Add an entry to the binding cache for the machine.

Add an entry to the binding cache for the machine. The dc-flags value may be any combination of DC types as described by the DS_* macros in DsGetDC.h (ex. 1 for DS_PDC_FLAG).

Documented in NTSecApi.h as adding "server credentials" to a given logon session, only applicable during AcceptSecurityContext, and requiring TCB to alter "other" credentials. Specifically, during the AcceptSecurityContext for Kerberos an AP-REQ will be checked to be valid and decrypted. Kerberos will attempt to use any supplied extra credentials in addition to the logon session’s primary credentials when attempting to decrypt the AP-REQ. The command allows a user to add, replace, or remove the additional credential. The password is not required when removing a credential.

Behaves the same as the AddExtraCredentials command but allows a user to add a list of "principal names" to the credential.

The command notifies Kerberos that the password for the machine has changed. The command will use client supplied pointers to reference LSASS’s own memory without checking if the client is LSASS itself. A client is intended to allocate and reference valid memory in LSASS’s own process for the command to succeed. As such, the command is not currently planned for inclusion in the project.

Changes a user’s password in a Windows domain or configured non-Windows Kerberos realm that supports the Kerberos Password Change Protocol. The caller must know the user’s current password to change it.

Purge any PKINIT device credentials from the current machine. SeTcbPrivilege is required and the luid must be either 996 (e.g., NETWORKSERVICE_LUID) or 999 (e.g., SYSTEM_LUID).

The DebugRequest command is not included with release builds of Windows. The command originally supported allowing users to issue a breakpoint for a kernel debugger, gather statistics about the kerberos ticket cache, and generate a token for the Administrator user. Current debug builds of Windows may support additional debug requests.

The DecryptData command is not included with release builds of Windows. The original command allowed users to decrypt a buffer with either a specified key or the primary key a logon session.

Pin a KDC as described by James Forshaw and Nick Landers. The command cannot be called from WOW64 clients. The dc-flags value may be any combination of DC types as described by the DS_* macros in DsGetDC.h (ex. 1 for DS_PDC_FLAG).

The NetworkTicketLogon command is not included with release builds of Windows.

Get cloud kerberos configuration information.

Creates a machine password bound by CredGuard, then changes the password on the KDC machine account, the password cache (e.g., the registry), and the logon credentials if applicable.

Remove all binding cache entries for the machine. SeTcbPrivilege is required.

The PurgeKdcProxyCache command has not been fully tested, but should should remove cached KDC proxy tickets. SeTcbPrivilege is required to specify another logon session.

Purge tickets in the ticket cache for a logon session. A server name and realm may be used to filter which tickets should be purged. The server name and realm must both be specified to be used. If both are not specified then all tickets will be purged. SeTcbPrivilege is required to specify another logon session.

Functions the same as the PurgeTicketCache but allows you to specify a client name and realm to filter tickets by. The client name and realm must both be specified to be used. The command also allows you to explicitly purge all tickets. If purging all tickets is explicitly specified then all ticket filters will be ignored.

Get information about the binding cache for the machine. SeTcbPrivilege is required.

Get the extended policy information for a domain.

The QueryKdcProxyCache command has not been fully tested, but should provide information about KDC proxy cached tickets. SeTcbPrivilege is required to specify another logon session.

Get the TGT and password information for a credential manager blob. The command will check if the client is LSASS itself. As such, the command is not currently planned for inclusion in the project.

Show the server name, realm name, start time, end time, renew time, encryption type, and flags for each ticket in the ticket cache for the current logon session. SeTcbPrivilege is required to specify another logon session.

Functions the same as the QueryTicketCache but will additionally return the client name and realm for each ticket.

Functions the same as the QueryTicketCacheEx but will additionally return the session key type and branch ID for each ticket.

Functions the same as the QueryTicketCacheEx2 but will additionally return the cache flags and KDC name for each ticket.

Get the proxy cache information for a service for user (S4U) logon.

The RefreshPolicy command is not included with release builds of Windows. The use of the command is not currently known.

Notifies Kerberos when the smart card credentials need to be updated. Implemented to allow the Winlogon session to refresh credentials as needed on terminal server connects and re-connects.

Get a ticket either by querying the ticket cache for the current logon session or by requesting the ticket from the current KDC. SeTcbPrivilege is required to specify another logon session. If the requested ticket is a TGT, SeTcbPrivilege is required to additionally get the session key for the TGT. If the TGT was obtained when Credential Guard was active, the returned TGT session key will not be valid, making the TGT unusable.

Return the keytab data for a domain user.

Get the TGT from the ticket cache of the specified user logon session. SeTcbPrivilege is required to additionally get the session key for the TGT. If the TGT was obtained when Credential Guard was active, the returned TGT session key will not be valid, making the TGT unusable.

Changes a user’s password in a Windows domain or configured non-Windows Kerberos realm that supports the Kerberos Password Change Protocol. The caller does not need to know the user’s current password to change it.

Behaves the same as the SetPassword command but allows a user to specify a client name and realm.

Adds a supplied ticket to the ticket cache for the current logon session. SeTcbPrivilege is required to specify another logon session.

Transfer data between two kerberos logon sessions. The specific data that is transferred and privileges that may be required are still being determined. The function only accepts the cleanup credentials and optimistic logon flags.

Updates the IP addresses used by netlogon. The command will check if the client is LSASS itself. As such, the command is not currently planned for inclusion in the project.

Verify the user name and password for a domain user. The command will check if the client is LSASS itself. As such, the command is not currently planned for inclusion in the project.

Verifies that a PAC was signed by a valid KDC. A client is intended to issue the command using a passthrough request to the KDC and it is the only passthrough command that the kerberos package supports.

Remove all previously pinned KDCs.