Vitaliy Leschenko’s blog
ru
Виталий Лещенко

Windows Server for beginners. Part 2: Disks and network: diskpart, netsh and their PowerShell replacements

All parts of the series “Windows Server for beginners”

In the previous part we configured an address with four cmdlets from the NetTCPIP module. Any guide older than 2012 does the same with a single line of netsh interface ip set address, and leaves disk partitioning to diskpart. Both utilities are still here: they exist on every Windows from XP to Server 2025, they work in the recovery environment, where PowerShell modules may be missing, and they can do a few things nobody ever wrote cmdlets for. So an administrator needs to know both: to read other people's scripts, and to avoid being left without a tool when PowerShell isn't available.

This part is built like a two-way dictionary: what the old utility does, which cmdlet does it now, and where there is no cmdlet.

How Windows sees storage

Before partitioning anything, you need to understand what exactly is being partitioned. Windows has three levels:

 Disk                     a physical or virtual device: Disk 0, Disk 1, …
   └─ Partition           a piece of a disk with a type and a number: Partition 1, 2, …
        └─ Volume         a file system on a partition, with or without a letter: C:, D:, \\?\Volume{…}

A disk has a number (starting from zero), a partition style, a state (Online/Offline) and a read-only attribute. The partition style is the partition table:

  • MBR (Master Boot Record, 1983): a table of four entries in the first sector, 32-bit addresses, meaning disks up to 2 TB. More than four partitions only through an "extended" partition with logical drives inside. Boots in BIOS mode.
  • GPT (GUID Partition Table): 128 partitions by default, disks up to 9.4 ZB, each partition has a GUID identifier and a GUID type, a copy of the table at the end of the disk and checksums. Boots in UEFI mode. This is the standard for everything installed today.

A partition on a GPT disk has a type, and there are four types you'll find on a Windows system disk:

Partition Type GUID Size What's inside
EFI System Partition c12a7328-f81f-11d2-ba4b-00a0c93ec93b 100 MB FAT32, the \EFI\Microsoft\Boot\bootmgfw.efi boot loader and the BCD store
Microsoft Reserved (MSR) e3c9e316-0b5c-4db8-817d-f92df00215ae 16 MB empty; reserved for system use, no file system
Basic data ebd0a0a2-0b84-4a0b-9d6b-3b2b5b4b6a5a… the rest NTFS with Windows, the one that gets the letter C:
Windows RE de94bba4-06d1-4d40-a16a-bfd50179d6ac 600–1000 MB the winre.wim recovery environment

A volume is a file system on top of a partition: NTFS, ReFS, FAT32, exFAT. A volume can have a letter, a mount point in a folder on another volume, or nothing at all (EFI and RE have no letters). For servers the file system is NTFS, except when you need ReFS: it is more resilient to corruption and faster with virtual disks and databases, but it doesn't support compression, quotas or EFS encryption and can't be used for the system volume.

There are also dynamic disks — the Windows 2000 way of building a mirror or RAID-5 from several disks. They are deprecated: their replacement is Storage Spaces, where physical disks are combined into a pool and virtual disks with the required resiliency are carved out of the pool. Simple disks will be enough for this series.

diskpart

diskpart isn't a command but a separate shell with its own prompt. The main thing to understand about it: it works through a context. The select disk 1 command makes disk 1 current, and all subsequent commands — clean, convert, create — apply to it until something else is selected. That is also its main danger: a clean run on the wrong disk wipes the partition table in a second, with no confirmation at all.

A typical session on a new disk:

PS C:\> diskpart

Microsoft DiskPart version 10.0.26100.1150

Copyright (C) Microsoft Corporation.
On computer: DC1

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online           40 GB      0 B        *
  Disk 1    Online          100 GB   100 GB

DISKPART> select disk 1

Disk 1 is now the selected disk.

DISKPART> clean
DISKPART> convert gpt
DISKPART> create partition primary
DISKPART> format fs=ntfs label=Data quick
DISKPART> assign letter=D
DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     C                NTFS   Partition     39 GB  Healthy    Boot
  Volume 1         Recovery     NTFS   Partition    799 MB  Healthy    Hidden
  Volume 2                      FAT32  Partition    100 MB  Healthy    System
  Volume 3     D   Data         NTFS   Partition    100 GB  Healthy

DISKPART> exit

What else diskpart can do, and which of it comes in handy:

Command What it does
list disk / list partition / list volume / list vdisk show the objects of a level
select disk N, select partition N, select volume N or a letter select the context
detail disk / detail partition details: ID, type, attributes, device path
clean / clean all wipe the partition table (fast) / zero out the whole disk
convert gpt / convert mbr change the partition style of an empty disk
create partition efi size=100, create partition msr size=16, create partition primary [size=MB] create a partition of the required type
format fs=ntfs quick label=X, assign letter=X, assign mount=C:\Mount\X, remove letter=X file system and letter
shrink desired=MB, extend [size=MB] resize a partition
online disk, offline disk, attributes disk clear readonly disk state
san policy=OnlineAll how to treat new disks (see below)
set id= and gpt attributes= partition type and its GPT attributes
create vdisk file=C:\x.vhdx maximum=10240 type=expandable, attach vdisk, detach vdisk VHD/VHDX virtual disks without Hyper-V
rescan rescan the bus

diskpart scripts are written to a text file, one command per line, and run with diskpart /s script.txt. This is still how disks are partitioned in deployment scripts and in autounattend.xml.

Another context where you can't do without diskpart is the recovery environment and the installer console (Shift+F10 in the setup window). There's either no PowerShell there or no Storage module, and that is exactly where you need to sort out partitions or recreate the EFI partition after losing the boot loader:

select disk 0
list partition
select partition 1          ← EFI
assign letter=S
exit
bcdboot C:\Windows /s S: /f UEFI

bcdboot copies the boot loader files from the installed Windows to partition S: and recreates the BCD boot configuration. These six lines bring back to life a server that "can't see the disk" after a failed firmware update or a move to another hypervisor.

The Storage module

Since Windows Server 2012, everything diskpart does can be done by the Storage module, with objects and through the pipeline. The same actions on a new disk:

PS C:\> Get-Disk

Number Friendly Name           Serial Number   HealthStatus OperationalStatus Total Size Partition Style
------ -------------           -------------   ------------ ----------------- ---------- ---------------
0      Msft Virtual Disk                       Healthy      Online                 40 GB GPT
1      Msft Virtual Disk                       Healthy      Online                100 GB RAW

PS C:\> Initialize-Disk -Number 1 -PartitionStyle GPT
PS C:\> New-Partition -DiskNumber 1 -UseMaximumSize -DriveLetter D
PS C:\> Format-Volume -DriveLetter D -FileSystem NTFS -NewFileSystemLabel Data -Confirm:$false

DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining      Size
----------- ------------ -------------- --------- ------------ ----------------- -------------      ----
D           Data         NTFS           Fixed     Healthy      OK                     99.89 GB  99.98 GB

RAW as the partition style means an empty disk with no table. And here is the same thing in one line for all empty disks of a server, the way it's written in provisioning scripts:

Get-Disk | Where-Object PartitionStyle -eq RAW |
    Initialize-Disk -PartitionStyle GPT -PassThru |
    New-Partition -AssignDriveLetter -UseMaximumSize |
    Format-Volume -FileSystem NTFS -NewFileSystemLabel Data -Confirm:$false

That is the difference in approach: diskpart runs commands against the selected context, while PowerShell passes objects down the pipeline, and each next cmdlet works with what the previous one returned (-PassThru makes Initialize-Disk return the disk; otherwise it returns nothing).

How the other commands map:

diskpart Storage
list disk / list partition / list volume Get-Disk, Get-Partition, Get-Volume; physical disks — Get-PhysicalDisk
detail disk Get-Disk -Number 1 | Format-List *
clean Clear-Disk -Number 1 -RemoveData -RemoveOEM -Confirm:$false
convert gpt Set-Disk -Number 1 -PartitionStyle GPT (empty disks only)
create partition primary size= New-Partition -DiskNumber 1 -Size 20GB
create partition efi New-Partition -GptType '{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}' -Size 100MB
format fs=ntfs quick Format-Volume -FileSystem NTFS (quick by default, full with -Full)
assign letter= / assign mount= Set-Partition -NewDriveLetter E, Add-PartitionAccessPath -AccessPath C:\Mount\Data
shrink / extend Resize-Partition -Size …; limits — Get-PartitionSupportedSize
online disk, attributes disk clear readonly Set-Disk -Number 1 -IsOffline $false -IsReadOnly $false
san policy=OnlineAll Set-StorageSetting -NewDiskPolicy OnlineAll
attach vdisk Mount-DiskImage -ImagePath C:\x.vhdx (works for ISO too)
create vdisk New-VHD from the Hyper-V module; without Hyper-V — diskpart only
rescan Update-HostStorageCache

SAN policy deserves a separate word, because it explains the popular question "I attached a second disk to the server and it's Offline". The policy determines what to do with a disk the system sees for the first time. The Windows Server default is Offline Shared: disks on a shared bus (iSCSI, Fibre Channel, SAS with several hosts) stay Offline so that two servers don't start writing to the same LUN at once, while local ones come online immediately. To check and change it:

PS C:\> Get-StorageSetting | Select-Object NewDiskPolicy

NewDiskPolicy
-------------
OfflineShared

PS C:\> Set-StorageSetting -NewDiskPolicy OnlineAll

On a standalone server OnlineAll is safe and saves you a manual Set-Disk -IsOffline $false for every new disk.

What remains diskpart's domain. GPT subtleties — partition attributes (gpt attributes=0x8000000000000001 makes a partition "required", and Disk Management stops offering to delete it) and set id= to change a partition type — are only partly available in Storage through Set-Partition -GptType and -IsHidden. Creating a VHD without Hyper-V — diskpart only. And the recovery environment: Storage isn't available there. In every other case the module is more convenient.

netsh

netsh (network shell) appeared in Windows 2000 and is built differently from diskpart: it's a tree of contexts, each responsible for its own subsystem and implemented by a separate helper library. The command netsh interface ipv4 show addresses is the interface context, the ipv4 subcontext, the show addresses command. Run without arguments, netsh opens a shell where you can enter contexts as if they were directories:

PS C:\> netsh
netsh>interface ipv4
netsh interface ipv4>show addresses "Ethernet"

Configuration for interface "Ethernet"
    DHCP enabled:                         No
    IP Address:                           192.168.1.10
    Subnet Prefix:                        192.168.1.0/24 (mask 255.255.255.0)
    Default Gateway:                      192.168.1.1
    Gateway Metric:                       256
    InterfaceMetric:                      15

netsh interface ipv4>exit

The contexts you'll run into on servers:

Context Responsible for Replaced by
interface ipv4, interface ipv6 addresses, routes, DNS servers, MTU, protocol parameters NetTCPIP, DnsClient
interface tcp global TCP parameters: window auto-tuning, ECN, RSS Get-NetTCPSetting, Set-NetTCPSetting
interface portproxy TCP port forwarding no replacement
advfirewall Windows Firewall with Advanced Security and IPsec NetSecurity
http HTTP.sys: certificates on ports, URL reservations no replacement outside IIS
winhttp system proxy for services no replacement
trace traffic capture and component tracing to ETL pktmon
wlan Wi-Fi profiles not needed on servers
winsock, interface ip reset stack reset no replacement
dhcpclient, dnsclient client parts Get-NetIPInterface, Clear-DnsClientCache
nps, ras, routing, branchcache, lan server roles role modules (NPS, RemoteAccess, …)
dhcp, wins old server contexts removed: DhcpServer, dnscmd

netsh has two useful features that standalone commands lack. Any command can be run on another machine with the -r name switch (it works over RPC, in a domain — with Kerberos; the equivalent of -ComputerName and -CimSession in cmdlets). And many set commands have store=persistent / store=active: apply permanently or only until reboot, which is handy for experiments with MTU or routes when there's a risk of cutting yourself off from the server.

PowerShell network modules

Four modules replace netsh interface and advfirewall, with around two hundred cmdlets between them. The dozen you need:

NetAdapter — the physical and virtual adapter, layer 2:

Get-NetAdapter                                      # list, state, speed
Get-NetAdapter Ethernet | Get-NetAdapterAdvancedProperty   # Jumbo Packet, RSS, VLAN ID, offloads
Set-NetAdapterAdvancedProperty Ethernet -DisplayName 'Jumbo Packet' -DisplayValue '9014 Bytes'
Get-NetAdapterBinding Ethernet                      # which protocols are bound (ms_tcpip6 is IPv6: leave it alone)
Restart-NetAdapter Ethernet
Get-NetAdapterStatistics Ethernet                   # bytes, packets, errors

NetTCPIP — addresses, routes, layer 3 interfaces, connections:

Get-NetIPAddress -AddressFamily IPv4                # equivalent of netsh int ipv4 show addresses
Get-NetIPInterface                                  # DHCP on/off, metric, MTU (NlMtu) per interface and family
Set-NetIPInterface Ethernet -AddressFamily IPv4 -NlMtuBytes 1400   # netsh int ipv4 set subinterface mtu=
Get-NetRoute -AddressFamily IPv4                    # route print
New-NetRoute -DestinationPrefix 10.10.0.0/16 -InterfaceAlias Ethernet -NextHop 192.168.1.254
Get-NetNeighbor -AddressFamily IPv4                 # arp -a; for IPv6 — the NDP neighbor table
Get-NetTCPConnection -State Listen                  # netstat -an
Get-NetIPv6Protocol                                 # global IPv6 parameters

For a server with IPv6 from Router Advertisement, two Set-NetIPv6Protocol parameters are useful: -UseTemporaryAddresses Disabled turns off temporary addresses (nobody needs a server that changes its address once a day), and -RandomizeIdentifiers Disabled makes it build the interface identifier from the MAC address so the address is predictable. These are the equivalents of netsh interface ipv6 set privacy state=disabled and set global randomizeidentifiers=disabled.

DnsClient — the client side of DNS:

Get-DnsClientServerAddress                          # who is configured on each interface
Set-DnsClientServerAddress Ethernet -ServerAddresses 192.168.1.10, 192.168.1.11
Get-DnsClient                                       # suffixes, DNS registration per interface
Set-DnsClientGlobalSetting -SuffixSearchList corp.example.com, example.com
Resolve-DnsName dc1.corp.example.com -Type A        # nslookup with objects as output
Clear-DnsClientCache                                # ipconfig /flushdns
Register-DnsClient                                  # ipconfig /registerdns

NetSecurity — the firewall and IPsec:

Get-NetFirewallProfile                              # netsh advfirewall show allprofiles
Set-NetFirewallProfile -Profile Public -DefaultInboundAction Block
New-NetFirewallRule -DisplayName 'App 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow -Profile Domain
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Enable-NetFirewallRule
Get-NetFirewallRule -Enabled True -Direction Inbound | Get-NetFirewallPortFilter | Where-Object LocalPort -eq 445
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Format-Table DisplayName, Profile, Program

The same rule in netsh: netsh advfirewall firewall add rule name="App 8080" dir=in action=allow protocol=TCP localport=8080 profile=domain. One to one; the difference is that Get-NetFirewallRule returns objects, and their port, address and program filters live in separate objects, fetched with Get-NetFirewallPortFilter, Get-NetFirewallAddressFilter and Get-NetFirewallApplicationFilter. It's inconvenient until you get used to it, and very convenient afterwards: one query for "all rules that open 445 to the outside" across a hundred servers.

The network profile of an interface is a separate cmdlet, Get-NetConnectionProfile. On a standalone server the network often ends up Public, and half of the management rules are closed in that profile; you can switch it to Private with Set-NetConnectionProfile -InterfaceAlias Ethernet -NetworkCategory Private. The Domain profile can't be assigned by hand: an interface gets it on its own when it can see a domain controller.

What only netsh can still do

Port forwarding. netsh interface portproxy makes Windows listen on a port and forward connections to another address and port, including from IPv4 to IPv6 and back. There is no cmdlet, and apparently there won't be.

PS C:\> netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8080 connectaddress=192.168.1.20 connectport=80
PS C:\> netsh interface portproxy show all

Listen on ipv4:             Connect to ipv4:

Address         Port        Address         Port
--------------- ----------  --------------- ----------
0.0.0.0         8080        192.168.1.20    80

It works thanks to the IP Helper service (iphlpsvc); if the service is disabled, the rules exist but nothing gets forwarded. A firewall rule for port 8080 has to be added separately. It comes in handy when you need to temporarily expose a service from another machine or forward a port into WSL.

HTTP.sys. The web server in Windows is built into the kernel: the HTTP.sys driver accepts connections, and IIS, WinRM, WSUS and ASP.NET Core services with the HttpSys server are its clients. Certificates are bound to ports at the HTTP.sys level, and the right to listen on a URL without administrator rights is granted there too:

netsh http show sslcert
netsh http add sslcert ipport=0.0.0.0:8443 certhash=3f1a…c9e2 appid='{12345678-0000-0000-0000-000000000001}'
netsh http add urlacl url=http://+:8080/ user='CORP\svc-app'
netsh http show urlacl

For IIS sites the WebAdministration module does this, but a service outside IIS (and WinRM over HTTPS, which we'll set up in the part about Remoting, is exactly that case) can only be configured here.

Proxy for services. Windows has two sets of proxy settings: WinINET — the per-user one, the one in the browser settings — and WinHTTP — the system one, used by Windows Update, WinRM, the WSUS client, Defender and services running under accounts without a profile. The second is set only with netsh:

netsh winhttp show proxy
netsh winhttp set proxy proxy-server="proxy.corp.example.com:3128" bypass-list="*.corp.example.com;<local>"
netsh winhttp reset proxy

A server that "can't see Windows Update" on a network with a mandatory proxy is cured with this command or by importing the user settings: netsh winhttp import proxy source=ie.

Stack reset. netsh winsock reset rebuilds the Winsock catalog, into which antivirus software, VPN clients and other layered service providers hook themselves; netsh interface ipv4 reset and ipv6 reset return the protocol settings to factory defaults. Both commands are a last resort for "the network is there but nothing works" after removing a badly written agent, and both require a reboot. The second one also wipes static addresses on all interfaces, so on a remote server it is only run from the hypervisor console.

Firewall export and import. netsh advfirewall export C:\fw.wfw saves the entire firewall policy, including IPsec rules, to a binary file, and import restores it. NetSecurity has Copy-NetFirewallRule between stores and GPO objects, but it can't give you the whole thing as a file in one step.

Traffic capture. tcpdump exists on Windows only as third-party ports — WinDump on top of the Npcap driver and the commercial tcpdump for Windows — and they require installing a capture driver on the server. There are two built-in ways to capture packets without installing anything.

The first is netsh trace, available since Windows 7. It writes an ETL file with packets and events of network components:

netsh trace start capture=yes tracefile=C:\Temp\dns.etl maxsize=200 persistent=no
Resolve-DnsName www.example.com
netsh trace stop

The ETL file opens in Microsoft Network Monitor or Message Analyzer, or is converted to pcapng with Microsoft's etl2pcapng utility from GitHub and opened in Wireshark. The persistent=yes parameter continues the capture after a reboot, which is invaluable for "at system startup" problems.

The second is pktmon, available since Windows Server 2019 and Windows 10 1809, and it's more convenient: it supports filters and converts to pcapng by itself.

PS C:\> pktmon filter add -p 53
PS C:\> pktmon start --capture --pkt-size 0
Logger Parameters:
    Logger name:          PktMon
    Logging mode:         Circular
    Log file:             C:\Temp\PktMon.etl
    Max file size:        512 MB
    Memory buffers:       64 MB
Collected Data:
    Packet counters, packet capture
Capture Type:
    All packets

PS C:\> Resolve-DnsName www.example.com | Out-Null
PS C:\> pktmon stop
Flushing logs...
Merging metadata...
Log file: C:\Temp\PktMon.etl (No events lost)

PS C:\> pktmon etl2pcap C:\Temp\PktMon.etl --out C:\Temp\dns.pcapng
Processing...
Packets total:       4
Packet drop count:   0
Packets formatted:   4
Formatted file:      C:\Temp\dns.pcapng

pktmon filter add -p 53 means port 53 only, --pkt-size 0 means whole packets, not the first 128 bytes. Real time works too: pktmon start --capture --log-mode real-time prints packets to the console, like tcpdump without the -w flag. The resulting pcapng opens in Wireshark on a workstation, and from there it's all as in the networking series. In the parts about Kerberos and replication, this is exactly how we'll capture the exchanges.

A hands-on look

Who is listening on the server's ports is a question that comes up every time a "port is in use" or a "service doesn't respond". netstat -ano shows the PID; Get-NetTCPConnection gives objects you can attach the process name to:

PS C:\> Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress, LocalPort, OwningProcess, @{n='Process'; e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
    Sort-Object LocalPort -Unique | Format-Table -AutoSize

LocalAddress LocalPort OwningProcess Process
------------ --------- ------------- -------
0.0.0.0            135           916 svchost
0.0.0.0            445             4 System
0.0.0.0           3389          1204 svchost
0.0.0.0           5985             4 System
::                47001            4 System
0.0.0.0          49664           728 lsass
0.0.0.0          49665          1000 svchost

Four ports you'll find on any server: 135 is the RPC Endpoint Mapper, through which RPC services find each other (we'll deal with it in the part about how AD works); 445 is SMB; 5985 and 47001 are WinRM (the second is an internal listener for local subscriptions); 3389 is RDP, which we enabled in the previous part. The System process with PID 4 on 445 and 5985 is the kernel drivers srv2.sys and HTTP.sys, not user processes. lsass on 49664 is the Local Security Authority listening on a dynamic RPC port; once the server becomes a controller, it will also get 88 (Kerberos), 389 and 636 (LDAP), 3268 and 3269 (global catalog), 53 (DNS), 464 (Kerberos password change) and 9389 (AD Web Services).

The routing table:

PS C:\> Get-NetRoute -AddressFamily IPv4 | Where-Object NextHop -ne '0.0.0.0' | Format-Table DestinationPrefix, NextHop, InterfaceAlias, RouteMetric, ifMetric

DestinationPrefix NextHop     InterfaceAlias RouteMetric ifMetric
----------------- -------     -------------- ----------- --------
0.0.0.0/0         192.168.1.1 Ethernet                 0       15

Routes with NextHop 0.0.0.0 are local subnets and the host's own addresses; there are many of them and they are uninteresting. There is one default route; the route metric plus the interface metric gives the total cost, and when there are several interfaces and traffic goes "the wrong way", these sums are exactly what you compare. If you want the old view, route print is still there.

And the whole disk as the system sees it, from the physical device to the volume:

PS C:\> Get-PhysicalDisk | Format-Table DeviceId, FriendlyName, MediaType, BusType, Size, HealthStatus
PS C:\> Get-Disk 0 | Get-Partition | Format-Table PartitionNumber, Type, GptType, Size, DriveLetter, IsBoot, IsSystem

PartitionNumber Type      GptType                                Size DriveLetter IsBoot IsSystem
--------------- ----      -------                                ---- ----------- ------ --------
1               System    {c12a7328-f81f-11d2-ba4b-00a0c93ec93b} 100 MB                False True
2               Reserved  {e3c9e316-0b5c-4db8-817d-f92df00215ae}  16 MB                False False
3               Basic     {ebd0a0a2-0b84-4a0b-9d6b-3b2b5b4b6a5a}  39 GB C             True False
4               Recovery  {de94bba4-06d1-4d40-a16a-bfd50179d6ac} 799 MB                False False

These are the four partitions we talked about at the beginning. IsSystem is the partition with the boot loader, IsBoot is the partition with Windows; Microsoft's terminology names them exactly the opposite of what you'd expect, and it's worth memorizing once.

We have a server, and we can read its disks and network at any level. Time to get to what all this was for. But before running Install-ADDSForest, it's worth understanding what exactly this command will create: a forest, a domain, directory partitions, a global catalog, SYSVOL and five protocols that hold it all together.

Next — Part 3: how Active Directory works. Forest, tree, domain and OU; what directory partitions are and why there are four of them; the global catalog; SYSVOL; and an overview of the LDAP, Kerberos, NTLM, SMB and RPC protocols — what each of them does in a domain and when it comes into play.

Only registered users can leave a comment.

Sign in or register to leave a comment.

© 2006-2026 Vitaliy Leschenko