<div class="content" name="NetrLogonComputeServerDigest" uuid="5f95c374-7951-42d9-816c-c7f4cff2ed52"><p>The <b>NetrLogonComputeServerDigest</b> method computes a
cryptographic digest of a message by using the MD5 message-digest algorithm, as
specified in <span><a href="https://go.microsoft.com/fwlink/?LinkId=90275" data-linktype="external">[RFC1321]</a></span>. This
method SHOULD<a id="Appendix_A_Target_243"></a><a aria-label="Product behavior note 243" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_243" data-linktype="relative-path">&lt;243&gt;</a> be called by a client
computer against a server and is used to compute a message digest, as specified
in this section. The client then calls the <span><a href="79ca6e90-ccd2-429e-b5ac-8050b620eef6" data-linktype="relative-path">NetrLogonComputeClientDigest</a></span>
method (as specified in section <span><a href="1bf3702b-be13-464a-ad5e-6be0fe210c90" data-linktype="relative-path">3.4.5.6.3</a></span>) and
compare the digests to ensure that the server that it communicates with knows
the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_ae8614db-83d9-406d-aa79-90b2f07c3ed1" data-linktype="relative-path">shared
secret</a></span> between the client machine and the domain. </p><dl>
<dd>
<div><pre> NET_API_STATUS NetrLogonComputeServerDigest(
   [in, unique, string] LOGONSRV_HANDLE ServerName,
   [in] ULONG Rid,
   [in, size_is(MessageSize)] UCHAR * Message,
   [in, range(0,2048)] ULONG MessageSize,
   [out] CHAR NewMessageDigest[16],
   [out] CHAR OldMessageDigest[16]
 );
</pre></div>
</dd></dl><p><b>ServerName: </b>The custom binding handle, as
defined in section <span><a href="3b224201-b531-43e2-8c79-b61f6dea8640" data-linktype="relative-path">3.5.4.1</a></span>.</p><p><b>Rid: </b>The <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_df3d0b61-56cd-4dac-9402-982f1fedc41c" data-linktype="relative-path">RID</a></span> of the machine
account for which the digest is to be computed. The <span><a href="1d6fad9e-763d-495f-9bed-18c79304c3d7" data-linktype="relative-path">NetrLogonGetTrustRid method</a></span>,
as specified in section 3.5.4.8.1, is used to obtain the RID.</p><p><b>Message: </b>A pointer to buffer that contains the
message to compute the digest.</p><p><b>MessageSize: </b>The length of the data referenced
by the <i>Message</i> parameter, in bytes.</p><p><b>NewMessageDigest: </b>A 128-bit MD5 digest of the
current machine account password and the message in the <i>Message</i> buffer.
The machine account is identified by the <i>Rid</i> parameter.</p><p><b>OldMessageDigest: </b>A 128-bit MD5 digest of the
previous machine account password, if present, and the message in the <i>Message</i>
buffer. If no previous machine account password exists, then the current
password is used. The machine account is identified by the <i>Rid</i>
parameter.</p><p><b>Return Values: </b>The method returns 0x00000000
on success; otherwise, it returns a nonzero error code.</p><p>The server uses the server name passed in the <i>ServerName</i>
parameter to look up the domain for the request. If the name is not found, the
server MUST return ERROR_INVALID_COMPUTERNAME.</p><p>If the client does not have sufficient <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_d8092e10-b227-4b44-b015-511bb8178940" data-linktype="relative-path">privilege</a></span>,
the server MUST return ERROR_ACCESS_DENIED.</p><p>The server MUST construct the machine account <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">SID</a></span>
using the <i>Rid</i> parameter and the current domain with the format S-1-5-<i>current
domain</i>-<i>Rid parameter</i>.</p><p>The server MUST compute or retrieve the NTOWFv1 of the
current password, retrieve <b>lmPwdHistory</b> (<span><a href="../ms-ada1/19528560-f41e-4623-a406-dabcfff0660f" data-linktype="relative-path">[MS-ADA1]</a></span>
section <span><a href="../ms-ada1/1282e4c5-c992-4d64-80aa-e1dc57dbbe77" data-linktype="relative-path">2.363</a></span>),
and the NTOWFv1 of the previous password (if it exists) for the machine account
whose security identifier (<span><a href="../ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0" data-linktype="relative-path">[MS-ADA3]</a></span>
section <span><a href="../ms-ada3/2f548cb7-b713-46fd-ba88-d1cde605a972" data-linktype="relative-path">2.237</a></span>)
corresponds to the generated SID. If the machine account cannot be found, or
the machine account does not correspond to a machine, or the machine account is
disabled, the server MUST return ERROR_NO_SUCH_USER. When the server is an <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">RODC</a></span>
and the NTOWFv1 of the current password cannot be retrieved, the server MUST
return ERROR_NO_TRUST_LSA_SECRET.</p><p>The digest of the <i>Message</i> parameter MUST be
calculated with the following algorithm, using this <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_9a5d11c7-eea9-4217-b9a8-478c6786e9e8" data-linktype="relative-path">one-way function (OWF)</a></span>
of the password.</p><ol><li><p><span>    </span>CALL
MD5Init(md5context)</p>
</li><li><p><span>    </span>IF OWF of password
is present:</p>
<ol><li><p><span>   
</span>CALL MD5Update(md5context, OWF of password, length of OWF of password)</p>
</li></ol></li><li><p><span>    </span>CALL
MD5Update(md5context, Message, MessageSize)</p>
</li><li><p><span>    </span>CALL
MD5Final(md5context)</p>
</li><li><p><span>    </span>SET digest to
md5context.digest</p>
</li></ol><p>The <i>NewMessageDigest</i> parameter MUST be computed by
using the current password. The <i>OldMessageDigest</i> parameter MUST be
computed by using the previous password, if it exists. If the previous password
is not present, the new password MAY<a id="Appendix_A_Target_244"></a><a aria-label="Product behavior note 244" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_244" data-linktype="relative-path">&lt;244&gt;</a> be
used to compute the <i>OldMessageDigest</i>.</p><p>Creating a message digest for the previous password allows
the possibility of password replication latency to be accounted for. If the
machine account password was recently changed, but the change has not
propagated to the server processing this method, the server keeps the old
password.</p></div>