2.2.6.23 SAMPR_USER_INTERNAL1_INFORMATION

  • Article

The SAMPR_USER_INTERNAL1_INFORMATION structure holds the hashed form of a cleartext password.

 typedef struct _SAMPR_USER_INTERNAL1_INFORMATION {
   ENCRYPTED_NT_OWF_PASSWORD EncryptedNtOwfPassword;
   ENCRYPTED_LM_OWF_PASSWORD EncryptedLmOwfPassword;
   unsigned char NtPasswordPresent;
   unsigned char LmPasswordPresent;
   unsigned char PasswordExpired;
 } SAMPR_USER_INTERNAL1_INFORMATION,
  *PSAMPR_USER_INTERNAL1_INFORMATION;

EncryptedNtOwfPassword: An NT hash encrypted with the 16-byte SMB session key obtained as specified in either section 3.1.2.4 or section 3.2.2.3.

EncryptedLmOwfPassword: An LM hash encrypted with the 16-byte SMB session key obtained as specified in either section 3.1.2.4 or section 3.2.2.3.

NtPasswordPresent: If nonzero, indicates that the EncryptedNtOwfPassword value is valid; otherwise, EncryptedNtOwfPassword MUST be ignored.

LmPasswordPresent: If nonzero, indicates that the EncryptedLmOwfPassword value is valid; otherwise, EncryptedLmOwfPassword MUST be ignored.

PasswordExpired: See section 2.2.6.1.