3.3.4.1.1 Generating an Initial NL_AUTH_MESSAGE Token
The client generates a NL_AUTH_MESSAGE token to initiate authentication to a server. The MessageType field of this token MUST be set to zero to indicate that this is a Negotiate message type.
The client MUST provide at least one domain name and one computer name in the token by providing the Flags bit and the corresponding text buffer. The Flags field is a bitwise OR of the values described under the Flags field of the NL_AUTH_MESSAGE token in section 2.2.1.3.1. This value represents the names available in the token. The Buffer field is then composed by concatenating the strings of the names indicated by the Flags value. The compressed UTF-8 strings are generated, as specified in [RFC1035] section 4.1.4.
The following is an example token on the wire.
-
00 00 00 00 17 00 00 00 4E 54 44 45 56 00 4E 41 ........NTDEV.NA 53 4B 4F 00 05 6E 74 64 65 76 04 63 6F 72 70 09 SKO..ntdev.corp. 6D 69 63 72 6F 73 6F 66 74 03 63 6F 6D 00 05 4E microsoft.com..N 41 53 4B 4F 00 ASKO.