<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/5f95c374-7951-42d9-816c-c7f4cff2ed52" data-linktype="external">msdn link</a></p><p>The <b>NetrLogonComputeServerDigest</b> method computes a
cryptographic digest of a message by using the MD5 message-digest algorithm, as
specified in <a href="https://go.microsoft.com/fwlink/?LinkId=90275" data-linktype="external">[RFC1321]</a>.
This method SHOULD<a id="Appendix_A_Target_233"></a><a aria-label="Product behavior note 233" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_233" data-linktype="relative-path">&lt;233&gt;</a> be called by a client computer
against a server and is used to compute a message digest, as specified in this
section. The client then calls the <a href="79ca6e90-ccd2-429e-b5ac-8050b620eef6" data-linktype="relative-path">NetrLogonComputeClientDigest</a>
method (as specified in section <a href="1bf3702b-be13-464a-ad5e-6be0fe210c90" data-linktype="relative-path">3.4.5.6.3</a>) and compare the
digests to ensure that the server that it communicates with knows the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_ae8614db-83d9-406d-aa79-90b2f07c3ed1" data-linktype="relative-path">shared secret</a> between the
client machine and the domain. </p><dl>
<dd>
<div><pre> NET_API_STATUS NetrLogonComputeServerDigest(
   [in, unique, string] LOGONSRV_HANDLE ServerName,
   [in] ULONG Rid,
   [in, size_is(MessageSize)] UCHAR * Message,
   [in] ULONG MessageSize,
   [out] CHAR NewMessageDigest[16],
   [out] CHAR OldMessageDigest[16]
 );
</pre></div>
</dd></dl><p><b>ServerName: </b>The custom binding handle, as
defined in section <a href="3b224201-b531-43e2-8c79-b61f6dea8640" data-linktype="relative-path">3.5.4.1</a>.</p><p><b>Rid: </b>The <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_df3d0b61-56cd-4dac-9402-982f1fedc41c" data-linktype="relative-path">RID</a> of the machine account
for which the digest is to be computed. The <a href="1d6fad9e-763d-495f-9bed-18c79304c3d7" data-linktype="relative-path">NetrLogonGetTrustRid method</a>,
as specified in section 3.5.4.8.1, is used to obtain the RID.</p><p><b>Message: </b>A pointer to buffer that contains the
message to compute the digest.</p><p><b>MessageSize: </b>The length of the data referenced
by the <i>Message</i> parameter, in bytes.</p><p><b>NewMessageDigest: </b>A 128-bit MD5 digest of the
current machine account password and the message in the <i>Message</i> buffer.
The machine account is identified by the <i>Rid</i> parameter.</p><p><b>OldMessageDigest: </b>A 128-bit MD5 digest of the
previous machine account password, if present, and the message in the <i>Message</i>
buffer. If no previous machine account password exists, then the current
password is used. The machine account is identified by the <i>Rid</i>
parameter.</p><p><b>Return Values: </b>The method returns 0x00000000
on success; otherwise, it returns a nonzero error code.</p><p>The server uses the server name passed in the <i>ServerName</i>
parameter to look up the domain for the request. If the name is not found, the
server MUST return ERROR_INVALID_COMPUTERNAME.</p><p>If the client does not have sufficient <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_d8092e10-b227-4b44-b015-511bb8178940" data-linktype="relative-path">privilege</a>, the server MUST
return ERROR_ACCESS_DENIED.</p><p>The server MUST construct the machine account <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">SID</a> using the <i>Rid</i>
parameter and the current domain with the format S-1-5-<i>current domain</i>-<i>Rid
parameter</i>.</p><p>The server MUST compute or retrieve the NTOWFv1 of the current
password, retrieve <b>lmPwdHistory</b> (<a href="../ms-ada1/19528560-f41e-4623-a406-dabcfff0660f" data-linktype="relative-path">[MS-ADA1]</a>
section <a href="../ms-ada1/1282e4c5-c992-4d64-80aa-e1dc57dbbe77" data-linktype="relative-path">2.363</a>),
and the NTOWFv1 of the previous password (if it exists) for the machine account
whose security identifier (<a href="../ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0" data-linktype="relative-path">[MS-ADA3]</a>
section <a href="../ms-ada3/2f548cb7-b713-46fd-ba88-d1cde605a972" data-linktype="relative-path">2.237</a>)
corresponds to the generated SID. If the machine account cannot be found, or
the machine account does not correspond to a machine, or the machine account is
disabled, the server MUST return ERROR_NO_SUCH_USER. When the server is an <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">RODC</a> and the NTOWFv1 of the
current password cannot be retrieved, the server MUST return
ERROR_NO_TRUST_LSA_SECRET.</p><p>The digest of the <i>Message</i> parameter MUST be
calculated with the following algorithm, using this <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_9a5d11c7-eea9-4217-b9a8-478c6786e9e8" data-linktype="relative-path">one-way function (OWF)</a> of
the password.</p><ol><li><p><span>    </span>CALL
MD5Init(md5context)</p>
</li><li><p><span>    </span>IF OWF of
password is present:</p>
<ol><li><p><span>   
</span>CALL MD5Update(md5context, OWF of password, length of OWF of password)</p>
</li></ol></li><li><p><span>    </span>CALL MD5Update(md5context,
Message, MessageSize)</p>
</li><li><p><span>    </span>CALL
MD5Final(md5context)</p>
</li><li><p><span>    </span>SET digest to
md5context.digest</p>
</li></ol><p>The <i>NewMessageDigest</i> parameter MUST be computed by
using the current password. The <i>OldMessageDigest</i> parameter MUST be
computed by using the previous password, if it exists. If the previous password
is not present, the new password MAY<a id="Appendix_A_Target_234"></a><a aria-label="Product behavior note 234" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_234" data-linktype="relative-path">&lt;234&gt;</a> be
used to compute the <i>OldMessageDigest</i>.</p><p>Creating a message digest for the previous password allows
the possibility of password replication latency to be accounted for. If the
machine account password was recently changed, but the change has not
propagated to the server processing this method, the server keeps the old
password.</p></div>