I remember somewhere there being a flag or special SID that indicated the a session is authenticated at the RODC. However I can't find any evidence of it.
Is there any such flag, ideally for connections made to the LDAP server, to tell me if the user session was authenticated at the RODC, or if the authentication was passed to the full DC? I realise I could do a SamLogonEx or Kerberos login and get the logon_sever from the info3/PAC, but I want to know the full set of options I have. This will help me test the fall-back from the RODC to the full DC for Samba, and the subsequent replication of the secrets (if permitted). Also, where is the fallback to the PDC documented, when a user authenticates (by any means) to an RODC but the password isn't there, or wasn't correct? Thanks, Andrew Bartlett -- Andrew Bartlett https://samba.org/~abartlet/ Authentication Developer, Samba Team https://samba.org Samba Development and Support, Catalyst IT https://catalyst.net.nz/services/samba _______________________________________________ cifs-protocol mailing list [email protected] https://lists.samba.org/mailman/listinfo/cifs-protocol
