Documentation. Microsoft publishes Open Specifications documentation (“this documentation”) for protocols, file formats, data portability, computer languages, and standards support. Additionally, overview documents cover inter-protocol relationships and interactions.
· Copyrights. This documentation is covered by Microsoft copyrights. Regardless of any other terms that are contained in the terms of use for the Microsoft website that hosts this documentation, you can make copies of it in order to develop implementations of the technologies that are described in this documentation and can distribute portions of it in your implementations that use these technologies or in your documentation as necessary to properly document the implementation. You can also distribute in your implementation, with or without modification, any schemas, IDLs, or code samples that are included in the documentation. This permission also applies to any documents that are referenced in the Open Specifications documentation.
· No Trade Secrets. Microsoft does not claim any trade secret rights in this documentation.
· Patents. Microsoft has patents that might cover your implementations of the technologies described in the Open Specifications documentation. Neither this notice nor Microsoft's delivery of this documentation grants any licenses under those patents or any other Microsoft patents. However, a given Open Specifications document might be covered by the Microsoft Open Specifications Promise or the Microsoft Community Promise. If you would prefer a written license, or if the technologies described in this documentation are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting [email protected].
· License Programs. To see all of the protocols in scope under a specific license program and the associated patents, visit the Patent Map.
· Trademarks. The names of companies and products contained in this documentation might be covered by trademarks or similar intellectual property rights. This notice does not grant any licenses under those rights. For a list of Microsoft trademarks, visit www.microsoft.com/trademarks.
· Fictitious Names. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events that are depicted in this documentation are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.
Reservation of Rights. All other rights are reserved, and this notice does not grant any rights other than as specifically described above, whether by implication, estoppel, or otherwise.
Tools. The Open Specifications documentation does not require the use of Microsoft programming tools or programming environments in order for you to develop an implementation. If you have access to Microsoft programming tools and environments, you are free to take advantage of them. Certain Open Specifications documents are intended for use in conjunction with publicly available standards specifications and network programming art and, as such, assume that the reader either is familiar with the aforementioned material or has immediate access to it.
Support. For questions and support, please contact [email protected].
Revision Summary
Date
Revision History
Revision Class
Comments
2/22/2007
0.01
New
Version 0.01 release
6/1/2007
1.0
Major
Included non-native content.
7/3/2007
1.0.1
Editorial
Changed language and formatting in the technical content.
7/20/2007
1.0.2
Editorial
Changed language and formatting in the technical content.
8/10/2007
1.0.3
Editorial
Changed language and formatting in the technical content.
9/28/2007
2.0
Major
Adjusted bitfield diagrams for byte ordering; added bitflags.
10/23/2007
2.1
Minor
Clarified the meaning of the technical content.
11/30/2007
2.2
Minor
Clarified the meaning of the technical content.
1/25/2008
3.0
Major
Updated and revised the technical content.
3/14/2008
3.1
Minor
Deleted hexadecimal representations of little-endian bit flags.
5/16/2008
4.0
Major
Updated and revised the technical content.
6/20/2008
5.0
Major
Updated and revised the technical content.
7/25/2008
6.0
Major
Updated and revised the technical content.
8/29/2008
7.0
Major
Updated and revised the technical content.
10/24/2008
8.0
Major
Updated and revised the technical content.
12/5/2008
9.0
Major
Updated and revised the technical content.
1/16/2009
10.0
Major
Updated and revised the technical content.
2/27/2009
11.0
Major
Updated and revised the technical content.
4/10/2009
12.0
Major
Updated and revised the technical content.
5/22/2009
13.0
Major
Updated and revised the technical content.
7/2/2009
14.0
Major
Updated and revised the technical content.
8/14/2009
15.0
Major
Updated and revised the technical content.
9/25/2009
16.0
Major
Updated and revised the technical content.
11/6/2009
17.0
Major
Updated and revised the technical content.
12/18/2009
18.0
Major
Updated and revised the technical content.
1/29/2010
19.0
Major
Updated and revised the technical content.
3/12/2010
20.0
Major
Updated and revised the technical content.
4/23/2010
21.0
Major
Updated and revised the technical content.
6/4/2010
22.0
Major
Updated and revised the technical content.
7/16/2010
23.0
Major
Updated and revised the technical content.
8/27/2010
24.0
Major
Updated and revised the technical content.
10/8/2010
25.0
Major
Updated and revised the technical content.
11/19/2010
26.0
Major
Updated and revised the technical content.
1/7/2011
27.0
Major
Updated and revised the technical content.
2/11/2011
28.0
Major
Updated and revised the technical content.
3/25/2011
29.0
Major
Updated and revised the technical content.
5/6/2011
30.0
Major
Updated and revised the technical content.
6/17/2011
30.1
Minor
Clarified the meaning of the technical content.
9/23/2011
31.0
Major
Updated and revised the technical content.
12/16/2011
32.0
Major
Updated and revised the technical content.
3/30/2012
33.0
Major
Updated and revised the technical content.
7/12/2012
34.0
Major
Updated and revised the technical content.
10/25/2012
35.0
Major
Updated and revised the technical content.
1/31/2013
36.0
Major
Updated and revised the technical content.
8/8/2013
37.0
Major
Updated and revised the technical content.
11/14/2013
38.0
Major
Updated and revised the technical content.
2/13/2014
39.0
Major
Updated and revised the technical content.
5/15/2014
40.0
Major
Updated and revised the technical content.
6/30/2015
41.0
Major
Significantly changed the technical content.
10/16/2015
42.0
Major
Significantly changed the technical content.
7/14/2016
43.0
Major
Significantly changed the technical content.
3/16/2017
44.0
Major
Significantly changed the technical content.
6/1/2017
45.0
Major
Significantly changed the technical content.
9/15/2017
46.0
Major
Significantly changed the technical content.
Table of Contents
1Introduction22
1.1Glossary24
1.2References41
1.2.1Normative References42
1.2.2Informative References46
1.3Overview47
1.4Relationship to Other Protocols48
1.5Prerequisites/Preconditions48
1.6Applicability Statement48
1.7Versioning and Capability Negotiation48
1.8Vendor-Extensible Fields49
1.9Standards Assignments49
2Messages50
2.1Transport50
2.2Message Syntax50
2.2.1LCID-Locale Mapping Table50
2.2.2DS_REPL_NEIGHBORW_BLOB56
2.2.3DS_REPL_KCC_DSA_FAILUREW_BLOB59
2.2.4DS_REPL_OPW_BLOB60
2.2.5DS_REPL_QUEUE_STATISTICSW_BLOB62
2.2.6DS_REPL_CURSOR_BLOB63
2.2.7DS_REPL_ATTR_META_DATA_BLOB64
2.2.8DS_REPL_VALUE_META_DATA_BLOB65
2.2.9Search Flags67
2.2.10System Flags68
2.2.11schemaFlagsEx Flags69
2.2.12Group Type Flags69
2.2.13Group Security Flags70
2.2.14Security Privilege Flags70
2.2.15Domain RID Values71
2.2.16userAccountControl Bits72
2.2.17Optional Feature Values73
2.2.18Claims Wire Structures74
2.2.18.1CLAIM_ID75
2.2.18.2CLAIM_TYPE75
2.2.18.3CLAIMS_SOURCE_TYPE76
2.2.18.4CLAIMS_COMPRESSION_FORMAT76
2.2.18.5CLAIM_ENTRY76
2.2.18.6CLAIMS_ARRAY77
2.2.18.7CLAIMS_SET78
2.2.18.8CLAIMS_SET_METADATA78
2.2.18.9CLAIMS_BLOB79
2.2.19MSDS-MANAGEDPASSWORD_BLOB79
2.2.20Key Credential Link Structures80
2.2.20.1Key Credential Link Constants80
2.2.20.2KEYCREDENTIALLINK_BLOB81
2.2.20.3KEYCREDENTIALLINK_ENTRY81
2.2.20.4CUSTOM_KEY_INFORMATION82
2.2.20.5KEYCREDENTIALLINK_ENTRY Identifiers82
2.2.21Service Principal Name83
3Details84
3.1Common Details85
3.1.1Abstract Data Model85
3.1.1.1State Model85
3.1.1.1.1Scope85
3.1.1.1.2State Modeling Primitives and Notational Conventions86
3.1.1.1.3Basics, objectGUID, and Special Attribute Behavior87
3.1.1.1.4objectClass, RDN, DN, Constructed Attributes, Secret Attributes88
3.1.1.1.5NC, NC Replica91
3.1.1.1.5.1Tombstone Lifetime and Deleted-Object Lifetime93
3.1.1.1.6Attribute Syntaxes, Object References, Referential Integrity, and Well-Known Objects94
3.1.1.1.7Forest, Canonical Name97
3.1.1.1.8GC99
3.1.1.1.9DCs, usn Counters, and the Originating Update Stamp99
3.1.1.1.10GC Server106
3.1.1.1.11FSMO Roles106
3.1.1.1.12Cross-NC Object References106
3.1.1.1.13NC Replica Graph107
3.1.1.1.14Scheduled and Event-Driven Replication109
3.1.1.1.15Replication Latency and Tombstone Lifetime110
3.1.1.1.16Delayed Link Processing110
3.1.1.2Active Directory Schema110
3.1.1.2.1Schema NC111
3.1.1.2.2Syntaxes112
3.1.1.2.2.1Introduction112
3.1.1.2.2.2LDAP Representations112
3.1.1.2.2.2.1Object(DN-String)115
3.1.1.2.2.2.2Object(Access-Point)115
3.1.1.2.2.2.3Object(DN-Binary)115
3.1.1.2.2.2.4Object(OR-Name)115
3.1.1.2.2.2.5String(Case)115
3.1.1.2.2.2.6String(NT-Sec-Desc)115
3.1.1.2.2.2.7String(Sid)116
3.1.1.2.2.2.8String(Teletex)116
3.1.1.2.2.3Referential Integrity116
3.1.1.2.2.4Supported Comparison Operations116
3.1.1.2.2.4.1Bool Comparison Rule119
3.1.1.2.2.4.2Integer Comparison Rule119
3.1.1.2.2.4.3DN-String Comparison Rule119
3.1.1.2.2.4.4DN-Binary Comparison Rule119
3.1.1.2.2.4.5DN Comparison Rule119
3.1.1.2.2.4.6PresentationAddress Comparison Rule120
3.1.1.2.2.4.7Octet Comparison Rule120
3.1.1.2.2.4.8CaseString Comparison Rule120
3.1.1.2.2.4.9SecDesc Comparison Rule120
3.1.1.2.2.4.10OID Comparison Rule120
3.1.1.2.2.4.11Sid Comparison Rule120
3.1.1.2.2.4.12NoCaseString Comparison Rule120
3.1.1.2.2.4.13UnicodeString Comparison Rule121
3.1.1.2.2.4.14Time Comparison Rule121
3.1.1.2.3Attributes121
3.1.1.2.3.1Auto-Generated linkID124
3.1.1.2.3.2Auto-Generated mAPIID124
3.1.1.2.3.3Property Set125
3.1.1.2.3.4lDAPDisplayName Generation126
3.1.1.2.3.5Flag fRODCFilteredAttribute in Attribute searchFlags126
3.1.1.2.4Classes127
3.1.1.2.4.1Class Categories127
3.1.1.2.4.2Inheritance127
3.1.1.2.4.3objectClass127
3.1.1.2.4.4Structure Rules128
3.1.1.2.4.5Content Rules128
3.1.1.2.4.6Auxiliary Class128
3.1.1.2.4.7RDN Attribute of a Class129
3.1.1.2.4.8Class classSchema129
3.1.1.2.5Schema Modifications131
3.1.1.2.5.1Consistency and Safety Checks131
3.1.1.2.5.1.1Consistency Checks131
3.1.1.2.5.1.2Safety Checks132
3.1.1.2.5.2Auto-Generated Attributes133
3.1.1.2.5.3Defunct133
3.1.1.2.5.3.1Forest Functional Level Less Than WIN2003134
3.1.1.2.5.3.2Forest Functional Level WIN2003 or Greater134
3.1.1.2.6ATTRTYP135
3.1.1.3LDAP136
3.1.1.3.1LDAP Conformance136
3.1.1.3.1.1Schema136
3.1.1.3.1.1.1subSchema136
3.1.1.3.1.1.2Syntaxes139
3.1.1.3.1.1.3Attributes139
3.1.1.3.1.1.4Classes146
3.1.1.3.1.1.5Auxiliary Classes149
3.1.1.3.1.2Object Naming150
3.1.1.3.1.2.1Naming Attributes150
3.1.1.3.1.2.2NC Naming151
3.1.1.3.1.2.3Multivalued and Multiple-Attribute RDNs151
3.1.1.3.1.2.4Alternative Forms of DNs151
3.1.1.3.1.2.5Alternative Form of SIDs153
3.1.1.3.1.3Search Operations153
3.1.1.3.1.3.1Search Filters153
3.1.1.3.1.3.2Selection Filters154
3.1.1.3.1.3.3Range Retrieval of Attribute Values154
3.1.1.3.1.3.4Ambiguous Name Resolution155
3.1.1.3.1.3.5Searches Using the objectCategory Attribute157
3.1.1.3.1.3.6Restrictions on rootDSE Searches157
3.1.1.3.1.4Referrals in LDAPv2 and LDAPv3157
3.1.1.3.1.5Password Modify Operations158
3.1.1.3.1.5.1unicodePwd158
3.1.1.3.1.5.2userPassword159
3.1.1.3.1.6Dynamic Objects160
3.1.1.3.1.7Modify DN Operations160
3.1.1.3.1.8Aliases160
3.1.1.3.1.9Error Message Strings160
3.1.1.3.1.10Ports160
3.1.1.3.1.11LDAP Search Over UDP161
3.1.1.3.1.12Unbind Operation161
3.1.1.3.2rootDSE Attributes161
3.1.1.3.2.1configurationNamingContext165
3.1.1.3.2.2currentTime166
3.1.1.3.2.3defaultNamingContext166
3.1.1.3.2.4dNSHostName166
3.1.1.3.2.5dsSchemaAttrCount166
3.1.1.3.2.6dsSchemaClassCount166
3.1.1.3.2.7dsSchemaPrefixCount166
3.1.1.3.2.8dsServiceName166
3.1.1.3.2.9highestCommittedUSN166
3.1.1.3.2.10isGlobalCatalogReady166
3.1.1.3.2.11isSynchronized166
3.1.1.3.2.12ldapServiceName166
3.1.1.3.2.13namingContexts166
3.1.1.3.2.14netlogon167
3.1.1.3.2.15pendingPropagations167
3.1.1.3.2.16rootDomainNamingContext167
3.1.1.3.2.17schemaNamingContext167
3.1.1.3.2.18serverName167
3.1.1.3.2.19subschemaSubentry167
3.1.1.3.2.20supportedCapabilities167
3.1.1.3.2.21supportedControl167
3.1.1.3.2.22supportedLDAPPolicies167
3.1.1.3.2.23supportedLDAPVersion167
3.1.1.3.2.24supportedSASLMechanisms167
3.1.1.3.2.25domainControllerFunctionality168
3.1.1.3.2.26domainFunctionality168
3.1.1.3.2.27forestFunctionality168
3.1.1.3.2.28msDS-ReplAllInboundNeighbors, msDS-ReplConnectionFailures, msDS-ReplLinkFailures, and msDS-ReplPendingOps169
3.1.1.3.2.29msDS-ReplAllOutboundNeighbors170
3.1.1.3.2.30msDS-ReplQueueStatistics170
3.1.1.3.2.31msDS-TopQuotaUsage171
3.1.1.3.2.32supportedConfigurableSettings172
3.1.1.3.2.33supportedExtension172
3.1.1.3.2.34validFSMOs172
3.1.1.3.2.35dsaVersionString173
3.1.1.3.2.36msDS-PortLDAP173
3.1.1.3.2.37msDS-PortSSL173
3.1.1.3.2.38msDS-PrincipalName173
3.1.1.3.2.39serviceAccountInfo173
3.1.1.3.2.40spnRegistrationResult174
3.1.1.3.2.41tokenGroups174
3.1.1.3.2.42usnAtRifm174
3.1.1.3.2.43approximateHighestInternalObjectID174
3.1.1.3.2.44databaseGuid174
3.1.1.3.2.45schemaIndexUpdateState175
3.1.1.3.2.46dumpLdapNotifications175
3.1.1.3.2.47msDS-ProcessLinksOperations175
3.1.1.3.2.48msDS-SegmentCacheInfo175
3.1.1.3.2.49msDS-ThreadStates175
3.1.1.3.2.50ConfigurableSettingsEffective175
3.1.1.3.2.51LDAPPoliciesEffective175
3.1.1.3.2.52msDS-ArenaInfo175
3.1.1.3.3rootDSE Modify Operations175
3.1.1.3.3.1becomeDomainMaster178
3.1.1.3.3.2becomeInfrastructureMaster178
3.1.1.3.3.3becomePdc179
3.1.1.3.3.4becomePdcWithCheckPoint179
3.1.1.3.3.5becomeRidMaster179
3.1.1.3.3.6becomeSchemaMaster179
3.1.1.3.3.7checkPhantoms180
3.1.1.3.3.8doGarbageCollection180
3.1.1.3.3.9dumpDatabase181
3.1.1.3.3.10fixupInheritance181
3.1.1.3.3.11invalidateRidPool182
3.1.1.3.3.12recalcHierarchy182
3.1.1.3.3.13schemaUpdateNow182
3.1.1.3.3.14schemaUpgradeInProgress183
3.1.1.3.3.15removeLingeringObject183
3.1.1.3.3.16doLinkCleanup184
3.1.1.3.3.17doOnlineDefrag184
3.1.1.3.3.18replicateSingleObject185
3.1.1.3.3.19updateCachedMemberships185
3.1.1.3.3.20doGarbageCollectionPhantomsNow186
3.1.1.3.3.21invalidateGCConnection186
3.1.1.3.3.22renewServerCertificate186
3.1.1.3.3.23rODCPurgeAccount187
3.1.1.3.3.24runSamUpgradeTasks187
3.1.1.3.3.25sqmRunOnce188
3.1.1.3.3.26runProtectAdminGroupsTask188
3.1.1.3.3.27disableOptionalFeature188
3.1.1.3.3.28enableOptionalFeature189
3.1.1.3.3.29dumpReferences190
3.1.1.3.3.30sidCompatibilityVersion190
3.1.1.3.3.31dumpLinks191
3.1.1.3.3.32schemaUpdateIndicesNow191
3.1.1.3.3.33null191
3.1.1.3.3.34dumpQuota191
3.1.1.3.3.35dumpLinksExtended192
3.1.1.3.3.36dumpLDAPState192
3.1.1.3.3.37msDS-ProcessLinksAbandonOperation192
3.1.1.3.3.38msDS-ProcessLinksScheduleOperation193
3.1.1.3.4LDAP Extensions193
3.1.1.3.4.1LDAP Extended Controls193
3.1.1.3.4.1.1LDAP_PAGED_RESULT_OID_STRING200
3.1.1.3.4.1.2LDAP_SERVER_CROSSDOM_MOVE_TARGET_OID200
3.1.1.3.4.1.3LDAP_SERVER_DIRSYNC_OID200
3.1.1.3.4.1.4LDAP_SERVER_DOMAIN_SCOPE_OID202
3.1.1.3.4.1.5LDAP_SERVER_EXTENDED_DN_OID203
3.1.1.3.4.1.6LDAP_SERVER_GET_STATS_OID204
3.1.1.3.4.1.7LDAP_SERVER_LAZY_COMMIT_OID207
3.1.1.3.4.1.8LDAP_SERVER_PERMISSIVE_MODIFY_OID207
3.1.1.3.4.1.9LDAP_SERVER_NOTIFICATION_OID208
3.1.1.3.4.1.10LDAP_SERVER_RANGE_OPTION_OID208
3.1.1.3.4.1.11LDAP_SERVER_SD_FLAGS_OID208
3.1.1.3.4.1.12LDAP_SERVER_SEARCH_OPTIONS_OID209
3.1.1.3.4.1.13LDAP_SERVER_SORT_OID and LDAP_SERVER_RESP_SORT_OID210
3.1.1.3.4.1.14LDAP_SERVER_SHOW_DELETED_OID216
3.1.1.3.4.1.15LDAP_SERVER_TREE_DELETE_OID217
3.1.1.3.4.1.16LDAP_SERVER_VERIFY_NAME_OID217
3.1.1.3.4.1.17LDAP_CONTROL_VLVREQUEST and LDAP_CONTROL_VLVRESPONSE217
3.1.1.3.4.1.18LDAP_SERVER_ASQ_OID219
3.1.1.3.4.1.19LDAP_SERVER_QUOTA_CONTROL_OID220
3.1.1.3.4.1.20LDAP_SERVER_SHUTDOWN_NOTIFY_OID221
3.1.1.3.4.1.21LDAP_SERVER_FORCE_UPDATE_OID221
3.1.1.3.4.1.22LDAP_SERVER_RANGE_RETRIEVAL_NOERR_OID222
3.1.1.3.4.1.23LDAP_SERVER_RODC_DCPROMO_OID222
3.1.1.3.4.1.24LDAP_SERVER_DN_INPUT_OID222
3.1.1.3.4.1.25LDAP_SERVER_SHOW_DEACTIVATED_LINK_OID223
3.1.1.3.4.1.26LDAP_SERVER_SHOW_RECYCLED_OID223
3.1.1.3.4.1.27LDAP_SERVER_POLICY_HINTS_OID224
3.1.1.3.4.1.28LDAP_SERVER_POLICY_HINTS_DEPRECATED_OID224
3.1.1.3.4.1.29LDAP_SERVER_DIRSYNC_EX_OID224
3.1.1.3.4.1.30LDAP_SERVER_UPDATE_STATS_OID224
3.1.1.3.4.1.30.1Highest USN Allocated225
3.1.1.3.4.1.30.2Invocation ID Of Server225
3.1.1.3.4.1.31LDAP_SERVER_TREE_DELETE_EX_OID225
3.1.1.3.4.1.32LDAP_SERVER_SEARCH_HINTS_OID226
3.1.1.3.4.1.32.1Require Sort Index226
3.1.1.3.4.1.32.2Soft Size Limit226
3.1.1.3.4.1.33LDAP_SERVER_EXPECTED_ENTRY_COUNT_OID227
3.1.1.3.4.1.34LDAP_SERVER_SET_OWNER_OID227
3.1.1.3.4.1.35LDAP_SERVER_BYPASS_QUOTA_OID228
3.1.1.3.4.1.36LDAP_SERVER_LINK_TTL_OID228
3.1.1.3.4.2LDAP Extended Operations228
3.1.1.3.4.2.1LDAP_SERVER_FAST_BIND_OID229
3.1.1.3.4.2.2LDAP_SERVER_START_TLS_OID230
3.1.1.3.4.2.3LDAP_TTL_REFRESH_OID230
3.1.1.3.4.2.4LDAP_SERVER_WHO_AM_I_OID230
3.1.1.3.4.2.5LDAP_SERVER_BATCH_REQUEST_OID230
3.1.1.3.4.3LDAP Capabilities232
3.1.1.3.4.3.1LDAP_CAP_ACTIVE_DIRECTORY_OID233
3.1.1.3.4.3.2LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID234
3.1.1.3.4.3.3LDAP_CAP_ACTIVE_DIRECTORY_V51_OID234
3.1.1.3.4.3.4LDAP_CAP_ACTIVE_DIRECTORY_ADAM_DIGEST_OID234
3.1.1.3.4.3.5LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID234
3.1.1.3.4.3.6LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID234
3.1.1.3.4.3.7LDAP_CAP_ACTIVE_DIRECTORY_V60_OID234
3.1.1.3.4.3.8LDAP_CAP_ACTIVE_DIRECTORY_V61_R2_OID234
3.1.1.3.4.3.9LDAP_CAP_ACTIVE_DIRECTORY_W8_OID234
3.1.1.3.4.4LDAP Matching Rules (extensibleMatch)234
3.1.1.3.4.4.1LDAP_MATCHING_RULE_BIT_AND235
3.1.1.3.4.4.2LDAP_MATCHING_RULE_BIT_OR235
3.1.1.3.4.4.3LDAP_MATCHING_RULE_TRANSITIVE_EVAL235
3.1.1.3.4.4.4LDAP_MATCHING_RULE_DN_WITH_DATA236
3.1.1.3.4.5LDAP SASL Mechanisms236
3.1.1.3.4.5.1GSSAPI237
3.1.1.3.4.5.2GSS-SPNEGO237
3.1.1.3.4.5.3EXTERNAL237
3.1.1.3.4.5.4DIGEST-MD5237
3.1.1.3.4.6LDAP Policies237
3.1.1.3.4.7LDAP Configurable Settings241
3.1.1.3.4.8LDAP IP-Deny List243
3.1.1.4Reads243
3.1.1.4.1Introduction244
3.1.1.4.2Definitions244
3.1.1.4.3Access Checks245
3.1.1.4.4Extended Access Checks245
3.1.1.4.5Constructed Attributes247
3.1.1.4.5.1subSchemaSubEntry248
3.1.1.4.5.2canonicalName248
3.1.1.4.5.3allowedChildClasses248
3.1.1.4.5.4sDRightsEffective248
3.1.1.4.5.5allowedChildClassesEffective248
3.1.1.4.5.6allowedAttributes249
3.1.1.4.5.7allowedAttributesEffective249
3.1.1.4.5.8fromEntry249
3.1.1.4.5.9createTimeStamp250
3.1.1.4.5.10modifyTimeStamp250
3.1.1.4.5.11primaryGroupToken250
3.1.1.4.5.12entryTTL250
3.1.1.4.5.13msDS-NCReplInboundNeighbors, msDS-NCReplCursors, msDS-ReplAttributeMetaData, msDS-ReplValueMetaData250
3.1.1.4.5.14msDS-NCReplOutboundNeighbors251
3.1.1.4.5.15msDS-Approx-Immed-Subordinates251
3.1.1.4.5.16msDS-KeyVersionNumber251
3.1.1.4.5.17msDS-User-Account-Control-Computed251
3.1.1.4.5.18msDS-Auxiliary-Classes253
3.1.1.4.5.19tokenGroups, tokenGroupsNoGCAcceptable253
3.1.1.4.5.20tokenGroupsGlobalAndUniversal253
3.1.1.4.5.21possibleInferiors254
3.1.1.4.5.22msDS-QuotaEffective254
3.1.1.4.5.23msDS-QuotaUsed255
3.1.1.4.5.24msDS-TopQuotaUsage255
3.1.1.4.5.25ms-DS-UserAccountAutoLocked256
3.1.1.4.5.26msDS-UserPasswordExpired256
3.1.1.4.5.27msDS-PrincipalName257
3.1.1.4.5.28parentGUID257
3.1.1.4.5.29msDS-SiteName257
3.1.1.4.5.30msDS-isRODC257
3.1.1.4.5.31msDS-isGC258
3.1.1.4.5.32msDS-isUserCachableAtRodc258
3.1.1.4.5.33msDS-UserPasswordExpiryTimeComputed259
3.1.1.4.5.34msDS-RevealedList259
3.1.1.4.5.35msDS-RevealedListBL260
3.1.1.4.5.36msDS-ResultantPSO260
3.1.1.4.5.37msDS-LocalEffectiveDeletionTime261
3.1.1.4.5.38msDS-LocalEffectiveRecycleTime261
3.1.1.4.5.39msDS-ManagedPassword261
3.1.1.4.5.40msds-memberOfTransitive267
3.1.1.4.5.41msds-memberTransitive268
3.1.1.4.5.42msds-tokenGroupNames, msds-tokenGroupNamesNoGCAcceptable268
3.1.1.4.5.43msds-tokenGroupNamesGlobalAndUniversal268
3.1.1.4.5.44structuralObjectClass268
3.1.1.4.6Referrals269
3.1.1.4.7Continuations270
3.1.1.4.8Effects of Defunct Attributes and Classes271
3.1.1.5Updates271
3.1.1.5.1General271
3.1.1.5.1.1Enforce Schema Constraints271
3.1.1.5.1.2Naming Constraints272
3.1.1.5.1.3Uniqueness Constraints272
3.1.1.5.1.4Transactional Semantics273
3.1.1.5.1.5Stamp Construction273
3.1.1.5.1.6Replication Notification273
3.1.1.5.1.7Urgent Replication274
3.1.1.5.1.8Updates Performed Only on FSMOs275
3.1.1.5.1.9Allow Updates Only When They Are Enabled277
3.1.1.5.1.10Originating Updates Attempted on an RODC277
3.1.1.5.1.11Constraints and Processing Specifics Defined Elsewhere277
3.1.1.5.2Add Operation278
3.1.1.5.2.1Security Considerations278
3.1.1.5.2.2Constraints279
3.1.1.5.2.3Special Classes and Attributes284
3.1.1.5.2.4Processing Specifics284
3.1.1.5.2.5Quota Calculation287
3.1.1.5.2.6NC Requirements288
3.1.1.5.2.7crossRef Requirements289
3.1.1.5.2.8NC-Add Operation289
3.1.1.5.2.8.1Constraints289
3.1.1.5.2.8.2Security Considerations290
3.1.1.5.2.8.3Processing Specifics290
3.1.1.5.3Modify Operation290
3.1.1.5.3.1Security Considerations291
3.1.1.5.3.1.1Validated Writes291
3.1.1.5.3.1.1.1Member291
3.1.1.5.3.1.1.2dNSHostName292
3.1.1.5.3.1.1.3msDS-AdditionalDnsHostName292
3.1.1.5.3.1.1.4servicePrincipalName292
3.1.1.5.3.1.1.5msDS-Behavior-Version293
3.1.1.5.3.1.1.6msDS-KeyCredentialLink293
3.1.1.5.3.1.2FSMO Changes293
3.1.1.5.3.2Constraints294
3.1.1.5.3.3Processing Specifics298
3.1.1.5.3.4BehaviorVersion Updates300
3.1.1.5.3.5ObjectClass Updates301
3.1.1.5.3.6wellKnownObjects Updates302
3.1.1.5.3.7Undelete Operation303
3.1.1.5.3.7.1Undelete Security Considerations303
3.1.1.5.3.7.2Undelete Constraints303
3.1.1.5.3.7.3Undelete Processing Specifics304
3.1.1.5.4Modify DN304
3.1.1.5.4.1Intra Domain Modify DN306
3.1.1.5.4.1.1Security Considerations306
3.1.1.5.4.1.2Constraints306
3.1.1.5.4.1.3Processing Specifics308
3.1.1.5.4.2Cross Domain Move308
3.1.1.5.4.2.1Security Considerations308
3.1.1.5.4.2.2Constraints308
3.1.1.5.4.2.3Processing Specifics311
3.1.1.5.5Delete Operation313
3.1.1.5.5.1Resultant Object Requirements315
3.1.1.5.5.1.1Tombstone Requirements315
3.1.1.5.5.1.2Deleted-Object Requirements316
3.1.1.5.5.1.3Recycled-Object Requirements317
3.1.1.5.5.2dynamicObject Requirements318
3.1.1.5.5.3Protected Objects318
3.1.1.5.5.4Security Considerations318
3.1.1.5.5.5Constraints318
3.1.1.5.5.6Processing Specifics319
3.1.1.5.5.6.1Transformation into a Tombstone319
3.1.1.5.5.6.2Transformation into a Deleted-Object320
3.1.1.5.5.6.3Transformation into a Recycled-Object321
3.1.1.5.5.7Tree-delete Operation321
3.1.1.5.5.7.1Tree-delete Security Considerations322
3.1.1.5.5.7.2Tree-delete Constraints322
3.1.1.5.5.7.3Tree-delete Processing Specifics322
3.1.1.6Background Tasks322
3.1.1.6.1AdminSDHolder322
3.1.1.6.1.1Authoritative Security Descriptor323
3.1.1.6.1.2Protected Objects323
3.1.1.6.1.3Protection Operation324
3.1.1.6.1.4Configurable State324
3.1.1.6.2Reference Update324
3.1.1.6.3Security Descriptor Propagator Update326
3.1.1.7NT4 Replication Support327
3.1.1.7.1Format of nt4ReplicationState and pdcChangeLog327
3.1.1.7.1.1nt4ReplicationState327
3.1.1.7.1.2pdcChangeLog327
3.1.1.7.2State Changes327
3.1.1.7.2.1Initialization327
3.1.1.7.2.2Directory Updates328
3.1.1.7.2.3Acquiring the PDC Role331
3.1.1.7.2.4Resetting the pdcChangeLog332
3.1.1.7.3Format of the Referent of pmsgOut.V1.pLog332
3.1.1.8AD LDS Special Objects333
3.1.1.8.1AD LDS Users333
3.1.1.8.2Bind Proxies334
3.1.1.9Optional Features334
3.1.1.9.1Recycle Bin Optional Feature336
3.1.1.9.2Privileged Access Management Optional Feature337
3.1.1.10Revisions337
3.1.1.10.1Forest Revision337
3.1.1.10.2RODC Revision338
3.1.1.10.3Domain Revision339
3.1.1.11Claims340
3.1.1.11.1Informative Overview340
3.1.1.11.1.1Claim340
3.1.1.11.1.2Claims Dictionary340
3.1.1.11.1.3Claim Source340
3.1.1.11.1.4Claims Issuance340
3.1.1.11.1.5Claims Transformation Rules341
3.1.1.11.1.6Claims Transformation341
3.1.1.11.2Claims Procedures341
3.1.1.11.2.1GetClaimsForPrincipal341
3.1.1.11.2.2GetADSourcedClaims342
3.1.1.11.2.3GetCertificateSourcedClaims343
3.1.1.11.2.4GetConstructedClaims344
3.1.1.11.2.5EncodeClaimsSet345
3.1.1.11.2.6FillClaimsSetMetadata346
3.1.1.11.2.7RunCompressionAlgorithm347
3.1.1.11.2.8NdrEncode348
3.1.1.11.2.9NdrDecode348
3.1.1.11.2.10DecodeClaimsSet348
3.1.1.11.2.11TransformClaimsOnTrustTraversal349
3.1.1.11.2.12GetClaimsTransformationRulesXml351
3.1.1.11.2.13GetTransformationRulesText352
3.1.1.11.2.14GetCTAClaims352
3.1.1.11.2.15CollapseMultiValuedClaims353
3.1.1.11.2.16FilterAndPackOutputClaims354
3.1.1.11.2.17ValidateClaimDefinition355
3.1.1.11.2.18GetAuthSiloClaim356
3.1.1.12NC Rename357
3.1.1.12.1Abstract Data Types358
3.1.1.12.1.1FlatName358
3.1.1.12.1.2SPNValue358
3.1.1.12.1.3ServerDescription358
3.1.1.12.1.4InterdomainTrustAccountDescription359
3.1.1.12.1.5TrustedDomainObjectDescription359
3.1.1.12.1.6NCDescription360
3.1.1.12.1.7DomainDescriptionElements360
3.1.1.12.1.8DomainDescription361
3.1.1.12.1.9NewTrustParentElements361
3.1.1.12.1.10DomainWithNewTrustParentDescription362
3.1.1.12.1.11NCRenameDescription362
3.1.1.12.2Encoding/Decoding Rules363
3.1.1.12.2.1EBNF-M363
3.1.1.12.2.1.1Tuples as Parameters to Production Rules363
3.1.1.12.2.1.2Parameter Fields as Terminal Values364
3.1.1.12.2.1.3Formatting of Non-String Parameter Fields as Terminal Values364
3.1.1.12.2.1.4Parameter Fields as Iterators364
3.1.1.12.2.1.5Reversed Production Rules365
3.1.1.12.2.2CodedNCRenameDescription367
3.1.1.12.2.2.1Expression367
3.1.1.12.2.2.2Common367
3.1.1.12.2.2.3Tests368
3.1.1.12.2.2.3.1TestConfigurationNC369
3.1.1.12.2.2.3.2TestReplicationEpoch369
3.1.1.12.2.2.3.3TestAppNCs369
3.1.1.12.2.2.3.4TestDomains370
3.1.1.12.2.2.3.4.1TestCrossRef370
3.1.1.12.2.2.3.4.2TestServersInstantiated371
3.1.1.12.2.2.3.4.3TestTrustCount372
3.1.1.12.2.2.3.4.4TestTrustedDomainObjectDescriptions372
3.1.1.12.2.2.3.4.5TestInterdomainTrustAccountDescriptions373
3.1.1.12.2.2.3.4.6TestServerDescriptions374
3.1.1.12.2.2.3.5TestPartitionCounts375
3.1.1.12.2.2.4Flatten376
3.1.1.12.2.2.5Rebuild376
3.1.1.12.2.2.6Trusts377
3.1.1.12.2.2.6.1DomainTrustSpecifications378
3.1.1.12.2.2.6.2DomainTrustAccounts379
3.1.1.12.2.2.7CrossRefs381
3.1.1.12.2.2.7.1ConfigurationCrossRef381
3.1.1.12.2.2.7.2SchemaCrossRef381
3.1.1.12.2.2.7.3AppNCsCrossRefs382
3.1.1.12.2.2.7.4NCRenameDescriptionRootCrossRef382
3.1.1.12.2.2.7.5TrustTreeNonRootDomainCrossRefs384
3.1.1.12.2.2.7.6TrustTreeRootDomainCrossRefs385
3.1.1.12.2.2.8ReplicationEpoch387
3.1.1.12.3Decode Operation388
3.1.1.12.4Verify Conditions388
3.1.1.12.5Process Changes389
3.1.1.13Authentication Information Retrieval391
3.1.1.13.1Informative Overview391
3.1.1.13.2ExpandMemberships391
3.1.1.13.3GetUserLogonInfo392
3.1.1.13.4GetResourceDomainInfo393
3.1.1.13.5ExpandShadowPrincipal393
3.1.1.13.6GetUserLogonInfoByAttribute394
3.1.1.13.7GetUserLogonInfoByUPNOrAccountName395
4Protocol Examples397
5Security398
5.1LDAP Security398
5.1.1Authentication398
5.1.1.1Supported Authentication Methods398
5.1.1.1.1Simple Authentication399
5.1.1.1.2SASL Authentication400
5.1.1.1.3Sicily Authentication401
5.1.1.2Using SSL/TLS403
5.1.1.3Using Fast Bind403
5.1.1.4Mutual Authentication404
5.1.1.5Supported Types of Security Principals404
5.1.2Message Security406
5.1.2.1Using SASL406
5.1.2.2Using SSL/TLS406
5.1.3Authorization406
5.1.3.1Background407
5.1.3.2Access Rights407
5.1.3.2.1Control Access Rights409
5.1.3.2.2Validated Writes413
5.1.3.3Checking Access415
5.1.3.3.1Null vs. Empty DACLs415
5.1.3.3.2Checking Simple Access415
5.1.3.3.3Checking Object-Specific Access416
5.1.3.3.4Checking Control Access Right-Based Access418
5.1.3.3.5Checking Validated Write-Based Access419
5.1.3.3.6Checking Object Visibility419
5.1.3.4AD LDS Security Context Construction420
6Additional Information422
6.1Special Objects and Forest Requirements422
6.1.1Special Objects422
6.1.1.1Naming Contexts422
6.1.1.1.1Any NC Root422
6.1.1.1.2Config NC Root423
6.1.1.1.3Schema NC Root424
6.1.1.1.4Domain NC Root424
6.1.1.1.5Application NC Root425
6.1.1.2Configuration Objects426
6.1.1.2.1Cross-Ref-Container Container427
6.1.1.2.1.1Cross-Ref Objects427
6.1.1.2.1.1.1Foreign crossRef Objects428
6.1.1.2.1.1.2Configuration crossRef Object428
6.1.1.2.1.1.3Schema crossRef Object428
6.1.1.2.1.1.4Domain crossRef Object428
6.1.1.2.1.1.5Application NC crossRef Object429
6.1.1.2.2Sites Container429
6.1.1.2.2.1Site Object429
6.1.1.2.2.1.1NTDS Site Settings Object430
6.1.1.2.2.1.2Servers Container431
6.1.1.2.2.1.2.1Server Object431
6.1.1.2.2.1.2.1.1nTDSDSA Object431
6.1.1.2.2.1.2.1.2Connection Object433
6.1.1.2.2.1.2.1.3RODC NTFRS Connection Object435
6.1.1.2.2.2Subnets Container436
6.1.1.2.2.2.1Subnet Object436
6.1.1.2.2.3Inter-Site Transports Container438
6.1.1.2.2.3.1IP Transport Container438
6.1.1.2.2.3.2SMTP Transport Container439
6.1.1.2.2.3.3Site Link Object439
6.1.1.2.2.3.4Site Link Bridge Object440
6.1.1.2.3Display Specifiers Container440
6.1.1.2.3.1Display Specifier Object440
6.1.1.2.4Services442
6.1.1.2.4.1Windows NT442
6.1.1.2.4.1.1Directory Service442
6.1.1.2.4.1.2dSHeuristics443
6.1.1.2.4.1.3Optional Features Container448
6.1.1.2.4.1.3.1Recycle Bin Feature Object448
6.1.1.2.4.1.3.2Privileged Access Management Feature Object448
6.1.1.2.4.1.4Query-Policies448
6.1.1.2.4.1.4.1Default Query Policy449
6.1.1.2.4.1.5SCP Publication Service Object449
6.1.1.2.5Physical Locations449
6.1.1.2.6WellKnown Security Principals449
6.1.1.2.6.1Anonymous Logon450
6.1.1.2.6.2Authenticated Users450
6.1.1.2.6.3Batch450
6.1.1.2.6.4Console Logon450
6.1.1.2.6.5Creator Group450
6.1.1.2.6.6Creator Owner450
6.1.1.2.6.7Dialup450
6.1.1.2.6.8Digest Authentication451
6.1.1.2.6.9Enterprise Domain Controllers451
6.1.1.2.6.10Everyone451
6.1.1.2.6.11Interactive451
6.1.1.2.6.12IUSR451
6.1.1.2.6.13Local Service451
6.1.1.2.6.14Network451
6.1.1.2.6.15Network Service451
6.1.1.2.6.16NTLM Authentication452
6.1.1.2.6.17Other Organization452
6.1.1.2.6.18Owner Rights452
6.1.1.2.6.19Proxy452
6.1.1.2.6.20Remote Interactive Logon452
6.1.1.2.6.21Restricted452
6.1.1.2.6.22SChannel Authentication452
6.1.1.2.6.23Self453
6.1.1.2.6.24Service453
6.1.1.2.6.25System453
6.1.1.2.6.26Terminal Server User453
6.1.1.2.6.27This Organization453
6.1.1.2.7Extended Rights453
6.1.1.2.7.1controlAccessRight objects453
6.1.1.2.7.2Change-Rid-Master454
6.1.1.2.7.3Do-Garbage-Collection454
6.1.1.2.7.4Recalculate-Hierarchy454
6.1.1.2.7.5Allocate-Rids454
6.1.1.2.7.6Change-PDC454
6.1.1.2.7.7Add-GUID455
6.1.1.2.7.8Change-Domain-Master455
6.1.1.2.7.9Public-Information455
6.1.1.2.7.10msmq-Receive-Dead-Letter455
6.1.1.2.7.11msmq-Peek-Dead-Letter455
6.1.1.2.7.12msmq-Receive-computer-Journal455
6.1.1.2.7.13msmq-Peek-computer-Journal456
6.1.1.2.7.14msmq-Receive456
6.1.1.2.7.15msmq-Peek456
6.1.1.2.7.16msmq-Send456
6.1.1.2.7.17msmq-Receive-journal456
6.1.1.2.7.18msmq-Open-Connector457
6.1.1.2.7.19Apply-Group-Policy457
6.1.1.2.7.20RAS-Information457
6.1.1.2.7.21DS-Install-Replica457
6.1.1.2.7.22Change-Infrastructure-Master457
6.1.1.2.7.23Update-Schema-Cache457
6.1.1.2.7.24Recalculate-Security-Inheritance458
6.1.1.2.7.25DS-Check-Stale-Phantoms458
6.1.1.2.7.26Certificate-Enrollment458
6.1.1.2.7.27Self-Membership458
6.1.1.2.7.28Validated-DNS-Host-Name458
6.1.1.2.7.29Validated-SPN458
6.1.1.2.7.30Generate-RSoP-Planning459
6.1.1.2.7.31Refresh-Group-Cache459
6.1.1.2.7.32Reload-SSL-Certificate459
6.1.1.2.7.33SAM-Enumerate-Entire-Domain459
6.1.1.2.7.34Generate-RSoP-Logging459
6.1.1.2.7.35Domain-Other-Parameters460
6.1.1.2.7.36DNS-Host-Name-Attributes460
6.1.1.2.7.37Create-Inbound-Forest-Trust460
6.1.1.2.7.38DS-Replication-Get-Changes-All460
6.1.1.2.7.39Migrate-SID-History460
6.1.1.2.7.40Reanimate-Tombstones461
6.1.1.2.7.41Allowed-To-Authenticate461
6.1.1.2.7.42DS-Execute-Intentions-Script461
6.1.1.2.7.43DS-Replication-Monitor-Topology461
6.1.1.2.7.44Update-Password-Not-Required-Bit462
6.1.1.2.7.45Unexpire-Password462
6.1.1.2.7.46Enable-Per-User-Reversibly-Encrypted-Password462
6.1.1.2.7.47DS-Query-Self-Quota462
6.1.1.2.7.48Private-Information462
6.1.1.2.7.49MS-TS-GatewayAccess463
6.1.1.2.7.50Terminal-Server-License-Server463
6.1.1.2.7.51Domain-Administer-Server463
6.1.1.2.7.52User-Change-Password463
6.1.1.2.7.53User-Force-Change-Password463
6.1.1.2.7.54Send-As464
6.1.1.2.7.55Receive-As464
6.1.1.2.7.56Send-To464
6.1.1.2.7.57Domain-Password465
6.1.1.2.7.58General-Information465
6.1.1.2.7.59User-Account-Restrictions465
6.1.1.2.7.60User-Logon465
6.1.1.2.7.61Membership466
6.1.1.2.7.62Open-Address-Book466
6.1.1.2.7.63Personal-Information466
6.1.1.2.7.64Email-Information466
6.1.1.2.7.65Web-Information467
6.1.1.2.7.66DS-Replication-Get-Changes467
6.1.1.2.7.67DS-Replication-Synchronize467
6.1.1.2.7.68DS-Replication-Manage-Topology467
6.1.1.2.7.69Change-Schema-Master468
6.1.1.2.7.70DS-Replication-Get-Changes-In-Filtered-Set468
6.1.1.2.7.71Run-Protect-Admin-Groups-Task468
6.1.1.2.7.72Manage-Optional-Features468
6.1.1.2.7.73Read-Only-Replication-Secret-Synchronization468
6.1.1.2.7.74Validated-MS-DS-Additional-DNS-Host-Name469
6.1.1.2.7.75Validated-MS-DS-Behavior-Version469
6.1.1.2.7.76DS-Clone-Domain-Controller469
6.1.1.2.7.77Certificate-AutoEnrollment469
6.1.1.2.7.78DS-Read-Partition-Secrets469
6.1.1.2.7.79DS-Write-Partition-Secrets469
6.1.1.2.7.80DS-Set-Owner470
6.1.1.2.7.81DS-Bypass-Quota470
6.1.1.2.7.82DS-Validated-Write-Computer470
6.1.1.2.8Forest Updates Container470
6.1.1.2.8.1Operations Container471
6.1.1.2.8.2Windows2003Update Container471
6.1.1.2.8.3ActiveDirectoryUpdate Container471
6.1.1.2.8.4ActiveDirectoryRodcUpdate Container471
6.1.1.3Critical Domain Objects471
6.1.1.3.1Domain Controller Object472
6.1.1.3.2Read-Only Domain Controller Object473
6.1.1.4Well-Known Objects474
6.1.1.4.1Lost and Found Container476
6.1.1.4.2Deleted Objects Container476
6.1.1.4.3NTDS Quotas Container477
6.1.1.4.4Infrastructure Object477
6.1.1.4.5Domain Controllers OU477
6.1.1.4.6Users Container478
6.1.1.4.7Computers Container478
6.1.1.4.8Program Data Container478
6.1.1.4.9Managed Service Accounts Container478
6.1.1.4.10Foreign Security Principals Container478
6.1.1.4.11System Container479
6.1.1.4.11.1Password Settings Container479
6.1.1.4.12Builtin Container479
6.1.1.4.12.1Account Operators Group Object480
6.1.1.4.12.2Administrators Group Object480
6.1.1.4.12.3Backup Operators Group Object480
6.1.1.4.12.4Certificate Service DCOM Access Group Object480
6.1.1.4.12.5Cryptographic Operators Group Object480
6.1.1.4.12.6Distributed COM Users Group Object480
6.1.1.4.12.7Event Log Readers Group Object481
6.1.1.4.12.8Guests Group Object481
6.1.1.4.12.9IIS_IUSRS Group Object481
6.1.1.4.12.10Incoming Forest Trust Builders Group Object481
6.1.1.4.12.11Network Configuration Operators Group Object481
6.1.1.4.12.12Performance Log Users Group Object481
6.1.1.4.12.13Performance Monitor Users Group Object481
6.1.1.4.12.14Pre-Windows 2000 Compatible Access Group Object481
6.1.1.4.12.15Print Operators Group Object482
6.1.1.4.12.16Remote Desktop Users Group Object482
6.1.1.4.12.17Replicator Group Object482
6.1.1.4.12.18Server Operators Group Object482
6.1.1.4.12.19Terminal Server License Servers Group Object482
6.1.1.4.12.20Users Group Object482
6.1.1.4.12.21Windows Authorization Access Group Group Object482
6.1.1.4.13Roles Container482
6.1.1.4.13.1Administrators Group Object483
6.1.1.4.13.2Readers Group Object483
6.1.1.4.13.3Users Group Object483
6.1.1.4.13.4Instances Group Object483
6.1.1.5Other System Objects484
6.1.1.5.1AdminSDHolder Object484
6.1.1.5.2Default Domain Policy Container485
6.1.1.5.3Sam Server Object485
6.1.1.5.4Domain Updates Container485
6.1.1.5.4.1Operations Container486
6.1.1.5.4.2Windows2003Update Container486
6.1.1.5.4.3ActiveDirectoryUpdate Container486
6.1.1.6Well-Known Domain-Relative Security Principals486
6.1.1.6.1Administrator487
6.1.1.6.2Guest487
6.1.1.6.3Key Distribution Center Service Account487
6.1.1.6.4Cert Publishers487
6.1.1.6.5Domain Administrators487
6.1.1.6.6Domain Computers487
6.1.1.6.7Domain Controllers488
6.1.1.6.8Domain Guests488
6.1.1.6.9Domain Users488
6.1.1.6.10Enterprise Administrators488
6.1.1.6.11Group Policy Creator Owners488
6.1.1.6.12RAS and IAS Servers489
6.1.1.6.13Read-Only Domain Controllers489
6.1.1.6.14Enterprise Read-Only Domain Controllers489
6.1.1.6.15Schema Admins489
6.1.1.6.16Allowed RODC Password Replication Group489
6.1.1.6.17Denied RODC Password Replication Group490
6.1.2Forest Requirements490
6.1.2.1DC Existence490
6.1.2.2NC Existence491
6.1.2.3Hosting Requirements491
6.1.2.3.1DC and Application NC Replica491
6.1.2.3.2DC and Regular Domain NC Replica491
6.1.2.3.3DC and Schema/Config NC Replicas491
6.1.2.3.4DC and Partial Replica NCs Replicas492
6.1.3Security Descriptor Requirements492
6.1.3.1ACE Ordering Rules494
6.1.3.2SD Flags Control494
6.1.3.3Processing Specifics494
6.1.3.4Security Considerations496
6.1.3.5SD Defaulting Rules497
6.1.3.6Owner and Group Defaulting Rules497
6.1.3.7Default Administrators Group497
6.1.4Special Attributes498
6.1.4.1ntMixedDomain498
6.1.4.2msDS-Behavior-Version: DC Functional Level499
6.1.4.3msDS-Behavior-Version: Domain NC Functional Level499
6.1.4.4msDS-Behavior-Version: Forest Functional Level501
6.1.4.5Replication Schedule Structures502
6.1.4.5.1SCHEDULE_HEADER Structure502
6.1.4.5.2SCHEDULE Structure502
6.1.4.5.3REPS_FROM503
6.1.4.5.4REPS_TO503
6.1.4.5.5MTX_ADDR Structure503
6.1.4.5.6REPLTIMES Structure503
6.1.4.5.7PAS_DATA Structure503
6.1.4.6msDS-AuthenticatedAtDC503
6.1.5FSMO Roles504
6.1.5.1Schema Master FSMO Role504
6.1.5.2Domain Naming Master FSMO Role504
6.1.5.3RID Master FSMO Role504
6.1.5.4PDC Emulator FSMO Role505
6.1.5.5Infrastructure FSMO Role505
6.1.6Trust Objects506
6.1.6.1Overview (Synopsis)506
6.1.6.2Relationship to Other Protocols506
6.1.6.2.1TDO Replication over DRS506
6.1.6.2.2TDO Roles in Authentication Protocols over Domain Boundaries506
6.1.6.2.3TDO Roles in Authorization over Domain Boundaries506
6.1.6.3Prerequisites/Preconditions507
6.1.6.4Versioning and Capability Negotiation507
6.1.6.5Vendor-Extensible Fields507
6.1.6.6Transport507
6.1.6.7Essential Attributes of a Trusted Domain Object507
6.1.6.7.1flatName508
6.1.6.7.2isCriticalSystemObject508
6.1.6.7.3msDs-supportedEncryptionTypes508
6.1.6.7.4msDS-TrustForestTrustInfo508
6.1.6.7.5nTSecurityDescriptor509
6.1.6.7.6objectCategory509
6.1.6.7.7objectClass509
6.1.6.7.8securityIdentifier509
6.1.6.7.9trustAttributes509
6.1.6.7.10trustAuthIncoming511
6.1.6.7.11trustAuthOutgoing511
6.1.6.7.12trustDirection512
6.1.6.7.13trustPartner512
6.1.6.7.14trustPosixOffset512
6.1.6.7.15trustType512
6.1.6.8Essential Attributes of Interdomain Trust Accounts513
6.1.6.8.1cn (RDN)513
6.1.6.8.2objectClass513
6.1.6.8.3sAMAccountName513
6.1.6.8.4sAMAccountType513
6.1.6.8.5userAccountControl514
6.1.6.9Details514
6.1.6.9.1trustAuthInfo Attributes514
6.1.6.9.1.1LSAPR_AUTH_INFORMATION515
6.1.6.9.1.2Kerberos Usages of trustAuthInfo Attributes516
6.1.6.9.2Netlogon Usages of Trust Objects516
6.1.6.9.3msDS-TrustForestTrustInfo Attribute517
6.1.6.9.3.1Record517
6.1.6.9.3.2Building Well-Formed msDS-TrustForestTrustInfo Messages520
6.1.6.9.4Computation of trustPosixOffset523
6.1.6.9.5Mapping Logon SIDs to POSIX Identifiers523
6.1.6.9.6Timers523
6.1.6.9.6.1Trust Secret Cycling523
6.1.6.9.7Initialization523
6.1.6.10Security Considerations for Implementers524
6.1.7DynamicObject Requirements524
6.2Knowledge Consistency Checker525
6.2.1References525
6.2.2Overview525
6.2.2.1Refresh kCCFailedLinks and kCCFailedConnections527
6.2.2.2Intrasite Connection Creation528
6.2.2.3Intersite Connection Creation530
6.2.2.3.1ISTG Selection531
6.2.2.3.2Merge of kCCFailedLinks and kCCFailedLinks from Bridgeheads532
6.2.2.3.3Site Graph Concepts532
6.2.2.3.4Connection Creation533
6.2.2.3.4.1Types534
6.2.2.3.4.2Main Entry Point535
6.2.2.3.4.3Site Graph Construction536
6.2.2.3.4.4Spanning Tree Computation539
6.2.2.3.4.5nTDSConnection Creation549
6.2.2.4Removing Unnecessary Connections553
6.2.2.5Connection Translation554
6.2.2.6Remove Unneeded kCCFailedLinks and kCCFailedConnections Tuples555
6.2.2.7Updating the RODC NTFRS Connection Object555
6.3Publishing and Locating a Domain Controller556
6.3.1Structures and Constants557
6.3.1.1NETLOGON_NT_VERSION Options Bits557
6.3.1.2DS_FLAG Options Bits558
6.3.1.3Operation Code559
6.3.1.4NETLOGON_LOGON_QUERY559
6.3.1.5NETLOGON_PRIMARY_RESPONSE560
6.3.1.6NETLOGON_SAM_LOGON_REQUEST561
6.3.1.7NETLOGON_SAM_LOGON_RESPONSE_NT40562
6.3.1.8NETLOGON_SAM_LOGON_RESPONSE563
6.3.1.9NETLOGON_SAM_LOGON_RESPONSE_EX564
6.3.1.10DNSRegistrationSettings567
6.3.2DNS Record Registrations569
6.3.2.1Timers570
6.3.2.1.1Register DNS Records Timer570
6.3.2.2Non-Timer Events570
6.3.2.2.1Force Register DNS Records Non-Timer Event570
6.3.2.3SRV Records570
6.3.2.4Non-SRV Records573
6.3.3LDAP Ping574
6.3.3.1Syntactic Validation of the Filter575
6.3.3.2Domain Controller Response to an LDAP Ping576
6.3.3.3Response to Invalid Filter581
6.3.4NetBIOS Broadcast and NBNS Background581
6.3.5Mailslot Ping581
6.3.6Locating a Domain Controller584
6.3.6.1DNS-Based Discovery584
6.3.6.2NetBIOS-Based Discovery585
6.3.7Name Compression and Decompression585
6.3.8AD LDS DC Publication587
6.4Domain Join588
6.4.1State of a Machine Joined to a Domain588
6.4.2State in an Active Directory Domain589
6.4.3Relationship to Protocols590
6.5Unicode String Comparison590
6.5.1String Comparison by Using Sort Keys590
6.6Claims.idl591
7Communication Details for Active Directory Connections593
7.1Connection Resolution of LDAP Clients593
7.2ADConnection Overview593
7.3ADConnection Abstract Data Model596
7.4Handling Network Errors598
7.5ICMP Pings599
7.6Tasks and Events599
7.6.1Tasks600
7.6.1.1Initializing an ADConnection600
7.6.1.2Setting an LDAP Option on an ADConnection601
7.6.1.3Establishing an ADConnection602
7.6.1.4Performing an LDAP Bind on an ADConnection602
7.6.1.5Performing an LDAP Unbind on an ADConnection603
7.6.1.6Performing an LDAP Operation on an ADConnection603
7.6.2Internal Tasks604
7.6.2.1Initializing a Connection to a Directory Server604
7.6.2.2Connecting to a Directory Server605
7.6.2.3Performing an LDAP Bind Against a Directory Server607
7.6.2.4Performing an LDAP Unbind Against a Directory Server608
7.6.2.5Performing an LDAP Operation Against a Directory Server608
7.6.2.6Following an LDAP Referral or Continuation Reference609
7.6.2.7Autoreconnecting to a Directory Server611
7.6.3External Triggered Events612
7.6.3.1Processing Network Errors612
7.6.3.2Getting an LDAP Response from a Directory Server613
7.6.4Timer Triggered Events614
7.6.4.1Timer Expiry on RequestTimer614
7.7LDAP Over UDP615
7.7.1ADUDPHandle Overview615
7.7.2ADUDPHandle Abstract Data Model615
7.7.3Tasks616
7.7.3.1Initializing an ADUDPHandle616
7.7.3.2Performing an LDAP Operation on an ADUDPHandle616
7.8Transport Requirements619
7.9Security Elements619
7.10Communications Security619
8Change Tracking621
9Index622
Introduction
This is the primary specification for Active Directory, both Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). When the specification does not refer specifically to AD DS or AD LDS, it applies to both. The state model for this specification is prerequisite to the other specifications for Active Directory: [MS-DRSR] and [MS-SRPL].
When no operating system version information is specified, information in this document applies to all relevant versions of Windows. Similarly, when no DC functional level is specified, information in this document applies to all DC functional levels.
AD DS first became available as part of Microsoft Windows 2000 operating system and is available as part of Windows 2000 Server operating system products and Windows Server 2003 operating system products; in these products it is called "Active Directory". It is also available as part of Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, Windows Server 2016 operating system, and Windows Server operating system. AD DS is not present in Windows NT 3.1 operating system, Windows NT 3.51 operating system, Windows NT 4.0 operating system, or Windows XP operating system.
Unless otherwise specified, information in this specification is also applicable to Active Directory Application Mode (ADAM). ADAM is a standalone application that provides AD LDS capabilities on Windows XP and Windows Server 2003. There are two versions of ADAM, ADAM RTW and ADAM SP1; unless otherwise specified, where ADAM is discussed in this document it refers to both versions.
Information that is applicable to AD LDS on Windows Server 2008 is also applicable to Active Directory Lightweight Directory Services (AD LDS) for Windows Vista, except where it is explicitly specified that such information is not applicable to that product. AD LDS for Windows Vista is a standalone application that provides AD LDS capabilities for Windows Vista operating system. Similarly, unless it is explicitly specified otherwise, information that is applicable to AD LDS on Windows Server 2008 R2 is also applicable to the standalone application Active Directory Lightweight Directory Services (AD LDS) for Windows 7, which provides AD LDS capabilities for Windows 7 operating system. Similarly, unless it is explicitly specified otherwise, information that is applicable to AD LDS on Windows Server 2012 is also applicable to the stand-alone application Active Directory Lightweight Directory Services (AD LDS) for Windows 8 operating system, which provides AD LDS capabilities for Windows 8 operating system. Similarly, unless it is explicitly specified otherwise, information that is applicable to AD LDS on Windows Server 2012 R2 is also applicable to the stand-alone application Active Directory Lightweight Directory Services (AD LDS) for Windows 8.1 operating system, which provides AD LDS capabilities for Windows 8.1 operating system. Similarly, unless it is explicitly specified otherwise, information that is applicable to AD LDS on Windows Server 2016 is also applicable to the stand-alone application Active Directory Lightweight Directory Services (AD LDS) for Windows 10 operating system, which provides AD LDS capabilities for Windows 10 operating system. Finally, unless it is explicitly specified otherwise, information that is applicable to AD LDS on Windows Server operating system is also applicable to the stand-alone application AD LDS for Windows 10 v1703 operating system and Windows 10 v1709 operating system, which provides AD LDS capabilities for those versions of Windows 10.
State is included in the state model for this specification only as necessitated by the requirement that a licensee implementation of the protocols of applicable Windows Server releases has to be capable of receiving messages and responding in the same manner as applicable Windows Server releases. Behavior is specified in terms of request message received, processing based on current state, resulting state transformation, and response message sent. Unless otherwise specified in the sections that follow, all of the behaviors are required for interoperability.
The following typographical convention is used to indicate the special meaning of certain names:
· Underline, as in instanceType: the name of an attribute or object class whose interpretation is specified in the following documents:
· [MS-ADA1] Attribute names whose initial letter is A through L.
· [MS-ADA2] Attribute names whose initial letter is M.
· [MS-ADA3] Attribute names whose initial letter is N through Z.
· [MS-ADSC] Object class names.
· [MS-ADLS] Object class names and attribute names for AD LDS.
For clarity, bit flags are sometimes shown as bit field diagrams. In the case of bit flags for Lightweight Directory Access Protocol (LDAP) attributes, these diagrams take on big-endian characteristics but do not reflect the actual byte ordering of integers over the wire, because LDAP transfers an integer as the UTF-8 string of the decimal representation of that integer, as specified in [RFC2252].
Pervasive Concepts
The following concepts are pervasive throughout this specification.
This specification uses [KNUTH1] section 2.3.4.2 as a reference for the graph-related terms oriented tree, root, vertex, arc, initial vertex, and final vertex.
replica: A variable containing a set of objects.
attribute: An identifier for a value or set of values. See also attribute in the Glossary (section 1.1).
object: A set of attributes, each with its associated values. Two attributes of an object have special significance:
· Identifying attribute: A designated single-valued attribute appears on every object. The value of this attribute identifies the object. For the set of objects in a replica, the values of the identifying attribute are distinct.
· Parent-identifying attribute: A designated single-valued attribute appears on every object. The value of this attribute identifies the object's parent. That is, this attribute contains the value of the parent's identifying attribute or a reserved value identifying no object (for more information, see section 3.1.1.1.3). For the set of objects in a replica, the values of this parent-identifying attribute define an oriented tree with objects as vertices and child-parent references as directed arcs, with the child as an arc's initial vertex and the parent as an arc's final vertex.
Note that an object is a value, not a variable; a replica is a variable. The process of adding, modifying, or deleting an object in a replica replaces the entire value of the replica with a new value.
As the term "replica" suggests, it is often the case that two replicas contain "the same objects". In this usage, objects in two replicas are considered "the same" if they have the same value of the identifying attribute and if there is a process in place (that is, replication) to converge the values of the remaining attributes. When the members of a set of replicas are considered to be the same, it is common to say "an object" as a shorthand way of referring to the set of corresponding objects in the replicas.
object class: A set of restrictions on the construction and update of objects. An object class must be specified when an object is created. An object class specifies a set of must-have attributes (every object of the class must have at least one value of each) and may-have attributes (every object of the class may have a value of each). An object class also specifies a set of possible superiors (the parent object of an object of the class must have one of these classes). An object class is defined by a classSchema object.
parent object: See "object", above.
child object, children: An object that is not the root of its oriented tree. The children of an object O is the set of all objects whose parent object is O.
See section 3.1.1.1.3 for the particular use made of these definitions in this specification.
Glossary
This document uses the following terms:
88 object class: An object class as specified in the X.500 directory specification ([X501] section 8.4.3). An 88 object class can be instantiated as a new object, like a structural object class, and on an existing object, like an auxiliary object class.
abstract object class: An object class whose only function is to be the basis of inheritance by other object classes, thereby simplifying their definition.
access check: A verification to determine whether a specific access type is allowed by checking a security context against a security descriptor.
access control entry (ACE): An entry in an access control list (ACL) that contains a set of user rights and a security identifier (SID) that identifies a principal for whom the rights are allowed, denied, or audited.
access control list (ACL): A list of access control entries (ACEs) that collectively describe the security rules for authorizing access to some resource; for example, an object or set of objects.
access mask: A 32-bit value present in an access control entry (ACE) that specifies the allowed or denied rights to manipulate an object.
account domain: A domain, identified by a security identifier (SID), that is the SID namespace for which a given machine is authoritative. The account domain is the same as the primary domain for a domain controller (DC) and is its default domain. For a machine that is joined to a domain, the account domain is the SID namespace defined by the local Security Accounts Manager [MS-SAMR].
ACID: A term that refers to the four properties that any database system must achieve in order to be considered transactional: Atomicity, Consistency, Isolation, and Durability [GRAY].
active: A state of an attributeSchema or classSchema object that represents part of the schema. It is possible to instantiate an active attribute or an active class. The opposite term is defunct.
Active Directory: A general-purpose network directory service. Active Directory also refers to the Windows implementation of a directory service. Active Directory stores information about a variety of objects in the network. User accounts, computer accounts, groups, and all related credential information used by the Windows implementation of Kerberos are stored in Active Directory. Active Directory is either deployed as Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS). [MS-ADTS] describes both forms. For more information, see [MS-AUTHSOD] section 1.1.1.5.2, Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Kerberos, and DNS.
Active Directory Domain Services (AD DS): A directory service (DS) implemented by a domain controller (DC). The DS provides a data store for objects that is distributed across multiple DCs. The DCs interoperate as peers to ensure that a local change to an object replicates correctly across DCs. For more information, see [MS-AUTHSOD] section 1.1.1.5.2 and [MS-ADTS]. For information about product versions, see [MS-ADTS] section 1. See also Active Directory.
Active Directory Lightweight Directory Services (AD LDS): A directory service (DS) implemented by a domain controller (DC). The most significant difference between AD LDS and Active Directory Domain Services (AD DS) is that AD LDS does not host domain naming contexts (domain NCs). A server can host multiple AD LDS DCs. Each DC is an independent AD LDS instance, with its own independent state. AD LDS can be run as an operating system DS or as a directory service provided by a standalone application (ADAM). For more information, see [MS-ADTS]. See also Active Directory.
ambiguous name resolution (ANR): A search algorithm that permits a client to search multiple naming-related attributes on objects by way of a single clause of the form "(anr=value)" in a Lightweight Directory Access Protocol (LDAP) search filter. This permits a client to query for an object when the client possesses some identifying material related to the object but does not know which attribute of the object contains that identifying material.
application naming context (application NC): A specific type of naming context (NC), or an instance of that type, that supports only full replicas (no partial replicas). An application NC cannot contain security principal objects in Active Directory Domain Services (AD DS), but can contain security principal objects in Active Lightweight Directory Services (AD LDS). A forest can have zero or more application NCs in either AD DS or AD LDS. An application NC can contain dynamic objects. Application NCs do not appear in the global catalog (GC). The root of an application NC is an object of class domainDNS.
attribute: An identifier for a single or multivalued data element that is associated with a directory object. An object consists of its attributes and their values. For example, cn (common name), street (street address), and mail (email addresses) can all be attributes of a user object. An attribute's schema, including the syntax of its values, is defined in an attributeSchema object.
attribute syntax: Specifies the format and range of permissible values of an attribute. The syntax of an attribute is defined by several attributes on the attributeSchema object, as specified in [MS-ADTS] section 3.1.1.2. Attribute syntaxes supported by Active Directory include Boolean, Enumeration, Integer, LargeInteger, String(UTC-Time), Object(DS-DN), and String(Unicode).
AttributeStamp: The type of a stamp attached to an attribute.
ATTRTYP: A 32-bit quantity representing an object identifier (OID). See [MS-DRSR] section 5.14.
authentication: The act of proving an identity to a server while providing key material that binds the identity to subsequent communications.
authorization: The secure computation of roles and accesses granted to an identity.
auxiliary object class: An object class that cannot be instantiated in the directory but can be either added to, or removed from, an existing object to make its attributes available for use on that object; or associated with an abstract or structural object class to add its attributes to that abstract or structural object class.
back link attribute: A constructed attribute whose values include object references (for example, an attribute of syntax Object(DS-DN)). The back link values are derived from the values of a related attribute, a forward link attribute, on other objects. If f is the forward link attribute, one back link value exists on object o for each object r that contains a value of o for attribute f. The relationship between the forward link attributes and back link attributes is expressed using the linkId attribute on the attributeSchema objects representing the two attributes. The forward link's linkId is an even number, and the back link's linkId is the forward link's linkId plus one. For more information, see [MS-ADTS] section 3.1.1.1.6.
back link value: The value of a back link attribute.
backup domain controller (BDC): A domain controller (DC) that receives a copy of the domain directory database from the primary domain controller (PDC). This copy is synchronized periodically and automatically with the primary domain controller (PDC). BDCs also authenticate user logons and can be promoted to function as the PDC. There is only one PDC or PDC emulator in a domain, and the rest are backup domain controllers.
Basic Encoding Rules (BER): A set of encoding rules for ASN.1 notation. These encoding schemes allow the identification, extraction, and decoding of data structures. These encoding rules are defined in [ITUX690].
big-endian: Multiple-byte values that are byte-ordered with the most significant byte stored in the memory location with the lowest address.
binary large object (BLOB): A collection of binary data stored as a single entity in a database.
bridgehead domain controller (bridgehead DC): A domain controller (DC) that may replicate updates to or from DCs in sites other than its own.
broadcast: A style of resource location or data transmission in which a client makes a request to all parties on a network simultaneously (a one-to-many communication). Also, a mode of resource location that does not use a name service.
built-in domain: The security identifier (SID) namespace defined by the fixed SID S-1-5-32. Contains groups that define roles on a local machine such as Backup Operators.
built-in domain SID: The fixed SID S-1-5-32.
canonical name: A syntactic transformation of an Active Directory distinguished name (DN) into something resembling a path that still identifies an object within a forest. DN "cn=Peter Houston, ou=NTDEV, dc=microsoft, dc=com" translates to the canonical name "microsoft.com/NTDEV/Peter Houston", while the DN "dc=microsoft, dc=com" translates to the canonical name "microsoft.com/".
child naming context (child NC): Given naming contexts (NCs) with their corresponding distinguished names (DNs) forming a child and parent relationship, the NC in the child relationship is referred as the child NC. The parent of a child NC must be an NC and is referred to as the parent naming context (parent NC).
child object, children: An object that is not the root of its tree. The children of an object o are the set of all objects whose parent is o. See section 1 of [MS-ADTS] and section 1 of [MS-DRSR].
claim: An assertion about a security principal expressed as the n-tuple {Identifier, ValueType, m Value(s) of type ValueType} where m is greater than or equal to 1. A claim with only one Value in the n-tuple is called a single-valued claim; a claim with more than one Value is called a multi-valued claim.
code page: An ordered set of characters of a specific script in which a numerical index (code-point value) is associated with each character. Code pages are a means of providing support for character sets and keyboard layouts used in different countries. Devices such as the display and keyboard can be configured to use a specific code page and to switch from one code page (such as the United States) to another (such as Portugal) at the user's request.
Component Object Model (COM): An object-oriented programming model that defines how objects interact within a single process or between processes. In COM, clients have access to an object through interfaces implemented on the object. For more information, see [MS-DCOM].
computer object: An object of class computer. A computer object is a security principal object; the principal is the operating system running on the computer. The shared secret allows the operating system running on the computer to authenticate itself independently of any user running on the system. See security principal.
configuration naming context (config NC): A specific type of naming context (NC), or an instance of that type, that contains configuration information. In Active Directory, a single config NC is shared among all domain controllers (DCs) in the forest. A config NC cannot contain security principal objects.
constructed attribute: An attribute whose values are computed from normal attributes (for read) and/or have effects on the values of normal attributes (for write).
container: An object in the directory that can serve as the parent for other objects. In the absence of schema constraints, all objects would be containers. The schema allows only objects of specific classes to be containers.
control access right: An extended access right that can be granted or denied on an access control list (ACL).
Coordinated Universal Time (UTC): A high-precision atomic time standard that approximately tracks Universal Time (UT). It is the basis for legal, civil time all over the Earth. Time zones around the world are expressed as positive and negative offsets from UTC. In this role, it is also referred to as Zulu time (Z) and Greenwich Mean Time (GMT). In these specifications, all references to UTC refer to the time at UTC-0 (or GMT).
cross-forest trust: A relationship between two forests that enables security principals from any domain in one forest to authenticate to computers joined to any domain in the other forest.
crossRef object: An object residing in the partitions container of the config NC that describes the properties of a naming context (NC), such as its domain naming service name, operational settings, and so on.
DC functional level: A specification of functionality available in a domain controller (DC). See [MS-ADTS] section 6.1.4.2 for possible values and a mapping between the possible values and product versions.
default domain naming context (default domain NC): When Active Directory is operating as Active Directory Domain Services (AD DS), this is the default naming context (default NC) of the domain controller (DC). When operating as Active Directory Lightweight Directory Services (AD LDS), this NC is not defined.
default naming context (default NC): When Active Directory is operating as Active Directory Domain Services (AD DS), the default naming context (default NC) is the domain naming context (domain NC) whose full replica is hosted by a domain controller (DC), except when the DC is a read-only domain controller (RODC), in which case the default NC is a filtered partial NC replica. When operating as AD DS, a DC's default NC is the NC of its default NC replica, and the default NC contains the DC's computer object. When Active Directory is operating as AD LDS, the default NC is the naming context (NC) specified by the msDS-DefaultNamingContext attribute on the nTDSDSA object for the DC. See nTDSDSA object.
default schema: The schema of a given version of Active Directory, as defined by [MS-ADSC], [MS-ADA1], [MS-ADA2], and [MS-ADA3] for AD DS, and as defined by [MS-ADLS] for Active Directory Lightweight Directory Services (AD LDS).
defunct: A state of an attributeSchema or classSchema object that represents part of the schema. It is not possible to instantiate a defunct attribute or a defunct class. The opposite term is active.
deleted-object: An object that has been deleted, but remains in storage until a configured amount of time (the deleted-object lifetime) has passed, after which the object is transformed to a recycled-object. Unlike a recycled-object or a tombstone, a deleted-object maintains virtually all the state of the object before deletion, and can be undeleted without loss of information. Deleted-objects exist only when the Recycle Bin optional feature is enabled.
deleted-object lifetime: The time period that a deleted-object is kept in storage before it is transformed into a recycled-object.
digest: The fixed-length output string from a one-way hash function that takes a variable-length input string and is probabilistically unique for every different input string. Also, a cryptographic checksum of a data (octet) stream.
directory: A forest.
directory object: An Active Directory object, which is a specialization of the "object" concept that is described in [MS-ADTS] section 1 or [MS-DRSR] section 1, Introduction, under Pervasive Concepts. An Active Directory object can be identified by the objectGUID attribute of a dsname according to the matching rules defined in [MS-DRSR] section 5.50, DSNAME. The parent-identifying attribute (not exposed as an LDAP attribute) is parent. Active Directory objects are similar to LDAP entries, as defined in [RFC2251]; the differences are specified in [MS-ADTS] section 3.1.1.3.1.
directory service (DS): A service that stores and organizes information about a computer network's users and network shares, and that allows network administrators to manage users' access to the shares. See also Active Directory.
directory service agent (DSA): A term from the X.500 directory specification [X501] that represents a component that maintains and communicates directory information.
discretionary access control list (DACL): An access control list (ACL) that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.
distinguished name (DN): In Lightweight Directory Access Protocol (LDAP), an LDAP Distinguished Name, as described in [RFC2251] section 4.1.3. The DN of an object is the DN of its parent, preceded by the RDN of the object. For example: CN=David Thompson, OU=Users, DC=Microsoft, DC=COM. For definitions of CN and OU, see [RFC2256] sections 5.4 and 5.12, respectively.
DNS name: A fully qualified domain name (FQDN).
domain: A set of users and computers sharing a common namespace and management infrastructure. At least one computer member of the set must act as a domain controller (DC) and host a member list that identifies all members of the domain, as well as optionally hosting the Active Directory service. The domain controller provides authentication of members, creating a unit of trust for its members. Each domain has an identifier that is shared among its members. For more information, see [MS-AUTHSOD] section 1.1.1.5 and [MS-ADTS].
domain controller (DC): The service, running on a server, that implements Active Directory, or the server hosting this service. The service hosts the data store for objects and interoperates with other DCs to ensure that a local change to an object replicates correctly across all DCs. When Active Directory is operating as Active Directory Domain Services (AD DS), the DC contains full NC replicas of the configuration naming context (config NC), schema naming context (schema NC), and one of the domain NCs in its forest. If the AD DS DC is a global catalog server (GC server), it contains partial NC replicas of the remaining domain NCs in its forest. For more information, see [MS-AUTHSOD] section 1.1.1.5.2 and [MS-ADTS]. When Active Directory is operating as Active Directory Lightweight Directory Services (AD LDS), several AD LDS DCs can run on one server. When Active Directory is operating as AD DS, only one AD DS DC can run on one server. However, several AD LDS DCs can coexist with one AD DS DC on one server. The AD LDS DC contains full NC replicas of the config NC and the schema NC in its forest. The domain controller is the server side of Authentication Protocol Domain Support [MS-APDS].
domain functional level: A specification of functionality available in a domain. Must be less than or equal to the DC functional level of every domain controller (DC) that hosts a replica of the domain's naming context (NC). For information on defined levels, corresponding features, information on how the domain functional level is determined, and supported domain controllers, see [MS-ADTS] sections 6.1.4.2 and 6.1.4.3. When Active Directory is operating as Active Directory Lightweight Directory Services (AD LDS), domain functional level does not exist.
domain joined: A relationship between a machine and some domain naming context (domain NC) in which they share a secret. The shared secret allows the machine to authenticate to a domain controller (DC) for the domain.
domain local group: An Active Directory group that allows user objects, global groups, and universal groups from any domain as members. It can additionally include, and be a member of, other domain local groups from within its domain. A group object g is a domain local group if and only if GROUP_TYPE_RESOURCE_GROUP is present in g!groupType; see [MS-ADTS] section 2.2.12, "Group Type Flags". A security-enabled domain local group is valid for inclusion within access control lists (ACLs) from its own domain. If a domain is in mixed mode, then a security-enabled domain local group in that domain allows only user objects as members.
domain name: A domain name or a NetBIOS name that identifies a domain.
Domain Name System (DNS): A hierarchical, distributed database that contains mappings of domain names to various types of data, such as IP addresses. DNS enables the location of computers and services by user-friendly names, and it also enables the discovery of other information stored in the database.
domain naming context (domain NC): A specific type of naming context (NC), or an instance of that type, that represents a domain. A domain NC can contain security principal objects; no other type of NC can contain security principal objects. Domain NCs appear in the global catalog (GC). A domain NC is hosted by one or more domain controllers (DCs) operating as AD DS. In AD DS, a forest has one or more domain NCs. A domain NC cannot exist in AD LDS. The root of a domain NC is an object of class domainDNS; for directory replication [MS-DRSR], see domainDNS.
domain prefix: A security identifier (SID) of a domain without the relative identifier (RID) portion. The domain prefix refers to the issuing authority SID. For example, the domain prefix of S-1-5-21-397955417-626881126-188441444-1010 is S-1-5-21-397955417-626881126-188441444.
downlevel trust: A trust in which one of the peers is running Windows NT 4.0.
DSA GUID: The objectGUID of a DSA object.
dsname: A tuple that contains between one and three identifiers for an object. The term dsname does not stand for anything. The possible identifiers are the object's GUID (attribute objectGuid), security identifier (SID) (attribute objectSid), and distinguished name (DN) (attribute distinguishedName). A dsname can appear in a protocol message and as an attribute value (for example, a value of an attribute with syntax Object(DS-DN)). Given a DSName, an object can be identified within a set of NC replicas according to the matching rules defined in [MS-DRSR] section 5.49.
dynamic object: An object with a time-to-die (attribute msDS-Entry-Time-To-Die). The directory service garbage-collects a dynamic object immediately after its time-to-die has passed. The constructed attribute entryTTL gives a dynamic object's current time-to-live, that is, the difference between the current time and msDS-Entry-Time-To-Die. For more information, see [RFC2589].
entry: In Active Directory, a synonym for object.
existing-object: An object that is not a tombstone, deleted-object, or recycled-object.
expunge: To permanently remove an object from a naming context (NC) replica, without converting it to a tombstone.
Extended-Rights container: A container holding objects that correspond to control access rights. The container is a child of configuration naming context (config NC) and has relative distinguished name (RDN) CN=Extended-Rights.
File Replication Service (FRS): One of the services offered by a domain controller (DC), which is advertised through the Domain Controller Location protocol. The service being offered to clients is a replicated data storage volume that is associated with the default naming context (NC). The running or paused state of the FRS on a DC is available through protocols documented in [MS-ADTS] section 6.3.
filter: In the context of the Lightweight Directory Access Protocol (LDAP), the filter is one of the parameters in a search request. The filter specifies matching constraints for the candidate objects.
filtered attribute set: The subset of attributes that are not replicated to the filtered partial NC replica and the filtered GC partial NC replica. The filtered attribute set is part of the state of the forest and is used to control the attributes that replicate to a read-only domain controller (RODC). The searchFlags schema attribute is used to define this set.
filtered GC partial NC replica: An NC replica that contains a schema-specified subset of attributes for the objects. The attributes consist of the attributes in the GC partial attribute set (PAS), excluding those present in the filtered attribute set. A filtered GC partial NC replica is not writable; that is, it does not accept originating updates.
filtered partial NC replica: An NC replica that contains a schema-specified subset of attributes for the objects it contains. The subset of attributes consists of all the attributes of the objects, excluding those attributes in the filtered attribute set. A filtered partial NC replica is not writable; that is, it does not accept originating updates.
flexible single master operation (FSMO): A read or update operation on a naming context (NC), such that the operation must be performed on the single designated master replica of that NC. The master replica designation is "flexible" because it can be changed without losing the consistency gained from having a single master. This term, pronounced "fizmo", is never used alone; see also FSMO role, FSMO role owner, and FSMO object.
foreign principal object (FPO): A foreignSecurityPrincipal object.
forest: For Active Directory Domain Services (AD DS), a set of naming contexts (NCs) consisting of one schema naming context (schema NC), one configuration naming context (config NC), one or more domain naming contexts (domain NCs), and zero or more application naming contexts (application NCs). Because a set of NCs can be arranged into a tree structure, a forest is also a set containing one or several trees of NCs. For AD LDS, a set of NCs consisting of one schema NC, one config NC, and zero or more application NCs. (In Microsoft documentation, an AD LDS forest is called a "configuration set".)
forest functional level: A specification of functionality available in a forest. It must be less than or equal to the domain controller (DC) functional level of every DC in the forest. See [MS-ADTS] section 6.1.4.4 for information on how the forest functional level is determined.
forest root domain NC: For Active Directory Domain Services (AD DS), the domain naming context (domain NC) within a forest whose child is the forest's configuration naming context (config NC). The fully qualified domain name (FQDN) of the forest root domain NC serves as the forest's name.
forward link attribute: An attribute whose values include object references (for example, an attribute of syntax Object(DS-DN)). The forward link values can be used to compute the values of a related attribute, a back link attribute, on other objects. If an object o refers to object r in forward link attribute f, and there exists a back link attribute b corresponding to f, then a back link value referring to o exists in attribute b on object r. The relationship between the forward and back link attributes is expressed using the linkId attribute on the attributeSchema objects representing the two attributes. The forward link's linkId is an even number, and the back link's linkId is the forward link's linkId plus one. A forward link attribute can exist with no corresponding back link attribute, but not vice-versa. For more information, see [MS-ADTS].
forward link value: The value of a forward link attribute.
FSMO role: A set of objects that can be updated in only one naming context (NC) replica (the FSMO role owner's replica) at any given time. For more information, see [MS-ADTS] section 3.1.1.1.11. See also FSMO role owner.
FSMO role object: An object in a directory that represents a specific FSMO role. This object is an element of the FSMO role and contains the fSMORoleOwner attribute.
FSMO role owner: The domain controller (DC) holding the naming context (NC) replica in which the objects of a FSMO role can be updated.
full NC replica: A naming context (NC) replica that contains all the attributes of the objects it contains. A full replica accepts originating updates.
fully qualified domain name (FQDN): (1) An unambiguous domain name that gives an absolute location in the Domain Name System's (DNS) hierarchy tree, as defined in [RFC1035] section 3.1 and [RFC2181] section 11.
(2) In Active Directory, a fully qualified domain name (FQDN) (1) that identifies a domain.
garbage collection: The process of identifying logically deleted objects (also known as tombstones) and link values that have passed their tombstone lifetime, and then permanently removing these objects from a naming context (NC) replica. Garbage collection does not generate replication traffic.
GC partial attribute set (PAS): The subset of attributes that replicate to a GC partial NC replica. A particular GC partial attribute set (PAS) is part of the state of the forest and is used to control the attributes that replicate to global catalog servers (GC servers). The isMemberOfPartialAttributeSet schema attribute is used to define this set.
GC partial NC replica: An NC replica that contains a schema-specified subset of attributes for the objects it contains. The subset of attributes consists of the attributes in the GC partial attribute set (PAS). A GC partial NC replica is not writable; for example, it does not accept originating updates.
global catalog (GC): A unified partial view of multiple naming contexts (NCs) in a distributed partitioned directory. The Active Directory directory service GC is implemented by GC servers. The definition of global catalog is specified in [MS-ADTS] section 3.1.1.1.8.
global catalog server (GC server): A domain controller (DC) that contains a naming context (NC) replica (one full, the rest partial) for each domain naming context in the forest.
global group: An Active Directory group that allows user objects from its own domain and global groups from its own domain as members. Also called domain global group. Universal groups can contain global groups. A group object g is a global group if and only if GROUP_TYPE_ACCOUNT_GROUP is present in g! groupType; see [MS-ADTS] section 2.2.12, "Group Type Flags". A global group that is also a security-enabled group is valid for inclusion within ACLs anywhere in the forest. If a domain is in mixed mode, then a global group in that domain that is also a security-enabled group allows only user object as members. See also domain local group, security-enabled group.
globally unique identifier (GUID): A term used interchangeably with universally unique identifier (UUID) in Microsoft protocol technical documents (TDs). Interchanging the usage of these terms does not imply or require a specific algorithm or mechanism to generate the value. Specifically, the use of this term does not imply or require that the algorithms described in [RFC4122] or [C706] must be used for generating the GUID. See also universally unique identifier (UUID).
group: A collection of objects that can be treated as a whole.
group object: In Active Directory, a group object has an object class group. A group has a