Microsoft Open Specifications Support Team Blog

Referenced documents: [MS-CFB] : Compound File Binary File Format [MS-OLEPS] : Object Linking and Embedding (OLE) Property Set Data Structures Windows PowerShell Cookbook, 3 rd edition, by Lee Holmes NOTE : Questions and comments are welcome. However...

This blog talks about common timeouts for SMB dialects 2.x and 3.0 [MS-SMB2] in Windows. It also covers continuous availability timeout, witness keep alive [MS-SWN], and some SMB-Direct timers [MS-SMBD]. The behaviors are generally version-specific and...

Extended Protection for Authnetication (EPA) was introduced in Windows 7/WS2008R2 to thwart reflection attacks. This blog describes the changes in the implementation of NTLM Authentication that are needed to successfully authenticate to servers that have...

This blog gives a consolidated overview of the most common SMB timeouts in Windows and their behaviors. Some of these legacy timeouts or timers are optional, implementation specific, not defined or not required by the protocol specifications. Let’s...

Seldom is the question asked, "Is there an RTF directive that can be used to add watermarks in RTF documents? " One day recently this question found me, and after delving into the world of the Rich Text Format ( RTF ) specification you may in turn...

Overview ActiveSync requests and responses are sent as HTTP messages. In order to reduce the size of the messages, the body is encoded in a format known as WAP Binary XML. The information about Microsoft's implementation of this protocol that is used...

Referenced Documents: MS-CFB MS-OLEPS If you need to programmatically determine the office file type for a file and cannot rely on the file extension you can use the following method. These files are based on the MS-CFB specification...

This blog entry is intended for readers interested in generating unencrypted MS-EVEN6 ( http://msdn.microsoft.com/en-us/library/cc231282(v=PROT.13).aspx ) protocol traffic. NOTE: Questions and comments are welcome. However, please DO NOT post a comment...

Encryption is one of the new SMB 3.0 security enhancements in Windows Server 2012 RTM. It can be enabled on a per-share basis, or enforced for all shares on the server. SMB 3.0 uses AES-CCM [RFC5084] as encryption algorithm, and this also provides data...

Hitchhiker’s Guide to Debugging RDP protocols: Part 2 NOTE: Questions and comments are welcome. However, please DO NOT post a comment using the comment tool at the end of this post. Instead, post a new thread in the Open Specifications Forum...

This blog talks about secure dialect negotiation, one of the new SMB3 security enhancements in Windows Server 2012. Secure dialect negotiation is introduced in SMB3 to protect against man-in-the-middle attempt to downgrade dialect negotiation. The...

It is not unusual for our group to receive a question regarding Constrained Delegation and Protocol Transition. Even though the document ( MS-SFU ) does a great job in detailing the specification, not all implementers are familiar with the way in which...

SMB3 will debut in the upcoming version of Windows 8. This is a significant update from the last version (SMB2.1) and a host of new features are being introduced in this release. An important one among them is Encryption. If server and client negotiate...

Hitchhiker’s Guide to Debugging RDP protocols: Part 1 [MS-RDPEUSB] NOTE: Questions and comments are welcome. However, please DO NOT post a comment using the comment tool at the end of this post. Instead, post a new thread in the Open Specifications...

The current version of the MS-PST open specification document can be found here: http://msdn.microsoft.com/en-us/library/ff385210(office.12).aspx Introduction The PST is a structured binary file format that contains messages, folders, and attachments...

Encryption Negotiation in RDP connection The RDP connections between clients and servers are normally encrypted for better security. When we observe the network traffic to troubleshoot the RDP related problems, we may notice that the traffic between...

This article deals with the content contained in ECMA-376 Part 1. The 3rd edition of ECMA-376 was released in June of 2011 and can be downloaded from the following location: http://www.ecma-international.org/publications/standards/Ecma-376.htm Where...

This blog provides details on how the PassStub is used when establishing a remote assistance session of type 1 . It presents the password encryption flow and illustrates with Windows APIs and sample data. Remote assistance overview Remote...

This article will explain how to edit and deploy an “in-box” Netmon parser. By “in-box”, I refer to a parser that was installed with the Netmon package or was downloaded and installed via http://nmparsers.codeplex.com . The...

Alternate Calendars As you may or may not be aware, Outlook supports multiple calendars. Not only does it support multiple calendars, it also supports alternate calendar types. Some languages that enable alternate calendars are Arabic, English, Hebrew...

Yesterday, the Office Interoperability team announced the public release of the Beta version of the Microsoft Office Binary File Format Validator, also known as BFFValidator. You can read the official announcement from the Office Interoperability team...

What is NegoEx ? Why do we need it ? Before Windows 7 was introduced, applications utilize the SPNEGO to provide the ability to negotiate the authentication support between Kerberos SSP and NTLM SSP. SPNEGO itself is also implemented as a Negotiate...

In today’s fast-paced market, availability of an individual is increasingly important. Thus presents the need to be able to schedule an appointment/meeting with a person even if they are not available. Exchange provides such a service by storing...

EMF File Overview Generally, most people are familiar with two types of graphics files: bitmap and vector. Bitmapped graphics present a 1-to-1 pixel representation of an image. This is also known as raster graphics. These types of files cannot...

Hi y’all, Sebastian from Texas here! I’ve been at the File Sharing Plugfest last week. This time around I’ve had the chance to give a presentation on how we use the different sets of tools that we have at hand (both internal and...