0x29 SID_LOGONRESPONSE

ProtocolBNCS
DirectionsClient → Server and Server → Client
Used bySSHRJSTRDRTLDSHRW2BN

Logs on to an account in the older logon. Same proof as SID_LOGONRESPONSE2, but a simpler reply.

Client → Server

TypeFieldNotesConfidence
UINT32 Client token Chosen by the client. Verified
UINT32 Server token From SID_LOGONCHALLENGE or SID_LOGONCHALLENGEEX. Verified
VOID Password proof (20 bytes) X-SHA-1 of: client token, server token, then X-SHA-1 of the lowercase password. Verified
STRING Account name Verified

Server → Client

TypeFieldNotesConfidence
UINT32 Result Verified

Results

ValueMeaningConfidence
0x00Logon failed. The reply doesn't say whether the account is missing or the password is wrong. Verified
0x01Logged on. Verified

Remarks

The success value is reversed. In this message 0x01 means success. In SID_LOGONRESPONSE2, 0x00 does.

Which server token. If a server never sends a logon challenge, older clients use 0 as the server token, and the proof must be checked with 0.

Appears in

Sources and credits

This page is written in our own words. BNETDocs is credited for its research; none of its text is copied. See Credits.

Last edited September 16, 2026 by John Leighow.
Edit on GitHub | Page history