Microsoft Network Logon (rpc_netlogon)

Table 158. Microsoft Network Logon (rpc_netlogon)

FieldField NameTypeDescription
netlogon.acct.expiry_timeAcct Expiry TimeDate/Time stampWhen this account will expire
netlogon.acct_descAcct DescStringAccount Description
netlogon.acct_nameAcct NameStringAccount Name
netlogon.alias_nameAlias NameStringAlias Name
netlogon.alias_ridAlias RIDUnsigned 32-bit integer 
netlogon.attrsAttributesUnsigned 32-bit integerAttributes
netlogon.audit_retention_periodAudit Retention PeriodTime durationAudit retention period
netlogon.auditing_modeAuditing ModeUnsigned 8-bit integerAuditing Mode
netlogon.auth.dataAuth DataByte arrayAuth Data
netlogon.auth.sizeAuth SizeUnsigned 32-bit integerSize of AuthData in bytes
netlogon.auth_flagsAuth FlagsUnsigned 32-bit integer 
netlogon.authoritativeAuthoritativeUnsigned 8-bit integer 
netlogon.bad_pw_countBad PW CountUnsigned 32-bit integerNumber of failed logins
netlogon.bad_pw_count16Bad PW CountUnsigned 16-bit integerNumber of failed logins
netlogon.blobBLOBByte arrayBLOB
netlogon.blob.sizeSizeUnsigned 32-bit integerSize in bytes of BLOB
netlogon.challengeChallengeByte arrayNetlogon challenge
netlogon.cipher_current_dataCipher Current DataByte array 
netlogon.cipher_current_set_timeCipher Current Set TimeDate/Time stampTime when current cipher was initiated
netlogon.cipher_lenCipher LenUnsigned 32-bit integer 
netlogon.cipher_maxlenCipher Max LenUnsigned 32-bit integer 
netlogon.cipher_old_dataCipher Old DataByte array 
netlogon.cipher_old_set_timeCipher Old Set TimeDate/Time stampTime when previous cipher was initiated
netlogon.client.site_nameClient Site NameStringClient Site Name
netlogon.codeCodeUnsigned 32-bit integerCode
netlogon.codepageCodepageUnsigned 16-bit integerCodepage setting for this account
netlogon.commentCommentStringComment
netlogon.computer_nameComputer NameStringComputer Name
netlogon.countCountUnsigned 32-bit integer 
netlogon.countryCountryUnsigned 16-bit integerCountry setting for this account
netlogon.credentialCredentialByte arrayNetlogon credential
netlogon.database_idDatabase IdUnsigned 32-bit integerDatabase Id
netlogon.db_create_timeDB Create TimeDate/Time stampTime when created
netlogon.db_modify_timeDB Modify TimeDate/Time stampTime when last modified
netlogon.dc.addressDC AddressStringDC Address
netlogon.dc.address_typeDC Address TypeUnsigned 32-bit integerDC Address Type
netlogon.dc.nameDC NameStringDC Name
netlogon.dc.site_nameDC Site NameStringDC Site Name
netlogon.delta_typeDelta TypeUnsigned 16-bit integerDelta Type
netlogon.dir_driveDir DriveStringDrive letter for home directory
netlogon.dns.forest_nameDNS Forest NameStringDNS Forest Name
netlogon.dns_domainDNS DomainStringDNS Domain Name
netlogon.dns_hostDNS HostStringDNS Host
netlogon.domainDomainStringDomain
netlogon.domain_create_timeDomain Create TimeDate/Time stampTime when this domain was created
netlogon.domain_modify_timeDomain Modify TimeDate/Time stampTime when this domain was last modified
netlogon.downlevel_domainDownlevel DomainStringDownlevel Domain Name
netlogon.dummyDummyStringDummy string
netlogon.entriesEntriesUnsigned 32-bit integer 
netlogon.event_audit_optionEvent Audit OptionUnsigned 32-bit integerEvent audit option
netlogon.flagsFlagsUnsigned 32-bit integer 
netlogon.full_nameFull NameStringFull Name
netlogon.group_descGroup DescStringGroup Description
netlogon.group_nameGroup NameStringGroup Name
netlogon.group_ridGroup RIDUnsigned 32-bit integer 
netlogon.handleHandleStringLogon Srv Handle
netlogon.home_dirHome DirStringHome Directory
netlogon.kickoff_timeKickoff TimeDate/Time stampTime when this user will be kicked off
netlogon.lenLenUnsigned 32-bit integerLength
netlogon.levelLevelUnsigned 32-bit integerWhich option of the union is represented here
netlogon.level16LevelUnsigned 16-bit integerWhich option of the union is represented here
netlogon.lm_chal_respLM Chal respByte arrayChallenge response for LM authentication
netlogon.lm_owf_pwdLM PwdByte arrayLanManager OWF Password
netlogon.lm_owf_pwd.encryptedEncrypted LM PwdByte arrayEncrypted LanManager OWF Password
netlogon.lm_pwd_presentLM PWD PresentUnsigned 8-bit integerIs LanManager password present for this account?
netlogon.logoff_timeLogoff TimeDate/Time stampTime for last time this user logged off
netlogon.logon_attemptsLogon AttemptsUnsigned 32-bit integerNumber of logon attempts
netlogon.logon_countLogon CountUnsigned 32-bit integerNumber of successful logins
netlogon.logon_count16Logon CountUnsigned 16-bit integerNumber of successful logins
netlogon.logon_idLogon IDUnsigned 64-bit integerLogon ID
netlogon.logon_scriptLogon ScriptStringLogon Script
netlogon.logon_timeLogon TimeDate/Time stampTime for last time this user logged on
netlogon.max_audit_event_countMax Audit Event CountUnsigned 32-bit integerMax audit event count
netlogon.max_log_sizeMax Log SizeUnsigned 32-bit integerMax Size of log
netlogon.max_sizeMax SizeUnsigned 32-bit integerMax Size of database
netlogon.max_working_set_sizeMax Working Set SizeUnsigned 32-bit integer 
netlogon.min_passwd_lenMin Password LenUnsigned 16-bit integerMinimum length of password
netlogon.min_working_set_sizeMin Working Set SizeUnsigned 32-bit integer 
netlogon.modify_countModify CountUnsigned 64-bit integerHow many times the object has been modified
netlogon.neg_flagsNeg FlagsUnsigned 32-bit integerNegotiation Flags
netlogon.next_referenceNext ReferenceUnsigned 32-bit integer 
netlogon.nonpaged_pool_limitNon-Paged Pool LimitUnsigned 32-bit integer 
netlogon.nt_chal_respNT Chal respByte arrayChallenge response for NT authentication
netlogon.nt_owf_pwdNT PwdByte arrayNT OWF Password
netlogon.nt_pwd_presentNT PWD PresentUnsigned 8-bit integerIs NT password present for this account?
netlogon.num_dcNum DCsUnsigned 32-bit integerNumber of domain controllers
netlogon.num_deltasNum DeltasUnsigned 32-bit integerNumber of SAM Deltas in array
netlogon.num_other_groupsNum Other GroupsUnsigned 32-bit integer 
netlogon.num_ridsNum RIDsUnsigned 32-bit integerNumber of RIDs
netlogon.oem_infoOEM InfoStringOEM Info
netlogon.opnumOperationUnsigned 16-bit integerOperation
netlogon.pac.dataPac DataByte arrayPac Data
netlogon.pac.sizePac SizeUnsigned 32-bit integerSize of PacData in bytes
netlogon.page_file_limitPage File LimitUnsigned 32-bit integer 
netlogon.paged_pool_limitPaged Pool LimitUnsigned 32-bit integer 
netlogon.param_ctrlParam CtrlUnsigned 32-bit integerParam ctrl
netlogon.parametersParametersStringParameters
netlogon.passwd_history_lenPasswd History LenUnsigned 16-bit integerLength of password history
netlogon.pdc_connection_statusPDC Connection StatusUnsigned 32-bit integerPDC Connection Status
netlogon.principalPrincipalStringPrincipal
netlogon.privPrivUnsigned 32-bit integer 
netlogon.privilege_controlPrivilege ControlUnsigned 32-bit integer 
netlogon.privilege_entriesPrivilege EntriesUnsigned 32-bit integer 
netlogon.privilege_namePrivilege NameString 
netlogon.profile_pathProfile PathStringProfile Path
netlogon.pwd_can_change_timePWD Can ChangeDate/Time stampWhen this users password may be changed
netlogon.pwd_expiredPWD ExpiredUnsigned 8-bit integerWhether this password has expired or not
netlogon.pwd_last_set_timePWD Last SetDate/Time stampLast time this users password was changed
netlogon.pwd_must_change_timePWD Must ChangeDate/Time stampWhen this users password must be changed
netlogon.rcReturn codeUnsigned 32-bit integerNetlogon return code
netlogon.referenceReferenceUnsigned 32-bit integer 
netlogon.reservedReservedUnsigned 32-bit integerReserved
netlogon.restart_stateRestart StateUnsigned 16-bit integerRestart State
netlogon.ridUser RIDUnsigned 32-bit integer 
netlogon.sec_chn_typeSec Chn TypeUnsigned 16-bit integerSecure Channel Type
netlogon.security_informationSecurity InformationUnsigned 32-bit integerSecurity Information
netlogon.sensitive_dataDataByte arraySensitive Data
netlogon.sensitive_data_flagSensitive DataUnsigned 8-bit integerSensitive data flag
netlogon.sensitive_data_lenLengthUnsigned 32-bit integerLength of sensitive data
netlogon.serial_numberSerial NumberUnsigned 32-bit integer 
netlogon.serverServerStringServer
netlogon.site_nameSite NameStringSite Name
netlogon.sync_contextSync ContextUnsigned 32-bit integerSync Context
netlogon.system_flagsSystem FlagsUnsigned 32-bit integer 
netlogon.tc_connection_statusTC Connection StatusUnsigned 32-bit integerTC Connection Status
netlogon.time_limitTime LimitTime duration 
netlogon.timestampTimestampDate/Time stamp 
netlogon.trusted_dcTrusted DCStringTrusted DC
netlogon.unknown.charUnknown charUnsigned 8-bit integerUnknown char. If you know what this is, contact ethereal developers.
netlogon.unknown.longUnknown longUnsigned 32-bit integerUnknown long. If you know what this is, contact ethereal developers.
netlogon.unknown.shortUnknown shortUnsigned 16-bit integerUnknown short. If you know what this is, contact ethereal developers.
netlogon.unknown_stringUnknown stringStringUnknown string. If you know what this is, contact ethereal developers.
netlogon.user_flagsUser FlagsUnsigned 32-bit integer 
netlogon.user_session_keyUser Session KeyByte arrayUser Session Key
netlogon.validation_levelValidation LevelUnsigned 16-bit integerRequested level of validation
netlogon.wkst.fqdnWkst FQDNStringWorkstation FQDN
netlogon.wkst.nameWkst NameStringWorkstation Name
netlogon.wkst.osWkst OSStringWorkstation OS
netlogon.wkst.site_nameWkst Site NameStringWorkstation Site Name
netlogon.wkstsWorkstationsStringWorkstations