3.2.4.2.2 Netlogon Processes Reply

Every hop in the Netlogon chain performs steps on the reply message depending on where it is in the chain. As with the KDC, it will report status codes for failures but it will use the NetlogonStatus field (see section 2.2.1.4.20) instead. On failure, it MUST fill in the domain controller name in the SourceOfStatus field in the NETLOGON_VALIDATION_TICKET_LOGON.