s4:kdc: Correctly extract older NT hash

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index fc1400a305a60f72a2037f5abb4b6a0770b1a9b4..744136a545f856e495a7511829ec9524abe2e60c 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -689,7 +689,7 @@ krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
                old_hash = &ntPwdHistory[1];
        }
        if (num_ntPwdHistory > 2) {
-               older_hash = &ntPwdHistory[1];
+               older_hash = &ntPwdHistory[2];
        }
        sc_val = ldb_msg_find_ldb_val(msg, "supplementalCredentials");