<div class="content" name="KERB_VALIDATION_INFO" uuid="69e86ccc-85e3-41b9-b514-7d969cd0ed73"><p>The <b>KERB_VALIDATION_INFO</b> structure defines the user&#39;s
logon and authorization information provided by the <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">DC</a>. A pointer to the <b>KERB_VALIDATION_INFO</b>
structure is serialized into an array of bytes and then placed after the <b>Buffers</b>
array of the topmost <b>PACTYPE</b> structure (section <a href="6655b92f-ab06-490b-845d-037e6987275f" data-linktype="relative-path">2.3</a>), at the offset
specified in the <b>Offset</b> field of the corresponding <b>PAC_INFO_BUFFER</b>
structure (section <a href="3341cfa2-6ef5-42e0-b7bc-4544884bf399" data-linktype="relative-path">2.4</a>)
in the <b>Buffers</b> array. The <b>ulType</b> field of the corresponding <b>PAC_INFO_BUFFER</b>
structure is set to 0x00000001. </p><p>The <b>KERB_VALIDATION_INFO </b>structure is a subset of the
<a href="../ms-nrpc/bccfdba9-0c38-485e-b751-d4de1935781d" data-linktype="relative-path">NETLOGON_VALIDATION_SAM_INFO4</a>
structure (<a href="../ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f" data-linktype="relative-path">[MS-NRPC]</a>
section 2.2.1.4.13). It is a subset due to historical reasons and to the use of
Active Directory to generate this information. NTLM uses the
NETLOGON_VALIDATION_SAM_INFO4 structure in the context of the server to domain
controller exchange, as defined in <a href="../ms-apds/dd444344-fd7e-430e-b313-7e95ab9c338e" data-linktype="relative-path">[MS-APDS]</a>
section <a href="../ms-apds/407dd91f-8854-4c05-8a85-70fee9ab11da" data-linktype="relative-path">3.1</a>.
Consequently, the <b>KERB_VALIDATION_INFO</b> structure includes NTLM-specific
fields. Fields that are common to the <b>KERB_VALIDATION_INFO</b> and the
NETLOGON_VALIDATION_SAM_INFO4 structures, and which are specific to the NTLM
authentication operation, are not used with <a href="../ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9" data-linktype="relative-path">[MS-KILE]</a>
authentication. The <b>KERB_VALIDATION_INFO</b> structure is marshaled by <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a> <a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a>.
</p><p>The <b>KERB_VALIDATION_INFO</b> structure is defined as
follows.</p><dl>
<dd>
<div><pre> typedef struct _KERB_VALIDATION_INFO {
    FILETIME LogonTime;
    FILETIME LogoffTime;
    FILETIME KickOffTime;
    FILETIME PasswordLastSet;
    FILETIME PasswordCanChange;
    FILETIME PasswordMustChange;
    RPC_UNICODE_STRING EffectiveName;
    RPC_UNICODE_STRING FullName;
    RPC_UNICODE_STRING LogonScript;
    RPC_UNICODE_STRING ProfilePath;
    RPC_UNICODE_STRING HomeDirectory;
    RPC_UNICODE_STRING HomeDirectoryDrive;
    USHORT LogonCount;
    USHORT BadPasswordCount;
    ULONG UserId;
    ULONG PrimaryGroupId;
    ULONG GroupCount;
    [size_is(GroupCount)] PGROUP_MEMBERSHIP GroupIds;
    ULONG UserFlags;
    USER_SESSION_KEY UserSessionKey;
    RPC_UNICODE_STRING LogonServer;
    RPC_UNICODE_STRING LogonDomainName;
    PISID LogonDomainId;
    ULONG Reserved1[2];
    ULONG UserAccountControl;
    ULONG SubAuthStatus;
    FILETIME LastSuccessfulILogon;
    FILETIME LastFailedILogon;
    ULONG FailedILogonCount;
    ULONG Reserved3;
    ULONG SidCount;
    [size_is(SidCount)] PKERB_SID_AND_ATTRIBUTES ExtraSids;
    PISID ResourceGroupDomainSid;
    ULONG ResourceGroupCount;
    [size_is(ResourceGroupCount)] PGROUP_MEMBERSHIP ResourceGroupIds;
 } KERB_VALIDATION_INFO, *PKERB_VALIDATION_INFO;
</pre></div>
</dd></dl><p><b>LogonTime:</b> A <a href="../ms-dtyp/2c57429b-fdd4-488f-b5fc-9e4cf020fcdf" data-linktype="relative-path">FILETIME</a>
structure that contains the user account&#39;s lastLogon attribute (<a href="../ms-ada1/19528560-f41e-4623-a406-dabcfff0660f" data-linktype="relative-path">[MS-ADA1]</a>
section <a href="../ms-ada1/93258066-276d-4357-8458-981c19caad95" data-linktype="relative-path">2.351</a>)
value.</p><p><b>LogoffTime:</b> A <b>FILETIME</b> structure that
contains the time the client&#39;s logon session is set to expire. If the session
is set not to expire, the <b>dwHighDateTime</b> member is set to 0x7FFFFFFF and
the <b>dwLowDateTime</b> member set to 0xFFFFFFFF. A recipient of the <b>PAC </b>SHOULD<a id="Appendix_A_Target_11"></a><a aria-label="Product behavior note 11" href="a1c36b00-1fca-415c-a4ca-e66e98844760#Appendix_A_11" data-linktype="relative-path">&lt;11&gt;</a> use this value as an indicator
of when to warn the user that the allowed time is due to expire.</p><p><b>KickOffTime:</b> A <b>FILETIME</b> structure that
contains <b>LogoffTime</b> minus the user account&#39;s <b>forceLogoff</b>
attribute ([MS-ADA1] section <a href="../ms-ada1/d19435aa-ee82-4fcf-810f-fe15710cc3bf" data-linktype="relative-path">2.233</a>)
value. If the client is not to be forcibly logged off, the <b>dwHighDateTime</b>
member is set to 0x7FFFFFFF and the <b>dwLowDateTime</b> member set to
0xFFFFFFFF. The Kerberos service ticket end time is a replacement for <b>KickOffTime</b>.
The service ticket lifetime SHOULD NOT<a id="Appendix_A_Target_12"></a><a aria-label="Product behavior note 12" href="a1c36b00-1fca-415c-a4ca-e66e98844760#Appendix_A_12" data-linktype="relative-path">&lt;12&gt;</a> be set
longer than the <b>KickOffTime</b> of an account. A recipient of the <b>PAC </b>uses
this value as the indicator of when the client is to be forcibly disconnected. </p><p><b>PasswordLastSet:</b>  A <b>FILETIME</b>
structure that contains the user account&#39;s pwdLastSet attribute (<a href="../ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0" data-linktype="relative-path">[MS-ADA3]</a>
section <a href="../ms-ada3/9663282b-c880-4061-ba8e-e8509c8aa336" data-linktype="relative-path">2.175</a>)
value. If the password was never set, this structure MUST have the <b>dwHighDateTime</b>
member set to 0x00000000 and the <b>dwLowDateTime</b> member set to 0x00000000.</p><p><b>PasswordCanChange:</b> A <b>FILETIME</b> structure
that contains the time at which the client&#39;s password is allowed to change. If
there is no restriction on when the client can change the password, this member
MUST be set to zero.</p><p><b>PasswordMustChange:</b> A <b>FILETIME</b>
structure that contains the time at which the client&#39;s password expires. If the
password will not expire, this structure MUST have the <b>dwHighDateTime</b>
member set to 0x7FFFFFFF and the <b>dwLowDateTime</b> member set to 0xFFFFFFFF.
</p><p><b>EffectiveName:</b> An <a href="../ms-dtyp/94a16bb6-c610-4cb9-8db6-26f15f560061" data-linktype="relative-path">RPC_UNICODE_STRING</a>
structure that contains the user account&#39;s samAccountName attribute ([MS-ADA3]
section <a href="../ms-ada3/56d7e9e4-1505-4d9a-b968-3bf0d6b92809" data-linktype="relative-path">2.222</a>)
value.</p><p><b>FullName:</b> An <b>RPC_UNICODE_STRING</b>
structure that contains the user account&#39;s full name for interactive logon and
is set to zero for network logon. If <b>FullName</b> is omitted, this member
MUST contain an <b>RPC_UNICODE_STRING</b> structure with the <b>Length</b>
member set to zero.</p><p><b>LogonScript:</b> An <b>RPC_UNICODE_STRING</b>
structure that contains the user account&#39;s <b>scriptPath</b> attribute
([MS-ADA3] section <a href="../ms-ada3/c640630e-23ff-44e7-886f-16df9574039e" data-linktype="relative-path">2.232</a>)
value for interactive logon and is set to zero for network logon. If no <b>LogonScript</b>
is configured for the user, this member MUST contain an <b>RPC_UNICODE_STRING</b>
structure with the <b>Length</b> member set to zero.</p><p><b>ProfilePath:</b> An <b>RPC_UNICODE_STRING</b>
structure that contains the user account&#39;s <b>profilePath</b> attribute
([MS-ADA3] section <a href="../ms-ada3/098a8c90-fde7-4904-bb75-af402a8203bf" data-linktype="relative-path">2.167</a>)
value for interactive logon and is set to zero for network logon. If no <b>ProfilePath</b>
is configured for the user, this member MUST contain an <b>RPC_UNICODE_STRING</b>
structure with the <b>Length</b> member set to zero.</p><p><b>HomeDirectory:</b> An <b>RPC_UNICODE_STRING</b>
structure that contains the user account&#39;s <b>HomeDirectory</b> attribute
([MS-ADA1] section <a href="../ms-ada1/10d700cb-2954-4446-a9b4-69113344421c" data-linktype="relative-path">2.295</a>)
value for interactive logon and is set to zero for network logon. If no <b>HomeDirectory</b>
is configured for the user, this member MUST contain an <b>RPC_UNICODE_STRING</b>
structure with the <b>Length</b> member set to zero.</p><p><b>HomeDirectoryDrive:</b> An <b>RPC_UNICODE_STRING</b>
structure that contains the user account&#39;s <b>HomeDrive</b> attribute
([MS-ADA1] section <a href="../ms-ada1/b3c899de-2fe7-40b5-b2a1-8b03ed49b812" data-linktype="relative-path">2.296</a>)
value for interactive logon and is set to zero for network logon. This member
MUST be populated if <b>HomeDirectory</b> contains a <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_3aa4cef1-1bf3-4f6c-9e57-fd44a56a96b1" data-linktype="relative-path">UNC path</a>. If no <b>HomeDirectoryDrive</b>
is configured for the user, this member MUST contain an <b>RPC_UNICODE_STRING</b>
structure with the <b>Length</b> member set to zero.</p><p><b>LogonCount:</b> A 16-bit unsigned integer that
contains the user account&#39;s <b>LogonCount</b> attribute ([MS-ADA1] section <a href="../ms-ada1/528b54a7-f895-4c1e-bd21-b443f7d6846e" data-linktype="relative-path">2.375</a>)
value. </p><p><b>BadPasswordCount:</b> A 16-bit unsigned integer
that contains the user account&#39;s <b>badPwdCount</b> attribute ([MS-ADA1]
section <a href="../ms-ada1/16b90560-0dc4-4e36-be2f-f97f5e764a6c" data-linktype="relative-path">2.83</a>)
value for interactive logon and is set to zero for network logon. </p><p><b>UserId:</b> A 32-bit unsigned integer that
contains the <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_df3d0b61-56cd-4dac-9402-982f1fedc41c" data-linktype="relative-path">RID</a> of the
account. If the UserId member equals 0x00000000, the first group <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">SID</a> in this member is the
SID for this account.</p><p><b>PrimaryGroupId:</b> A 32-bit unsigned integer that
contains the RID for the primary group to which this account belongs.</p><p><b>GroupCount:</b> A 32-bit unsigned integer that
contains the number of groups within the account domain to which the account
belongs. </p><p><b>GroupIds:</b> A pointer to a list of <a href="40526584-1565-4fb1-97b7-eb38fd880595" data-linktype="relative-path">GROUP_MEMBERSHIP (section 2.2.2)</a>
structures that contains the groups to which the account belongs in the account
domain. The number of groups in this list MUST be equal to <b>GroupCount</b>.</p><p><b>UserFlags:</b> A 32-bit unsigned integer that
contains a set of bit flags that describe the user&#39;s logon information.</p><dl>
<dd>
<table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>0</td>
  <td>L</td>
  <td>K</td>
  <td>J</td>
  <td>I</td>
  <td>H</td>
  <td>G</td>
  <td>F</td>
  <td>E</td>
  <td>D</td>
  <td>0</td>
  <td>C</td>
  <td>0</td>
  <td>B</td>
  <td>A</td>
 </tr>
</tbody></table>
</dd>
<dd>
<p>The following flags are set only
when this structure is created as the result of an NTLM authentication, as
specified in <a href="../ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4" data-linktype="relative-path">[MS-NLMP]</a>.
These flags MUST be zero for any other authentication protocol, such as
[MS-KILE] authentication.</p>
</dd>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>A</td>
  <td>Authentication was done via the GUEST account; no password was used.</td>
 </tr><tr>
  <td>B</td>
  <td>No encryption is available.</td>
 </tr><tr>
  <td>C</td>
  <td>LAN Manager key was used for authentication.</td>
 </tr><tr>
  <td>E</td>
  <td>Sub-authentication used; session key came from the sub-authentication package.</td>
 </tr><tr>
  <td>F</td>
  <td>Indicates that the account is a machine account.</td>
 </tr><tr>
  <td>G</td>
  <td>Indicates that the domain controller understands NTLMv2.</td>
 </tr><tr>
  <td>I</td>
  <td>Indicates that ProfilePath is populated.</td>
 </tr><tr>
  <td>J</td>
  <td>The NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation.</td>
 </tr><tr>
  <td>K</td>
  <td>The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation.</td>
 </tr><tr>
  <td>L</td>
  <td>The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and the NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used session key generation.</td>
 </tr></tbody></table>
</dd>
<dd>
<p>The following flags are valid for
[MS-KILE] authentications; settings depend on the configuration of the user and
groups referenced in the PAC.</p>
</dd>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>D</td>
  <td>Indicates that the ExtraSids field is populated and contains additional SIDs.</td>
 </tr><tr>
  <td>H</td>
  <td>Indicates that the ResourceGroupIds field is populated.</td>
 </tr></tbody></table>
</dd>
<dd>
<p>All other bits MUST be set to zero
and MUST be ignored on receipt.</p>
</dd></dl><p><b>UserSessionKey:</b> A session key that is used for
cryptographic operations on a session. This field is valid only when
authentication is performed using NTLM. For any other protocol, this field MUST
be zero.</p><p><b>LogonServer:</b> An RPC_UNICODE_STRING structure
that contains the NetBIOS name of the Kerberos <a href="f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_6e5aafba-6b66-4fdd-872e-844f142af287" data-linktype="relative-path">KDC</a> that performed the
authentication server (AS) ticket request. </p><p><b>LogonDomainName:</b> An RPC_UNICODE_STRING
structure that contains the NetBIOS name of the domain to which this account
belongs. </p><p><b>LogonDomainId:</b> An <a href="../ms-dtyp/5cb97814-a1c2-4215-b7dc-76d1f4bfad01" data-linktype="relative-path">RPC_SID</a>
structure (<a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a>
section 2.4.2.3) that contains the SID for the domain specified in <b>LogonDomainName</b>.
This member is used in conjunction with the <b>UserId</b>, <b>PrimaryGroupId</b>,
and <b>GroupIds</b> members to create the user and group SIDs for the client. </p><p><b>Reserved1:</b> A two-element array of unsigned
32-bit integers. This member is reserved, and each element of the array MUST be
zero when sent and MUST be ignored on receipt.</p><p><b>UserAccountControl:</b> A 32-bit unsigned integer
that contains a set of bit flags that represent information about this account.
This field carries the <b>UserAccountControl</b> information from the
corresponding <b>Security Account Manager</b> field, as specified in <a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a>.</p><p><b>SubAuthStatus:</b> A 32-bit unsigned integer that
contains the subauthentication package&#39;s ([MS-APDS] section <a href="../ms-apds/e376df86-6783-4b59-83ad-c8a639a06906" data-linktype="relative-path">3.1.5.2.1</a>)
status code. If a subauthentication package is not used, this structure is set
to 0x00000000.</p><p><b>LastSuccessfulILogon:</b> A <b>FILETIME</b>
structure that contains the user account&#39;s <b>msDS-LastSuccessfulInteractiveLogonTime</b>
(<a href="../ms-ada2/e20ebc4e-5285-40ba-b3bd-ffcb81c2783e" data-linktype="relative-path">[MS-ADA2]</a>
section <a href="../ms-ada2/bd0266d0-1e39-44e0-a3c9-4e18d402dcfc" data-linktype="relative-path">2.370</a>).
If the user has never logged on, this structure is set to 0x7FFFFFFFFFFFFFFF.</p><p><b>LastFailedILogon:</b> A <b>FILETIME</b> structure
that contains the user account&#39;s <b>msDS-LastFailedInteractiveLogonTime</b>
([MS-ADA2] section <a href="../ms-ada2/e8071f3e-c6fa-4888-959e-7121e3e64510" data-linktype="relative-path">2.368</a>).
If the user has never logged on, this structure is set to 0x7FFFFFFFFFFFFFFF.</p><p><b>FailedILogonCount:</b> A 32-bit unsigned integer
that contains the user account&#39;s <b>msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon</b>
([MS-ADA2] section <a href="../ms-ada2/afc5fd06-9212-43ac-861e-a73179a20730" data-linktype="relative-path">2.324</a>).</p><p><b>Reserved3:</b> A 32-bit integer. This member is
reserved, MUST be zero when sent and MUST be ignored on receipt. </p><p><b>SidCount:</b> A 32-bit unsigned integer that
contains the total number of SIDs present in the <b>ExtraSids</b> member. If
this member is not zero then the <b>D</b> bit MUST be set in the <b>UserFlags</b>
member. </p><p><b>ExtraSids:</b> A pointer to a list of <a href="311aab27-ebdf-47f7-b939-13dc99b15341" data-linktype="relative-path">KERB_SID_AND_ATTRIBUTES (section 2.2.1)</a>
structures that contain a list of SIDs corresponding to groups in domains other
than the account domain to which the principal belongs. This member is not NULL
only if the <b>D</b> bit has been set in the <b>UserFlags</b> member. If the <b>UserId</b>
member equals 0x00000000, the first group SID in this member is the SID for
this account. </p><p><b>ResourceGroupDomainSid:</b> An <b>RPC_SID</b>
structure that contains the SID of the domain for the server whose resources
the client is authenticating to. This member is used in conjunction with the <b>ResourceGroupIds</b>
member to create the group SIDs for the user. If this member is populated, then
the <b>H</b> bit MUST be set in the <b>UserFlags</b> member.</p><dl>
<dd>
<p>When this field is not used, it MUST be set to NULL.</p>
</dd></dl><p><b>ResourceGroupCount:</b> A 32-bit unsigned integer
that contains the number of resource group identifiers stored in <b>ResourceGroupIds</b>.
If this member is not zero, then the <b>H</b> bit MUST be set in the <b>UserFlags</b>
member. </p><dl>
<dd>
<p>When this field is not used, it MUST be set to zero.</p>
</dd></dl><p><b>ResourceGroupIds:</b> A pointer to a list of
GROUP_MEMBERSHIP structures that contain the RIDs and attributes of the
account&#39;s groups in the resource domain. If this member is not NULL, then the <b>H</b>
bit MUST be set in the <b>UserFlags</b> member.</p><dl>
<dd>
<p>When this field is not used, it MUST be set to NULL.</p>
</dd></dl></div>