The bouncer stamps the ticket "ACCEPT-INCOMPLETE" and hands back a sealed envelope marked with a lock icon. A caption reads: "The server responds with the (hopefully) successful negotiation... this is not yet complete, but things are proceeding as planned."
The bouncer unclips the velvet rope and waves the client through with a thumbs-up. A caption reads: "What follows is the completion of the authentication and encapsulation phase, called an ALTER_CONTEXT operation. If all goes well, the authentication is accepted."
A fast montage strip shows a locked briefcase stamped "214 Bytes — ENCRYPTED" passing back and forth between the two domain-controller icons, each pass labeled in plain English: "Bind," "Sync a Replica," "Get the Changes," "Look Up a Name." Captions read: "Netmon is politely translating all of these RPC functions... into semi-intelligible words, like DRSBind, DRSReplicaSync, and DRSGetNCChanges." and "You have a decent idea what it is doing... even if your network parsers are terrible."