Skip to content

Commit 2061097

Browse files
Deland-HanDeland-Han
committed
update
1 parent 8ed4395 commit 2061097

1 file changed

Lines changed: 58 additions & 58 deletions

File tree

‎support/windows-server/active-directory/domain-join-log-analysis.md‎

Lines changed: 58 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -509,48 +509,48 @@ DCE/RPC Endpoint Mapper, Map
509509
#### DRSR traffic
510510

511511
```output
512-
Source Destination Protocol Info
513-
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
514-
192.168.100.10 192.168.100.13 TCP 49671 → 49711 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
515-
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [ACK] Seq=1 Ack=1 Win=65280 Len=0
512+
Source Destination Protocol Info
513+
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
514+
192.168.100.10 192.168.100.13 TCP 49671 → 49711 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
515+
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [ACK] Seq=1 Ack=1 Win=65280 Len=0
516516
192.168.100.13 192.168.100.10 DCERPC Bind: call_id: 2, Fragment: Single, 3 context items: DRSUAPI V4.0 (32bit NDR), DRSUAPI V4.0 (64bit NDR), DRSUAPI V4.0 (6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
517517
192.168.100.10 192.168.100.13 DCERPC Bind_ack: call_id: 2, Fragment: Single, max_xmit: 5840 max_recv: 5840, 3 results: Provider rejection, Acceptance, Negotiate ACK, NTLMSSP_CHALLENGE
518518
192.168.100.13 192.168.100.10 DCERPC AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: contoso\puser2
519-
192.168.100.13 192.168.100.10 DRSUAPI DsBind request
520-
192.168.100.10 192.168.100.13 TCP 49671 → 49711 [ACK] Seq=329 Ack=929 Win=2096896 Len=0
521-
192.168.100.10 192.168.100.13 DRSUAPI DsBind response
522-
192.168.100.13 192.168.100.10 DRSUAPI DsCrackNames request
523-
192.168.100.10 192.168.100.13 DRSUAPI DsCrackNames response
524-
192.168.100.13 192.168.100.10 DRSUAPI DsCrackNames request
525-
192.168.100.10 192.168.100.13 DRSUAPI DsCrackNames response
526-
192.168.100.13 192.168.100.10 DRSUAPI DsUnbind request
527-
192.168.100.10 192.168.100.13 DRSUAPI DsUnbind response
528-
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [ACK] Seq=1393 Ack=905 Win=64512 Len=0
519+
192.168.100.13 192.168.100.10 DRSUAPI DsBind request
520+
192.168.100.10 192.168.100.13 TCP 49671 → 49711 [ACK] Seq=329 Ack=929 Win=2096896 Len=0
521+
192.168.100.10 192.168.100.13 DRSUAPI DsBind response
522+
192.168.100.13 192.168.100.10 DRSUAPI DsCrackNames request
523+
192.168.100.10 192.168.100.13 DRSUAPI DsCrackNames response
524+
192.168.100.13 192.168.100.10 DRSUAPI DsCrackNames request
525+
192.168.100.10 192.168.100.13 DRSUAPI DsCrackNames response
526+
192.168.100.13 192.168.100.10 DRSUAPI DsUnbind request
527+
192.168.100.10 192.168.100.13 DRSUAPI DsUnbind response
528+
192.168.100.13 192.168.100.10 TCP 49711 → 49671 [ACK] Seq=1393 Ack=905 Win=64512 Len=0
529529
```
530530

531531
#### NetLogon traffic
532532

533533
```output
534-
Source Destination Protocol Info
535-
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
536-
192.168.100.10 192.168.100.13 TCP 49682 → 49735 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
537-
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [ACK] Seq=1 Ack=1 Win=65280 Len=0
538-
192.168.100.13 192.168.100.10 DCERPC Bind: call_id: 2, Fragment: Single, 3 context items: RPC_NETLOGON V1.0 (32bit NDR), RPC_NETLOGON V1.0 (64bit NDR), RPC_NETLOGON V1.0 (6cb71c2c-9812-4540-0300-000000000000)
539-
192.168.100.10 192.168.100.13 DCERPC Bind_ack: call_id: 2, Fragment: Single, max_xmit: 5840 max_recv: 5840, 3 results: Provider rejection, Acceptance, Negotiate ACK
534+
Source Destination Protocol Info
535+
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
536+
192.168.100.10 192.168.100.13 TCP 49682 → 49735 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
537+
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [ACK] Seq=1 Ack=1 Win=65280 Len=0
538+
192.168.100.13 192.168.100.10 DCERPC Bind: call_id: 2, Fragment: Single, 3 context items: RPC_NETLOGON V1.0 (32bit NDR), RPC_NETLOGON V1.0 (64bit NDR), RPC_NETLOGON V1.0 (6cb71c2c-9812-4540-0300-000000000000)
539+
192.168.100.10 192.168.100.13 DCERPC Bind_ack: call_id: 2, Fragment: Single, max_xmit: 5840 max_recv: 5840, 3 results: Provider rejection, Acceptance, Negotiate ACK
540540
192.168.100.13 192.168.100.10 RPC_NETLOGON NetrServerReqChallenge request,
541541
192.168.100.10 192.168.100.13 RPC_NETLOGON NetrServerReqChallenge response
542542
192.168.100.13 192.168.100.10 RPC_NETLOGON NetrServerAuthenticate3 request
543543
192.168.100.10 192.168.100.13 RPC_NETLOGON NetrServerAuthenticate3 response
544-
192.168.100.13 192.168.100.10 DCERPC Alter_context: call_id: 4, Fragment: Single, 1 context items: RPC_NETLOGON V1.0 (64bit NDR)
545-
192.168.100.10 192.168.100.13 DCERPC Alter_context_resp: call_id: 4, Fragment: Single, max_xmit: 5840 max_recv: 5840, 1 results: Acceptance
544+
192.168.100.13 192.168.100.10 DCERPC Alter_context: call_id: 4, Fragment: Single, 1 context items: RPC_NETLOGON V1.0 (64bit NDR)
545+
192.168.100.10 192.168.100.13 DCERPC Alter_context_resp: call_id: 4, Fragment: Single, max_xmit: 5840 max_recv: 5840, 1 results: Acceptance
546546
192.168.100.13 192.168.100.10 RPC_NETLOGON NetrLogonGetCapabilities request
547547
192.168.100.10 192.168.100.13 RPC_NETLOGON NetrLogonGetCapabilities response
548548
192.168.100.13 192.168.100.10 RPC_NETLOGON NetrLogonGetCapabilities request
549549
192.168.100.10 192.168.100.13 RPC_NETLOGON NetrLogonGetCapabilities response
550550
192.168.100.13 192.168.100.10 RPC_NETLOGON NetrLogonGetDomainInfo request
551-
192.168.100.10 192.168.100.13 TCP 49682 → 49735 [ACK] Seq=505 Ack=1993 Win=2097920 Len=1460 [TCP PDU reassembled in 562]
551+
192.168.100.10 192.168.100.13 TCP 49682 → 49735 [ACK] Seq=505 Ack=1993 Win=2097920 Len=1460 [TCP PDU reassembled in 562]
552552
192.168.100.10 192.168.100.13 RPC_NETLOGON NetrLogonGetDomainInfo response
553-
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [ACK] Seq=1993 Ack=2113 Win=65280 Len=09735, DstPort=49682, PayloadLen=0, Seq=2988619262, Ack=225725553
553+
192.168.100.13 192.168.100.10 TCP 49735 → 49682 [ACK] Seq=1993 Ack=2113 Win=65280 Len=09735, DstPort=49682, PayloadLen=0, Seq=2988619262, Ack=225725553
554554
```
555555

556556
### Kerberos
@@ -560,25 +560,25 @@ Kerberos traffic is also used during domain join operation, because all the type
560560
For example, in the following network trace, the client gets a Kerberos TGT for the user account **CONTOSO\puser2** and the service ticket for the target SPN **cifs/DC2.contoso.local**. Then, the client sets up the SMB session to the DC DC2.contoso.local with that service ticket.
561561

562562
```output
563-
Source Destination Protocol Info
564-
192.168.100.13 192.168.100.10 TCP 49744 → 445 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
565-
192.168.100.10 192.168.100.13 TCP 445 → 49744 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
566-
192.168.100.13 192.168.100.10 TCP 49744 → 445 [ACK] Seq=1 Ack=1 Win=65280 Len=0
567-
192.168.100.13 192.168.100.10 SMB Negotiate Protocol Request
568-
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
569-
192.168.100.13 192.168.100.10 SMB2 Negotiate Protocol Request
570-
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
571-
192.168.100.13 192.168.100.12 KRB5 AS-REQ
572-
192.168.100.12 192.168.100.13 KRB5 KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED
573-
192.168.100.13 192.168.100.12 KRB5 AS-REQ
574-
192.168.100.12 192.168.100.13 KRB5 AS-REP
575-
192.168.100.13 192.168.100.12 KRB5 TGS-REQ
576-
192.168.100.12 192.168.100.13 KRB5 TGS-REP
577-
192.168.100.13 192.168.100.10 SMB2 Session Setup Request
578-
192.168.100.10 192.168.100.13 TCP 445 → 49744 [ACK] Seq=629 Ack=2213 Win=2097920 Len=0
579-
192.168.100.10 192.168.100.13 SMB2 Session Setup Response
580-
192.168.100.13 192.168.100.10 SMB2 Tree Connect Request Tree: \\DC2.contoso.local\IPC$
581-
192.168.100.10 192.168.100.13 SMB2 Tree Connect Response
563+
Source Destination Protocol Info
564+
192.168.100.13 192.168.100.10 TCP 49744 → 445 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
565+
192.168.100.10 192.168.100.13 TCP 445 → 49744 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
566+
192.168.100.13 192.168.100.10 TCP 49744 → 445 [ACK] Seq=1 Ack=1 Win=65280 Len=0
567+
192.168.100.13 192.168.100.10 SMB Negotiate Protocol Request
568+
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
569+
192.168.100.13 192.168.100.10 SMB2 Negotiate Protocol Request
570+
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
571+
192.168.100.13 192.168.100.12 KRB5 AS-REQ
572+
192.168.100.12 192.168.100.13 KRB5 KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED
573+
192.168.100.13 192.168.100.12 KRB5 AS-REQ
574+
192.168.100.12 192.168.100.13 KRB5 AS-REP
575+
192.168.100.13 192.168.100.12 KRB5 TGS-REQ
576+
192.168.100.12 192.168.100.13 KRB5 TGS-REP
577+
192.168.100.13 192.168.100.10 SMB2 Session Setup Request
578+
192.168.100.10 192.168.100.13 TCP 445 → 49744 [ACK] Seq=629 Ack=2213 Win=2097920 Len=0
579+
192.168.100.10 192.168.100.13 SMB2 Session Setup Response
580+
192.168.100.13 192.168.100.10 SMB2 Tree Connect Request Tree: \\DC2.contoso.local\IPC$
581+
192.168.100.10 192.168.100.13 SMB2 Tree Connect Response
582582
```
583583

584584
```output
@@ -637,21 +637,21 @@ Even if you don't see any Kerberos traffic, that doesn't necessarily mean the do
637637
See the following example of successful SMB session setup using NTLM authentication.
638638

639639
```output
640-
Source Destination Protocol Info
641-
192.168.100.13 192.168.100.10 TCP 49708 → 445 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
642-
192.168.100.10 192.168.100.13 TCP 445 → 49708 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
643-
192.168.100.13 192.168.100.10 TCP 49708 → 445 [ACK] Seq=1 Ack=1 Win=65280 Len=0
644-
192.168.100.13 192.168.100.10 SMB Negotiate Protocol Request
645-
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
646-
192.168.100.13 192.168.100.10 SMB2 Negotiate Protocol Request
647-
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
648-
192.168.100.13 192.168.100.10 TCP 49708 → 445 [ACK] Seq=378 Ack=629 Win=64768 Len=0
649-
192.168.100.13 192.168.100.10 SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
650-
192.168.100.10 192.168.100.13 SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
651-
192.168.100.13 192.168.100.10 SMB2 Session Setup Request, NTLMSSP_AUTH, User: contoso\puser2
652-
192.168.100.10 192.168.100.13 SMB2 Session Setup Response
653-
192.168.100.13 192.168.100.10 SMB2 Tree Connect Request Tree: \\DC2.contoso.local\IPC$
654-
192.168.100.10 192.168.100.13 SMB2 Tree Connect Response
640+
Source Destination Protocol Info
641+
192.168.100.13 192.168.100.10 TCP 49708 → 445 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
642+
192.168.100.10 192.168.100.13 TCP 445 → 49708 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=256 SACK_PERM
643+
192.168.100.13 192.168.100.10 TCP 49708 → 445 [ACK] Seq=1 Ack=1 Win=65280 Len=0
644+
192.168.100.13 192.168.100.10 SMB Negotiate Protocol Request
645+
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
646+
192.168.100.13 192.168.100.10 SMB2 Negotiate Protocol Request
647+
192.168.100.10 192.168.100.13 SMB2 Negotiate Protocol Response
648+
192.168.100.13 192.168.100.10 TCP 49708 → 445 [ACK] Seq=378 Ack=629 Win=64768 Len=0
649+
192.168.100.13 192.168.100.10 SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
650+
192.168.100.10 192.168.100.13 SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
651+
192.168.100.13 192.168.100.10 SMB2 Session Setup Request, NTLMSSP_AUTH, User: contoso\puser2
652+
192.168.100.10 192.168.100.13 SMB2 Session Setup Response
653+
192.168.100.13 192.168.100.10 SMB2 Tree Connect Request Tree: \\DC2.contoso.local\IPC$
654+
192.168.100.10 192.168.100.13 SMB2 Tree Connect Response
655655
```
656656

657657
```output

0 commit comments

Comments
 (0)