Microsoft Technology Licensing, LLC

Nathan Daniel Muggli

William Birkin Lees

William S Jack

Colin Harrison Brace

Gregory C Johnson

William James Whalen

Daniel Wade Hitchcock

Billy J Fuller

Dmitri Gavrilov

Xin He

Lee Walker

Weiqing Tu

Levon A Esibov

Siddharth Bhai

Jeffrey J Westhead

Collin H Brace

Brian W Puhl

Sanjeev Balarajan

A domain controller hierarchy in accordance with implementations of the present invention involves one or more local domain controllers, such as one or more read-only local domain controllers in communication with one or more writable hub domain controllers. The local domain controllers include a resource manager, such as a Security Account Manager ('SAM'), that manages resources and/or other accounts information received from the writable hub domain controller. When a local user attempts to change the resource at the local domain controller, however, the resource manager chains the request, along with any appropriate identifiers for the request, to the writable hub domain controller, where the request is processed. If appropriate, the hub domain controller sends a response that the resource has been updated as requested and also sends a copy of the updated resource to be cached at the local domain controller.

Transparent resource administration using a read-only domain controller

A domain controller hierarchy includes one or more hub domain controllers in communication with one or more local domain controllers, such as local domain controllers at a branch office. The hub domain controller(s) is writable, while the local domain controller(s) is typically read-only. Non-secure and secure information is partitioned to specific local domain controllers at the one or more hub domain controllers. The non-secure and secure information is then passed from the hub domain controller only to the local domain controller associated with the given partition at the hub domain controller on request. For example, a user requests a logon at a client computer system at a local branch office, and the logon is passed from the local domain controller to the hub domain controller. If authenticated, the user logon account is passed to the local domain controller, where it can be cached to authenticate subsequent requests.

Replicating selected secrets to local domain controllers

Accessing a data set with secret and non-secret data. A method includes accessing a data set image. The data set image comprises secret data. The data set image is derived from an authorized data set associated with a master key that authorizes access to the secret data. The master key is not provided with the data set image. The method further comprises restoring the data set image to a computing system to create a degraded data set. Data in the degraded data set other than the secret data is accessed without restoring the master key.

Secure seed media

A server may bridge between a wide area network, such as the Internet, and a local area network and may process authentication requests from clients on the wide area network. The server may filter the requests to enable specific types of requests to pass, and may forward the requests to a credential server within the local area network and pass any responses back to the client. The server may be configured with some or all of a set of domain services objects, but such objects may be stored in a read only format. The server may further contain a minimum of or no sensitive data such that, if compromised, an attacker may gain little advantage. The client may request evidence of authentication available to devices within the local area network and may use the evidence of authentication to access services made available to the wide area network.

Secure key distribution to internet clients

Securing data set images

A data store is distributed between a server and a client. The distributed data store includes global data. A transformation is applied to the global data to generate client-specific data based on the global data. The client-specific data is stored on the client which uses the client-specific data to perform tasks relating to the client-specific data.

Client-specific transformation of distributed data

A domain controller hierarchy in accordance with implementations of the present invention involves one or more local domain controllers, such as one or more read-only local domain controllers in communication with one or more writable hub domain controllers. The local domain controllers includes a resource manager, such as a Security Account Manager ('SAM'), that manages resources and/or other accounts information received from the writable hub domain controller. When a local user attempts to change the resource at the local domain controller, however, the resource manager chains the request, along with any appropriate identifiers for the request, to the writable hub domain controller, where the request is processed. If appropriate, the hub domain controller sends a response that the resource has been updated as requested and also sends a copy of the updated resource to be cached at the local domain controller.

Registering a client with a distributed service. A method may be practiced, for example, in a network computing environment including a client at a local site and a number of distributed services at a number of remote sites. The method includes pinging one or more distributed services at one or more remote sites. A message is received from a distributed service from among the one or more distributed services. The message specifies an optimal remote site. The method further includes registering with a distributed service at the optimal remote site.

Next site for distributed service connections

Maintaining DNS records. A computing network system includes a local Domain Name Service (DNS) server connected to one or more local clients or resources at a local branch office in an enterprise network. The local DNS server advertises to the local clients or resources at the local branch office that the DNS server is authoritative. The DNS server receives record information for the local clients or resources. An attempt is made to forward the record information to an enterprise hub DNS server. The record information is stored persistently in a cache. Storing the record information persistently in cache may be performed selectively or non-selectively. When performed selectively, the record information is stored or not stored depending on some result or other action. For example, the result may be stored or not stored depending on the results of attempting to forward to an enterprise hub DNS server.

Growing community of inventors

Redmond, WA, United States of America

Nathan Daniel Muggli