<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/5647a125-f6ae-4ea6-acec-14f3e9ec3a8b" data-linktype="external">msdn link</a></p><p>The <b>NetrServerPasswordGet</b> method SHOULD<a id="Appendix_A_Target_184"></a><a aria-label="Product behavior note 184" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_184" data-linktype="relative-path">&lt;184&gt;</a> allow a BDC to get a machine
account password from the DC with the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_663cb13a-8b75-477f-b6e1-bea8f2fba64d" data-linktype="relative-path">PDC</a> role in the domain. </p><dl>
<dd>
<div><pre> NTSTATUS NetrServerPasswordGet(
   [in, unique, string] LOGONSRV_HANDLE PrimaryName,
   [in, string] wchar_t* AccountName,
   [in] NETLOGON_SECURE_CHANNEL_TYPE AccountType,
   [in, string] wchar_t* ComputerName,
   [in] PNETLOGON_AUTHENTICATOR Authenticator,
   [out] PNETLOGON_AUTHENTICATOR ReturnAuthenticator,
   [out] PENCRYPTED_NT_OWF_PASSWORD EncryptedNtOwfPassword
 );
</pre></div>
</dd></dl><p><b>PrimaryName: </b>The custom binding handle, as
defined in section <a href="3b224201-b531-43e2-8c79-b61f6dea8640" data-linktype="relative-path">3.5.4.1</a>.</p><p><b>AccountName: </b>A null-terminated <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a> string that
contains the name of the account to retrieve the password for.<a id="Appendix_A_Target_185"></a><a aria-label="Product behavior note 185" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_185" data-linktype="relative-path">&lt;185&gt;</a></p><p><b>AccountType: </b>A <a href="4d1235e3-2c96-4e9f-a147-3cb338a0d09f" data-linktype="relative-path">NETLOGON_SECURE_CHANNEL_TYPE</a>
enumerated value, as specified in section 2.2.1.3.13, that defines the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_08ce423c-9f9c-48ed-afa8-8b64c04ecdca" data-linktype="relative-path">secure channel</a> to be used
for authentication.</p><p><b>ComputerName: </b>A null-terminated Unicode string
that contains the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_0334e0bd-2755-42f6-aeff-2d4a22bf4abf" data-linktype="relative-path">NetBIOS
name</a> of the DC making the call.</p><p><b>Authenticator: </b>A pointer to a <a href="76c93227-942a-4687-ab9d-9d972ffabdab" data-linktype="relative-path">NETLOGON_AUTHENTICATOR</a>
structure, as specified in section 2.2.1.1.5, that contains the encrypted logon
<a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_b505ab37-868d-426c-bb19-af21e675e0b8" data-linktype="relative-path">credential</a> and a time
stamp.</p><p><b>ReturnAuthenticator: </b>A pointer to a <b>NETLOGON_AUTHENTICATOR</b>
structure, as specified in section 2.2.1.1.5, that contains the server return <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_e72a2c02-84a2-4ce3-b66f-86f725642dc3" data-linktype="relative-path">authenticator</a>.</p><p><b>EncryptedNtOwfPassword: </b>A pointer to an <a href="f7458576-d538-47cd-b387-b6f98449a0ee" data-linktype="relative-path">ENCRYPTED_NT_OWF_PASSWORD</a>
structure, as specified in <a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a>
section <a href="../ms-samr/ce061fef-6d4f-4802-bd5d-26b11f14f4a6" data-linktype="relative-path">2.2.7.3</a>,
that contains the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_9a5d11c7-eea9-4217-b9a8-478c6786e9e8" data-linktype="relative-path">OWF</a>
password of the account.</p><p><b>Return Values: </b>The method returns 0x00000000
on success; otherwise, it returns a nonzero error code.</p><p>On receiving this call, the server MUST perform the
following validation steps:</p><ul><li><p><span><span> 
</span></span>Verify that the caller of this method is not an <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">RODC</a> or PDC; otherwise, the
server MUST return STATUS_ACCESS_DENIED.</p>
</li><li><p><span><span> 
</span></span>Verify that AccountName is not NULL and AccountType flags are
valid; otherwise, the server MUST return STATUS_INVALID_PARAMETER.</p>
</li><li><p><span><span> 
</span></span>Apply Common Error Processing Rule A, specified in section <a href="2d776bfc-e81f-4c8f-9da8-4c2920f65413" data-linktype="relative-path">3</a>.</p>
</li><li><p><span><span> 
</span></span>Apply Common Error Processing Rule B, specified in section 3, to
the <i>PrimaryName</i> parameter.</p>
</li><li><p><span><span> 
</span></span>The server uses the server name passed in the PrimaryName
parameter to look up the domain that the server hosts. If the name is not found,
the server MUST return STATUS_INVALID_COMPUTER_NAME.</p>
</li><li><p><span><span> 
</span></span>Using the <i>ComputerName</i> for the secure channel to find the
corresponding record in the ClientSessionInfo table, verify the <i>Authenticator</i>
parameter (section <a href="da7acaa3-030b-481e-979b-f58f89389806" data-linktype="relative-path">3.1.4.5</a>).
If the <i>Authenticator</i> parameter is valid, compute the <i>ReturnAuthenticator</i>
parameter returned (section 3.1.4.5). Otherwise, the server MUST return
STATUS_ACCESS_DENIED.</p>
</li></ul><p>The server MUST retrieve the current OWF of the password for
the account identified by the <i>AccountName</i> and <i>AccountType</i>
parameters. If the <i>AccountType</i> is TrustedDnsDomainSecureChannel or
TrustedDomainSecureChannel, then the SharedSecret of the trust will be used.
All other types of <b>SecureChannelType</b> that can be used require that the
SharedSecret of the computer account is used.</p><p>The server MUST retrieve the current OWF of the client
password and encrypt it with the key that is derived by using the <a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_4f67a585-fb00-4166-93e8-cf4abca8226d" data-linktype="relative-path">session key</a> as the
specified 16-byte key. The specified 16-byte key uses the 16-byte value
process, as specified in [MS-SAMR] section <a href="../ms-samr/ba437786-7de8-47b4-b269-5a595c255327" data-linktype="relative-path">2.2.11.1.4</a>.
The encrypted version of the password MUST be returned in the <i>EncryptedNtOwfPassword</i>
parameter.</p><p>This method SHOULD only be called by a machine that has
established a secure channel with the server.</p></div>