Revision Summary Date Revision History Revision Class Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 2.0 Major Updated and revised the technical content. 7/20/2007 3.0 Major Added new content. 8/10/2007 4.0 New content added. 9/28/2007 5.0 Major Updated and revised the technical content. 10/23/2007 5.1 Minor Clarified the meaning of the technical content. 11/30/2007 5.1.1 Editorial Changed language and formatting in the technical content. 1/25/2008 6.0 Major Updated and revised the technical content. 3/14/2008 7.0 Major Updated and revised the technical content. 5/16/2008 8.0 Major Updated and revised the
technical content. 6/20/2008 9.0 Major Updated and revised the technical content. 7/25/2008 9.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 10.0 Major Updated and revised the technical content. 10/24/2008 11.0 Major Updated and revised the technical content. 12/5/2008 12.0 Major Updated and revised the technical content. 1/16/2009 13.0 Major Updated and revised the technical content. 2/27/2009 14.0 Major Updated and revised the technical content. 4/10/2009 15.0 Major Updated and revised the technical content. 5/22/2009 16.0 Major Updated and revised the technical content. 7/2/2009 17.0 Updated and revised the
technical content. 8/14/2009 18.0 Major Updated and revised the technical content. 9/25/2009 19.0 Major Updated and revised the technical content. 11/6/2009 20.0 Major Updated and revised the technical content. 12/18/2009 21.0 Major Updated and revised the technical content. 1/29/2010 22.0 Updated and revised the technical content. 3/12/2010 23.0 Major Updated and revised the technical content. 4/23/2010 23.1 Minor Clarified the meaning of the technical content. 6/4/2010 24.0 Updated and revised the technical content. 7/16/2010 25.0 Major Updated and revised the technical content. 8/27/2010 26.0 Major Updated and revised the technical content.
10/8/2010 27.0 Major Updated and revised the technical content. 11/19/2010 28.0 Major Updated and revised the technical content. 1/7/2011 29.0 Major Updated and revised the technical content. 2/11/2011 30.0 Major Updated and revised the technical content. 3/25/2011 31.0 Updated and revised the technical content. 5/6/2011 32.0 Major Updated and revised the technical content. 6/17/2011 33.0 Major Updated and revised the technical content. 9/23/2011 33.0 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 34.0 Major Updated and revised the technical content. 3/30/2012 35.0 Major Updated and revised the
technical content. 7/12/2012 35.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 36.0 Major Updated and revised the technical content. 1/31/2013 36.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 37.0 Major Updated and revised the technical content. 11/14/2013 37.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 37.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 37.0 None No changes to the meaning, language, or formatting of the
0x40000000 TRUSTED_SET_CONTROLLERS | TRUSTED_SET_POSIX | READ_CONTROL 0x00020014 0x20000000 TRUSTED_QUERY_CONTROLLERS | TRUSTED_QUERY_POSIX | READ_CONTROL 0x0002000A 0x10000000 TRUSTED_QUERY_DOMAIN_NAME | TRUSTED_QUERY_CONTROLLERS | TRUSTED_SET_CONTROLLERS | TRUSTED_QUERY_POSIX | TRUSTED_SET_POSIX | TRUSTED_SET_AUTH | TRUSTED_QUERY_AUTH | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER 0x000F007F ACCESS_MASK for Policy Objects The following apply to policy objects. Value Meaning 0x00000000 No access. POLICY_VIEW_LOCAL_INFORMATION 0x00000001 Access to view local information. POLICY_VIEW_AUDIT_INFORMATION 0x00000002 Access to view information. POLICY_GET_PRIVATE_INFORMATION 0x00000004 Access to view private information. POLICY_TRUST_ADMIN 0x00000008 Access to administer relationships. POLICY_CREATE_ACCOUNT 0x00000010 Access to create . POLICY_CREATE_SECRET 0x00000020 Access to create . POLICY_CREATE_PRIVILEGE 0x00000040 Access to create .
Note New privilege creation is not currently a part of the protocol, so this flag is not actively used. POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080 Access to set default quota limits. Note limits are not currently a part of the protocol, so this flag is not actively used. POLICY_SET_AUDIT_REQUIREMENTS 0x00000100 Access to set audit requirements. POLICY_AUDIT_LOG_ADMIN 0x00000200 Access to administer the log. POLICY_SERVER_ADMIN 0x00000400 Access to administer policy on the server. POLICY_LOOKUP_NAMES 0x00000800 Access to translate and . POLICY_NOTIFICATION 0x00001000 Access to be notified of policy changes.<9> ACCESS_MASK for Account Objects The following flags apply to . Meaning ACCOUNT_VIEW 0x00000001 View account information. ACCOUNT_ADJUST_PRIVILEGES 0x00000002 Change on an account. ACCOUNT_ADJUST_QUOTAS 0x00000004 Change quotas on an account.
ACCOUNT_ADJUST_SYSTEM_ACCESS 0x00000008 Change system access. ACCESS_MASK for Secret Objects The following flags apply to . Value Meaning SECRET_SET_VALUE 0x00000001 Set secret value. SECRET_QUERY_VALUE 0x00000002 Query secret value. ACCESS_MASK for Trusted Domain Objects The following flags apply to .<10> Value Meaning TRUSTED_QUERY_DOMAIN_NAME 0x00000001 View information. TRUSTED_QUERY_CONTROLLERS 0x00000002 View "Domain Controllers" information. TRUSTED_SET_CONTROLLERS 0x00000004 Change "Domain Controllers" information. TRUSTED_QUERY_POSIX 0x00000008 View information. TRUSTED_SET_POSIX 0x00000010 Change information. TRUSTED_SET_AUTH 0x00000020 Change authentication information. TRUSTED_QUERY_AUTH 0x00000040 View authentication information.
Note This set of flags is reserved; for current and future reasons, the trust is disabled. ForestTrustType: This value is one of . Time: The date and time when this entry was created. It is a 64-bit value that represents the number of 100-nanosecond intervals since January 1, 1601, . ForestTrustData: An or structure, depending on the value ForestTrustType as specified in the structure definition for LSA_FOREST_TRUST_RECORD. LSA_FOREST_TRUST_RECORD_TYPE The LSA_FOREST_TRUST_RECORD_TYPE enumeration specifies a type of record. typedef enum _LSA_FOREST_TRUST_RECORD_TYPE { ForestTrustTopLevelName = 0, ForestTrustTopLevelNameEx = 1, ForestTrustDomainInfo = 2 } LSA_FOREST_TRUST_RECORD_TYPE; ForestTrustTopLevelName: The of the . The structure used for this record type is equivalent to . ForestTrustTopLevelNameEx: The DNS name of the trusted forest. This is the same as ForestTrustTopLevelName. The structure used for this record type is equivalent to LSA_UNICODE_STRING. ForestTrustDomainInfo: This field specifies a record containing identification and name information. LSA_FOREST_TRUST_BINARY_DATA The LSA_FOREST_TRUST_BINARY_DATA structure is used to communicate a record. This structure is not used in the current version of the protocol. typedef struct _LSA_FOREST_TRUST_BINARY_DATA { unsigned long Length; [size_is(Length)] unsigned char* Buffer; } LSA_FOREST_TRUST_BINARY_DATA, *PLSA_FOREST_TRUST_BINARY_DATA; Length: The count of bytes in Buffer.<32> Buffer: The record. If the Length has a value other than 0, this field MUST NOT be NULL. LSA_FOREST_TRUST_DOMAIN_INFO The LSA_FOREST_TRUST_DOMAIN_INFO structure is used to communicate a record corresponding to the LSA_FOREST_TRUST_DOMAIN_INFO value of ForestTrustDomainInfo. typedef struct _LSA_FOREST_TRUST_DOMAIN_INFO { PRPC_SID Sid; LSA_UNICODE_STRING DnsName; LSA_UNICODE_STRING NetbiosName;
section 6.1.6.7.8) Trust Type section 6.1.6.7.15) unsigned int (as specified in section TrustType) trustType ([MS-ADA3] section 2.327) Trust Direction section 6.1.6.7.12) unsigned int (as specified in section 2.2.7.9 TrustDirection) trustDirection ([MS-ADA3] section 2.323) Trust Attributes section 6.1.6.7.9) unsigned int (as specified in section 2.2.7.9 TrustAttributes) trustAttributes section 2.320) Posix Offset section 6.1.6.7.14) trustPosixOffset section 2.326) Incoming Passwords section 6.1.6.7.10) of trustAuthIncoming section 2.321) Outgoing Passwords section 6.1.6.7.11) Array of LSAPR_AUTH_INFORMATION trustAuthOutgoing section 2.322) Supported Encryption Types section 6.1.6.7.3) ([MS-ADA2] section 2.464) Forest Trust Information section 6.1.6.7.4) ([MS-ADA2] section 2.479)
LsarOpenAccount (opnum 17) Opens a handle to an existing account object. LsarEnumeratePrivilegesAccount (opnum 18) Enumerates all rights and of an account. LsarAddPrivilegesToAccount (opnum 19) Adds new privileges to an existing account object. LsarRemovePrivilegesFromAccount 20) Removes privileges from an existing account object. LsarGetSystemAccessAccount (opnum 23) Retrieves system access flags from the account object. LsarSetSystemAccessAccount (opnum 24) Sets system access flags on the account object. LsarEnumerateAccountsWithUserRight (opnum 35) Enumerates all account objects in the server's policy database that match a given user right. LsarEnumerateAccountRights (opnum 36) Enumerates all rights of an account object in the server's policy database. LsarAddAccountRights (opnum 37) Adds new rights to an account object in the server's
policy database. LsarRemoveAccountRights (opnum 38) Removes rights from an account object in the server's policy database. LsarCreateAccount 10) The LsarCreateAccount method is invoked to create a new in the server's database. NTSTATUS LsarCreateAccount( [in] LSAPR_HANDLE PolicyHandle, [in] PRPC_SID AccountSid, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* AccountHandle ); PolicyHandle: An context handle obtained from either or . AccountSid: The of the account to be created. DesiredAccess: A bitmask specifying accesses to be granted to the newly created and opened account at this time. AccountHandle: Used to return a handle to the newly created account object. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC0000035 STATUS_OBJECT_NAME_COLLISION An account with this SID already exists. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC000000D STATUS_INVALID_PARAMETER Some of the parameters supplied were invalid. Processing: This message takes four arguments:
DesiredAccess: An access mask specifying desired access to the TDO handle. TrustedDomainHandle: Used to return the handle for the newly created TDO. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<85> 0xC00000DD STATUS_INVALID_DOMAIN_STATE The operation cannot complete in the current state of the . 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The was not available on the server. 0xC0000078 STATUS_INVALID_SID The of the is not valid. 0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED cannot be established with the current domain. 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of the supplied information. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle.
0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED cannot be established with the current domain. 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of the supplied information. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC0000401 STATUS_PER_USER_TRUST_QUOTA_EXCEEDED The caller's for the maximum number of TDOs that can be created by control access right is exceeded. 0xC0000402 STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED The combined users' quota for the maximum number of TDOs that can be created by control access right is exceeded. Processing: This message MUST be processed in an identical manner to , with the following exceptions. AuthenticationInformation is a structure containing authentication information for the trusted domain. The authentication information is not encrypted, which makes this an insecure message to call. As a result, callers SHOULD NOT invoke this message and SHOULD instead call LsarCreateTrustedDomainEx2. LsarCreateTrustedDomain (Opnum 12) The LsarCreateTrustedDomain method is invoked to create an object of type in the server's database. NTSTATUS LsarCreateTrustedDomain(
[in] LSAPR_HANDLE PolicyHandle, [in] PLSAPR_TRUST_INFORMATION TrustedDomainInformation, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* TrustedDomainHandle ); PolicyHandle: An context handle obtained from either or . TrustedDomainInformation: Information the new to be created. DesiredAccess: An access mask that specifies the desired access to the TDO handle. TrustedDomainHandle: Used to return the handle for the newly created TDO. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<89> 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The was not available on the server. 0xC0000078 STATUS_INVALID_SID The of the trusted domain is not valid. 0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED cannot be established with the current . 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of
The rules for domain information entries are as follows: The of this must not be equal to that of an enabled domain information entry belonging to a different forest or any of the domains that comprise the current forest. The NetBIOS name of this must not be claimed by any other forest with which this forest has a relationship or by any domain within the current forest. The DNS name of this entry must not be claimed by any other forest with which this forest has a trust relationship or by the current forest. If any of rules are violated, a domain information entry is considered to be in conflict. In this case, a collision record is generated with the following values: Index: Ordinal number of a forest trust record supplied by the caller that generated the collision. Type: CollisionTdo or CollisionXref, depending on whether the collision was caused by an or internal-to-forest domain. Flags: LSA_SID_DISABLED_CONFLICT if the collision was caused by a security identifier component of the record. LSA_NB_DISABLED_CONFLICT if the collision was caused by a NetBIOS name component of the record. Entries that have been disabled by administrative action or through conflict are not considered in computing consistency checks. Privilege Methods The message processing of methods in this section MUST use the abstract data model specified in section . Method (opnum) Summary LsarEnumeratePrivileges (opnum 2) Enumerates all known to the server. LsarLookupPrivilegeValue (opnum 31) Maps the well-known name of a privilege into the . LsarLookupPrivilegeName (opnum 32) Maps the LUID of a privilege into a privilege name. LsarLookupPrivilegeDisplayName 33) Maps the well-known name of a privilege into a
Message 4: Failure: Secret name "NL$" is a reserved prefix name and cannot be used. Direction and method Parameter field Parameter Receive LsarCreateSecret Status STATUS_INVALID_PARAMETER Receive LsarCreateSecret SecretHandle NULL Message 5: Attempt to create a secret object with name "MyBigSecret". Direction and method Parameter field Parameter value Send LsarCreateSecret PolicyHandle [Implementation-specific returned in Step 2.] Send LsarCreateSecret Secretname "MyBigSecret" Send LsarCreateSecret DesiredAccess SECRET_SET_VALUE Message 6: Success: Secret created. Direction and method Parameter field Parameter Receive LsarCreateSecret Status STATUS_SUCCESS Receive LsarCreateSecret SecretHandle [Implementation-specific value] Message 7: Set the value of the secret object. Direction and method Parameter Parameter Send LsarSetSecret SecretHandle [Implementation-specific returned in Step 6.] Send LsarSetSecret EncryptedCurrentValue Byte BLOB value encrypted with session key. Send LsarSetSecret EncryptedOldValue NULL Message 8: Success: Secret value set. Direction and method Parameter field Parameter Receive LsarSetSecret Status STATUS_SUCCESS Message 9: Done with this secret; close the handle.
Name Product SE_ASSIGNPRIMARYTOKEN_NAME "SeAssignPrimaryTokenPrivilege" Windows NT 3.1 SE_AUDIT_NAME "SeAuditPrivilege" Windows NT 3.1 SE_BACKUP_NAME "SeBackupPrivilege" Windows NT 3.1 SE_CHANGE_NOTIFY_NAME "SeChangeNotifyPrivilege" Windows NT 3.1 SE_CREATE_GLOBAL_NAME "SeCreateGlobalPrivilege" Windows 2000 SP4, Windows XP operating system Service Pack 2 (SP2), and Windows Server 2003 SE_CREATE_PAGEFILE_NAME "SeCreatePagefilePrivilege" Windows NT 3.1 SE_CREATE_PERMANENT_NAME "SeCreatePermanentPrivilege" Windows NT 3.1 SE_CREATE_TOKEN_NAME "SeCreateTokenPrivilege" Windows NT 3.1 SE_DEBUG_NAME "SeDebugPrivilege" Windows NT 3.1 SE_ENABLE_DELEGATION_NAME "SeEnableDelegationPrivilege" Windows 2000 SE_IMPERSONATE_NAME "SeImpersonatePrivilege" Windows 2000 SP4, Windows XP SP2, and Windows Server 2003 SE_INC_BASE_PRIORITY_NAME "SeIncreaseBasePriorityPrivilege" Windows NT 3.1 SE_INCREASE_QUOTA_NAME "SeIncreaseQuotaPrivilege" Windows NT 3.1
SE_LOAD_DRIVER_NAME "SeLoadDriverPrivilege" Windows NT 3.1 SE_LOCK_MEMORY_NAME "SeLockMemoryPrivilege" Windows NT 3.1 SE_MACHINE_ACCOUNT_NAME "SeMachineAccountPrivilege" Windows NT 3.5 SE_MANAGE_VOLUME_NAME "SeManageVolumePrivilege" Windows 2000 SP4 and Windows XP SE_PROF_SINGLE_PROCESS_NAME "SeProfileSingleProcessPrivilege" Windows NT 3.1 SE_REMOTE_SHUTDOWN_NAME "SeRemoteShutdownPrivilege" Windows NT 3.1 SE_RESTORE_NAME "SeRestorePrivilege" Windows NT 3.1 SE_SECURITY_NAME "SeSecurityPrivilege" Windows NT 3.1 SE_SHUTDOWN_NAME "SeShutdownPrivilege" Windows NT 3.1 SE_SYNC_AGENT_NAME "SeSyncAgentPrivilege" Windows 2000 SE_SYSTEM_ENVIRONMENT_NAME "SeSystemEnvironment" Windows NT 3.1 SE_SYSTEM_PROFILE_NAME "SeSystemProfilePrivilege" Windows NT 3.1 SE_SYSTEMTIME_NAME "SeSystemtimePrivilege" Windows NT 3.1 SE_TAKE_OWNERSHIP_NAME "SeTakeOwnershipPrivilege" Windows NT 3.1 SE_TCB_NAME "SeTcbPrivilege" Windows NT 3.1 SE_UNDOCK_NAME "SeUndockPrivilege" Windows NT 3.1 SE_CREATE_SYMBOLIC_LINK_NAME "SeCreateSymbolicLinkPrivilege" Windows Vista and Windows Server 2008
2.2.7.9 LSAPR_TRUSTED_DOMAIN_INFORMATION_EX In the product behavior note for TrustAttributes flags, added Windows XP, Windows 8, and Windows 10 to the product version information about the TAFT, TANC, and TAPT flags, respectively. Trusted Domain Object Data Model In the product behavior note for information values, Windows XP to the product version information for Forest Trust Information. Minor Appendix B: Product Behavior Added information about which products implement which protocol roles. Major
Index A 67 67 Access 84 84 84 98 Account objects 73 161 98 69 21 C 22 216 88 88 23 151 151 D 67 67 23 23 156 156 173 175 66 E 66 173 Events 160 160 161 161 164 167 161 169 F 22 178 G 8 H Handles 88 84 I 178 173 173 177 14 79 79 8 L Local events 160 160 160 63 65 64 64 63 64 61 63 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56 57 52 54 51
61 61 52 47 109 104 155 99 112 136 134 132 154 125 108 100 107 147 103 129 128 105 150 149 148 102 89 88 113 120 131 96 142 92 90 137 116 151 121 126 110 105 118 97 143 95 93 139 115 153 106 122 127 117 M 161 164 167 79 79 Messages 23 23 23 Methods 84 98 98 88 151 151 156 84 88 88 146 146 111 111 119 119 N 13 O 84 84 14 P 177 177 63 65 64 63 64 61 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56