3.1.1.4 Secret Object Data Model
Inside the Local Security Authority (Domain Policy) Remote Protocol database, a secret object is represented by the following pieces of data.
|
Name |
Type |
Attribute name |
|---|---|---|
|
Name |
RPC_UNICODE_STRING |
|
|
Security Descriptor |
LSAPR_SR_SECURITY_DESCRIPTOR |
|
|
Old Set Time |
LARGE_INTEGER |
priorSetTime ([MS-ADA3] section 2.159) |
|
Old Value |
binary data |
priorValue ([MS-ADA3] section 2.160) |
|
New Set Time |
LARGE_INTEGER |
lastSetTime ([MS-ADA1] section 2.353) |
|
New Value |
binary data |
currentValue ([MS-ADA1] section 2.139) |
The Name field uniquely identifies the secret by using a Unicode string. Two different secrets MUST have different names (the comparison is case-sensitive). The Name field MUST be read-only. To be considered valid, the length of the name in bytes MUST be even; it MUST be greater than 0 and less than 0x101. The secret name MUST NOT contain the "\" character. Special values of the Name field indicate secret types. The different secret types are as follows:
Global
Local
Trusted Domain
System
The following rules govern secret type assignments.
The term "starts with" literally means "must have a nonzero number of characters following the prefix". Names consisting of only a reserved prefix are invalid.
The following table indicates the secret name pattern and the associated secret type.
|
Secret name or name pattern |
Type of secret |
|---|---|
|
Starts with "G$$" |
Trusted domain |
|
Starts with "G$" |
Global |
|
Starts with "L$" |
Local |
|
Starts with "M$" |
System |
|
Starts with "_sc_" |
System |
|
Starts with "NL$" |
System |
|
Starts with "RasDialParams" |
Local |
|
Starts with "RasCredentials" |
Local |
|
Equal to "$MACHINE.ACC" |
System |
|
Equal to "SAC" |
Local |
|
Equal to "SAI" |
Local |
|
Equal to "SANSC" |
Local |
The type of a secret defines the access and availability boundary for a given secret object.
System Secret: Cannot be accessed by any clients.
Local Secret: Can be accessed only by a client that is on the same machine as the server.
Global Secret: Replicates between domain controllers in the same domain, allowing each domain controller to be able to respond to secret requests of this type.
Trusted Domain Secret: Used with trusted domain objects to store trust passwords. Trusted domain secrets also replicate between domain controllers in the same domain.<52>
The security descriptor field controls access to the secret object. Every secret object in the Local Security Authority (Domain Policy) Remote Protocol database that has Local Secret type MUST have a valid security descriptor. The security descriptor of Local Secret objects can be queried by calling the LsarQuerySecurityObject (section 3.1.4.9.1) method and changed by calling the LsarSetSecurityObject (section 3.1.4.9.2) method. The server MUST assign a default security descriptor to every newly created secret object, even if the client did not specify a default value.<53>
The value of a secret is a byte BLOB. Depending on the caller's choices, the server stores 0, 1, or 2 values for the secret, the 2 values being "current" and "previous" and 1 value being either "current" or "previous". Both versions of the secret's value are accompanied by a 64-bit time stamp in Coordinated Universal Time (UTC), sometimes referred to as Greenwich Mean Time, in units of 100 nanoseconds since January 1, 1601.