3.3.5.6.2 Normative Specification

  • Article

Upon receiving this message, the responder SHOULD<21> return STATUS_NOT_SUPPORTED if the requestor is not an RODC. Otherwise, the responder MUST process the data from the message subject to all of the following constraints:

  1. The responder SHOULD validate the integrity of the message with respect to embedded offsets and sizes. Responder implementations SHOULD return STATUS_INVALID_PARAMETER upon receiving malformed messages.<22>

  2. If the responder is not a writable NC replica in the same domain as the RODC, then the responder SHOULD<23> return an error.

  3. For each individual update contained in the Updates field of the LastLogonTimeStampUpdatesForward message (section 2.2.7), the responder MUST do the following:

    1. If there is no object in the database that has an objectSid attribute value that corresponds to the value constructed by concatenating the LastLogonTimeStampUpdate.AccountRid field with the configured domain SID, skip this update and go to the next one.

    2. Verify that the RODC is allowed to cache credentials for the object found, as specified in [MS-DRSR] section 4.1.10.5.15; otherwise, skip this update request and go to the next one.

    3. Update the lastLogonTimeStamp attribute of the directory entry in accordance with the algorithm specified for that attribute in [MS-ADA1]. This MUST be an originating update.

  4. All errors MUST be ignored.