Revision Summary Date Revision History Revision Class Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 2.0 Major Updated and revised the technical content. 7/20/2007 3.0 Added new content. 8/10/2007 4.0 Major New content added. 9/28/2007 5.0 Updated and revised the technical content. 10/23/2007 5.1 Minor Clarified the meaning of the technical content. 11/30/2007 5.1.1 Editorial Changed language and formatting in the technical content. 1/25/2008 6.0 Major Updated and revised the technical content. 3/14/2008 7.0 Major Updated and revised the technical content. 5/16/2008 8.0 Major Updated and revised the
technical content. 6/20/2008 9.0 Updated and revised the technical content. 7/25/2008 9.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 10.0 Major Updated and revised the technical content. 10/24/2008 11.0 Updated and revised the technical content. 12/5/2008 12.0 Major Updated and revised the technical content. 1/16/2009 13.0 Major Updated and revised the technical content. 2/27/2009 14.0 Major Updated and revised the technical content. 4/10/2009 15.0 Major Updated and revised the technical content. 5/22/2009 16.0 Major Updated and revised the technical content. 7/2/2009 17.0 Major Updated and revised the
technical content. 8/14/2009 18.0 Major Updated and revised the technical content. 9/25/2009 19.0 Major Updated and revised the technical content. 11/6/2009 20.0 Updated and revised the technical content. 12/18/2009 21.0 Major Updated and revised the technical content. 1/29/2010 22.0 Major Updated and revised the technical content. 3/12/2010 23.0 Updated and revised the technical content. 4/23/2010 23.1 Clarified the meaning of the technical content. 6/4/2010 24.0 Major Updated and revised the technical content. 7/16/2010 25.0 Major Updated and revised the technical content. 8/27/2010 26.0 Major Updated and revised the technical content.
10/8/2010 27.0 Major Updated and revised the technical content. 11/19/2010 28.0 Major Updated and revised the technical content. 1/7/2011 29.0 Major Updated and revised the technical content. 2/11/2011 30.0 Major Updated and revised the technical content. 3/25/2011 31.0 Major Updated and revised the technical content. 5/6/2011 32.0 Major Updated and revised the technical content. 6/17/2011 33.0 Major Updated and revised the technical content. 9/23/2011 33.0 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 34.0 Major Updated and revised the technical content. 3/30/2012 35.0 Updated and revised the
technical content. 7/12/2012 35.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 36.0 Major Updated and revised the technical content. 1/31/2013 36.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 37.0 Updated and revised the technical content. 11/14/2013 37.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 37.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 37.0 None No changes to the meaning, language, or formatting of the
0x40000000 TRUSTED_SET_CONTROLLERS | TRUSTED_SET_POSIX | READ_CONTROL 0x00020014 0x20000000 TRUSTED_QUERY_CONTROLLERS | TRUSTED_QUERY_POSIX | READ_CONTROL 0x0002000A 0x10000000 TRUSTED_QUERY_DOMAIN_NAME | TRUSTED_QUERY_CONTROLLERS | TRUSTED_SET_CONTROLLERS | TRUSTED_QUERY_POSIX | TRUSTED_SET_POSIX | TRUSTED_SET_AUTH | TRUSTED_QUERY_AUTH | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER 0x000F007F ACCESS_MASK for Policy Objects The following flags apply to policy objects. Meaning 0x00000000 No access. POLICY_VIEW_LOCAL_INFORMATION 0x00000001 Access to view local information. POLICY_VIEW_AUDIT_INFORMATION 0x00000002 Access to view audit information. POLICY_GET_PRIVATE_INFORMATION 0x00000004 Access to view private information. POLICY_TRUST_ADMIN 0x00000008 Access to administer trust relationships. POLICY_CREATE_ACCOUNT 0x00000010 Access to create account objects. POLICY_CREATE_SECRET 0x00000020 Access to create secret objects.
0x00000002 ACCOUNT_ADJUST_QUOTAS 0x00000004 Change quotas on an account. ACCOUNT_ADJUST_SYSTEM_ACCESS 0x00000008 Change system access. ACCESS_MASK for Secret Objects The following flags apply to secret objects. Meaning SECRET_SET_VALUE 0x00000001 Set secret value. SECRET_QUERY_VALUE 0x00000002 secret value. ACCESS_MASK for Trusted Domain Objects The following flags apply to trusted domain objects.<10> Value Meaning TRUSTED_QUERY_DOMAIN_NAME 0x00000001 View information. TRUSTED_QUERY_CONTROLLERS 0x00000002 View "Domain Controllers" information. TRUSTED_SET_CONTROLLERS 0x00000004 Change "Domain Controllers" information. TRUSTED_QUERY_POSIX 0x00000008 View information. TRUSTED_SET_POSIX 0x00000010 Change POSIX information. TRUSTED_SET_AUTH 0x00000020 Change authentication information. TRUSTED_QUERY_AUTH 0x00000040 View authentication information.
Active Directory. 0x00000002 Trust with a Windows domain that is running Active Directory. 0x00000003 Trust with a Kerberos distribution, as specified in . 0x00000004 Trust with a distributed computing environment (DCE) realm. This is a historical reference and is not used. Note Other values SHOULD NOT be set. Maps to the Trust Type field, as specified in section 3.1.1.5. TrustAttributes: This field contains bitmapped values that define the attributes of the trust.<27> 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 R R R R R R R R O O R R R R R R R R R R R T A P T T A N C R T A R C T A T E T A W F T A C O T A F T T A Q D T A U O T A N T TrustAttribute values are described in section 3.1.1.5. The following table shows how these values map to the Trust Attributes field in section 3.1.1.5. Value Mapping TANT (TRUST_ATTRIBUTE_NON_TRANSITIVE) Trust Attributes: TAUO (TRUST_ATTRIBUTE_UPLEVEL_ONLY) Trust Attributes: Uplevel only TAQD (TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) Trust Attributes: Quarantined TAFT (TRUST_ATTRIBUTE_FOREST_TRANSITIVE) Trust Attributes: Forest trust compliant
to be trusted for delegation. SE_IMPERSONATE_NAME "SeImpersonatePrivilege" {0,29} Impersonate a client after authentication. SE_INC_BASE_PRIORITY_NAME "SeIncreaseBasePriorityPrivilege" {0,14} Increase scheduling priority. SE_INCREASE_QUOTA_NAME "SeIncreaseQuotaPrivilege" {0,5} Adjust memory quotas for a process. SE_LOAD_DRIVER_NAME "SeLoadDriverPrivilege" {0,10} Load and unload device drivers. SE_LOCK_MEMORY_NAME "SeLockMemoryPrivilege" {0,4} Lock pages in memory. SE_MACHINE_ACCOUNT_NAME "SeMachineAccountPrivilege" {0,6} Add workstations to domain. SE_MANAGE_VOLUME_NAME "SeManageVolumePrivilege" {0,28} Manage the files on a volume. SE_PROF_SINGLE_PROCESS_NAME "SeProfileSingleProcessPrivilege" {0,13} Profile single process. SE_REMOTE_SHUTDOWN_NAME "SeRemoteShutdownPrivilege" {0,24} shutdown from a remote system. SE_RESTORE_NAME "SeRestorePrivilege" {0,18} Restore files and directories. SE_SECURITY_NAME "SeSecurityPrivilege" {0,8} Manage auditing and security log. SE_SHUTDOWN_NAME "SeShutdownPrivilege" {0,19} Shut down the system. SE_SYNC_AGENT_NAME "SeSyncAgentPrivilege" {0,26} Synchronize data. SE_SYSTEM_ENVIRONMENT_NAME "SeSystemEnvironment" {0,22} Modify firmware environment values. SE_SYSTEM_PROFILE_NAME "SeSystemProfilePrivilege" {0,11} Profile system performance.
The Type column lists the data type for its corresponding abstract data field. The Attribute Name column lists the ldapDisplayName and a link to the appropriate section in , , or for the corresponding abstract data field stored in Active Directory. Name Type Attribute name Name section 6.1.6.7.13) RPC_UNICODE_STRING trustPartner ([MS-ADA3] section 2.325) Flat Name section 6.1.6.7.1) RPC_UNICODE_STRING flatName ([MS-ADA1] section 2.232) Security Identifier section 6.1.6.7.8) RPC_SID securityIdentifier section 2.237) Trust Type section 6.1.6.7.15) unsigned int (as specified in section TrustType) trustType ([MS-ADA3] section 2.327) Trust Direction section 6.1.6.7.12) unsigned int (as specified in section 2.2.7.9 TrustDirection) trustDirection ([MS-ADA3] section 2.323) Trust Attributes section 6.1.6.7.9) unsigned int (as specified in section 2.2.7.9 TrustAttributes) trustAttributes section 2.320) Posix Offset section 6.1.6.7.14) trustPosixOffset section 2.326) Trust Incoming Passwords section 6.1.6.7.10) Array of trustAuthIncoming section 2.321) Outgoing Passwords Array of LSAPR_AUTH_INFORMATION trustAuthOutgoing section 2.322)
Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC000009A STATUS_INSUFFICIENT_RESOURCES There are insufficient resources to complete the request. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform the operation. 0xC000000D STATUS_INVALID_PARAMETER One of the parameters is incorrect. For instance, this can happen if InformationClass is out of or if PolicyInformation is NULL. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. Processing: PolicyHandle MUST be a handle to an open policy object, and PolicyHandle.HandleType MUST equal "Policy"; otherwise, STATUS_INVALID_HANDLE MUST be returned. The server MUST verify that PolicyHandle grants access as specified in section . The following table specifies the RequiredAccess value to use in this access check for each InformationClass value or indicates if no processing is supported, regardless of access granted. InformationClass RequiredAccess value PolicyAuditLogInformation POLICY_VIEW_AUDIT_INFORMATION PolicyAuditEventsInformation POLICY_VIEW_AUDIT_INFORMATION PolicyPrimaryDomainInformation POLICY_VIEW_LOCAL_INFORMATION PolicyPdAccountInformation POLICY_GET_PRIVATE_INFORMATION PolicyAccountDomainInformation POLICY_VIEW_LOCAL_INFORMATION PolicyLsaServerRoleInformation POLICY_VIEW_LOCAL_INFORMATION PolicyReplicaSourceInformation POLICY_VIEW_LOCAL_INFORMATION PolicyModificationInformation Not applicable: This information class cannot be queried. The request MUST
NULL Non-NULL Old of "new secret time" Current server time Non-NULL NULL Current server time Current server time Non-NULL Non-NULL Current server time Current server time LsarQuerySecret (Opnum 30) The LsarQuerySecret method is invoked to retrieve the current and old (or previous) of the secret object. NTSTATUS LsarQuerySecret( [in] LSAPR_HANDLE SecretHandle, [in, out, unique] PLSAPR_CR_CIPHER_VALUE* EncryptedCurrentValue, [in, out, unique] PLARGE_INTEGER CurrentValueSetTime, [in, out, unique] PLSAPR_CR_CIPHER_VALUE* EncryptedOldValue, [in, out, unique] PLARGE_INTEGER OldValueSetTime ); SecretHandle: An open secret object handle. EncryptedCurrentValue: Used to return the encrypted current value of the secret object. CurrentValueSetTime: Used to return the time when the current value was set. EncryptedOldValue: A BLOB representing the encrypted old value. It is valid for this parameter to be NULL, in which case the current value in the policy database is copied. OldValueSetTime: The time corresponding to the instant that the old value was last changed. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC0000008 STATUS_INVALID_HANDLE SecretHandle is not a handle. Processing: This message takes five arguments: SecretHandle: An open handle to a secret object. If the handle is not a valid context handle to a secret object or SecretHandle.HandleType does not equal "Secret", the server MUST return STATUS_INVALID_HANDLE. The server MUST verify that SecretHandle grants access as specified in section with RequiredAccess set to SECRET_QUERY_VALUE.<74>
0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The Active Directory service was not available on the server. 0xC0000078 STATUS_INVALID_SID The security identifier of the trusted domain is not valid. 0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED Trust cannot be established with the current domain. 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of the supplied information. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC0000401 STATUS_PER_USER_TRUST_QUOTA_EXCEEDED The caller's quota for maximum number of TDOs that can be created by control access right is exceeded. 0xC0000402 STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED The combined quota for maximum number of TDOs that can be created by control access right is exceeded. Processing:
successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<88> 0xC00000DD STATUS_INVALID_DOMAIN_STATE The operation cannot complete in the current state of the domain. 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The Active Directory service was not available on the server. 0xC0000078 STATUS_INVALID_SID The security identifier of the trusted domain is not valid. 0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED Trust cannot be established with the current domain. 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of the supplied information. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC0000401 The caller's quota for the
0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<89> 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The Active Directory service was not available on the server. 0xC0000078 STATUS_INVALID_SID The security identifier of the trusted domain is not valid. 0xC00002E9 STATUS_CURRENT_DOMAIN_NOT_ALLOWED cannot be established with the current domain. 0xC0000035 STATUS_OBJECT_NAME_COLLISION Another TDO already exists that matches some of the identifying information of the supplied information. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC0000401 STATUS_PER_USER_TRUST_QUOTA_EXCEEDED The caller's quota for the maximum number of TDOs that can be created by
CALL des_ecb_lm_enc(input->buffer, sessionkey[keyindex], output->buffer) INCREMENT input->buffer by blocklen INCREMENT output->buffer by blocklen INCREMENT output->length by blocklen SET keyindex to AdvanceKey(keyindex) DECREMENT remaining by blocklen ENDWHILE IF (remaining > 0) THEN // zero pad the last block. SET bytes in buffer to 0 COPY remaining from input->buffer to buffer CALL des_ecb_lm_enc(buffer, sessionkey[keyindex], output->buffer) INCREMENT output->length by blocklen ENDIF } decrypt_secret(input : LSA_UNICODE_STRING, sessionkey : byte[16], output : LSA_UNICODE_STRING) { LET keyindex be 0 LET blocklen be 8 // Check version, get clear length. CALL des_ecb_lm_dec(input->buffer, sessionkey[keyindex], output->buffer) LET outputlength be output[0] LET version be output[1] IF (version ≠ 1) THEN // version FAIL ENDIF INCREMENT input->buffer by blocklen SET keyindex to AdvanceKey(keyindex) LET remaining be outputlength WHILE remaining > blocklen CALL des_ecb_lm_dec(input->buffer, sessionkey[keyindex], output->buffer) INCREMENT input->buffer by blocklen INCREMENT output->buffer by blocklen SET keyindex to AdvanceKey(keyindex) DECREMENT remaining by blocklen ENDWHILE IF (remaining > 0) THEN CALL des_ecb_lm_dec(input->buffer, sessionkey[keyindex], output->buffer) ENDIF SET output->length to outputlength } AdvanceKey(pos : ULONG)
Input af 78 44 03 fb a0 92 27 8c 95 fc 7e 88 56 4c cd 7c d0 c2 41 da 6f 14 41 56 26 cd a5 81 e9 22 3d sessionkey 4e 98 c9 10 b2 a9 88 d7 92 fb 5a a3 3e 8e f7 86 The following table describes the values keyindex (defined in decrypt_secret) and input, InputKey, OutputKey, and output (defined in des_ecb_lm) after successive calls to des_ecb_lm_dec. keyindex input InputKey OutputKey output 0 af 78 44 03 fb a0 92 27 4e 98 c9 10 b2 a9 88 4f 4c 32 23 0b 94 a7 10 16 00 00 00 01 00 00 00 7 8c 95 fc 7e 88 56 4c cd d7 92 fb 5a a3 3e 8e d6 c8 bf 6b ab 19 fb 1c 50 00 61 00 73 00 73 00 2 7c d0 c2 41 da 6f 14 41 c9 10 b2 a9 88 d7 92 c8 89 2c 54 98 46 5e 25 77 00 6f 00 72 00 64 00 9 56 26 cd a5 81 e9 22 3d fb 5a a3 3e 8e f7 86 fb ad a8 67 e9 76 df 0d 31 00 32 00 33 00 00 00 The output variable fields are: Parameters Value output->buffer 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 31 00 32 00 33 00 00 00 output->length 0x16
POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080 Windows NT 3.1 POLICY_SET_AUDIT_REQUIREMENTS 0x00000100 Windows NT 3.1 POLICY_AUDIT_LOG_ADMIN 0x00000200 Windows NT 3.1 POLICY_SERVER_ADMIN 0x00000400 Windows NT 3.1 POLICY_LOOKUP_NAMES 0x00000800 Windows NT 3.1 POLICY_NOTIFICATION 0x00001000 Windows 2000 <10> Section 2.2.1.1.5: The following is a timeline of when each access mask was introduced. All access continue to be available in subsequent versions of Windows according to the applicability list at the beginning of this section. Value Product TRUSTED_QUERY_DOMAIN_NAME 0x00000001 Windows NT 3.1 TRUSTED_QUERY_CONTROLLERS 0x00000002 Windows NT 3.1 TRUSTED_SET_CONTROLLERS 0x00000004 Windows NT 3.1 TRUSTED_QUERY_POSIX 0x00000008 Windows NT 3.1 TRUSTED_SET_POSIX 0x00000010 Windows NT 3.1 TRUSTED_SET_AUTH 0x00000020 Windows 2000 TRUSTED_QUERY_AUTH 0x00000040 Windows 2000 <11> Section 2.2.1.2: The POLICY_MODE_ALL flag applies to Windows 2000 Server and later versions. <12> Section 2.2.1.2: The POLICY_MODE_ALL_NT4 flag applies to Windows NT 3.1 through Windows NT 4.0.
<13> Section 2.2.1.2: The following is a timeline of when each mode was introduced. All modes continue to be available in subsequent versions of Windows according to the applicability list at the beginning of this section. Value Product 0x00000000 No access Windows NT 3.1 0x00000001 POLICY_MODE_INTERACTIVE Windows NT 3.1 0x00000002 POLICY_MODE_NETWORK Windows NT 3.1 0x00000004 POLICY_MODE_BATCH Windows NT 3.1 0x00000010 POLICY_MODE_SERVICE Windows NT 3.1 0x00000020 POLICY_MODE_PROXY Windows NT 3.1 0x00000040 POLICY_MODE_DENY_INTERACTIVE Windows 2000 0x00000080 POLICY_MODE_DENY_NETWORK Windows 2000 0x00000100 POLICY_MODE_DENY_BATCH Windows 2000 0x00000200 POLICY_MODE_DENY_SERVICE Windows 2000 0x00000400 POLICY_MODE_REMOTE_INTERACTIVE Windows XP 0x00000800 POLICY_MODE_DENY_REMOTE_INTERACTIVE Windows XP <14> Section 2.2.2.4: The Windows implementation of the RPC client for this protocol leaves this structure to be filled by a higher-layer application and does not verify the structure's contents except for RootDirectory, which must be NULL. <15> Section 2.2.2.5: In Windows NT, Windows 2000, Windows XP, and Windows XP operating system Service Pack 1 (SP1), the Windows RPC server and RPC client do not enforce restrictions on the Length field of this structure (using the range primitive specified in [MS-RPCE]). <16> Section 2.2.4.1: The following is a timeline of when each enumeration value was introduced. All enumeration values continue to be available in subsequent versions of Windows according to the applicability list at the beginning of this section. Value Product
A 67 67 Access 84 84 84 98 Account objects 73 161 98 69 21 C 22 217 88 88 23 151 151 D 67 67 23 23 155 155 173 175 66 E 66 173 Events 160 160 161 161 164 167 161 169 F 22 178 G 8 H Handles 88 84 I 178 173 173 177 14 79 79 8 L Local events 160 160 160 63 65 64 64 63 64 61 63 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56 57 52 54 51
61 61 52 47 109 104 155 99 112 135 134 131 153 124 108 100 107 146 103 129 127 105 149 148 147 102 89 88 113 119 130 95 141 92 90 137 116 151 121 125 110 104 118 97 143 95 93 139 114 152 106 122 126 117 M 161 164 167 79 79 Messages 23 23 23 Methods 84 98 98 88 151 151 155 84 88 88 146 146 111 111 119 119 N 13 O 84 84 14 P 177 177 63 65 64 63 64 61 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56
57 52 54 51 61 61 52 47 Policy object 67 88 88 46 43 42 39 43 45 44 37 41 42 42 43 42 39 45 44 42 42 21 21 Privilege 69 146 146 194 Protocol Details 67 37 34 60 52 R 173 13 14 13 19 S 66 Secret 173 173 111 Secret objects 73 164 111 173 173 177 36 37 79 79 Server 67 84 98 88 151 155 79 160 79 84 88 146 111 79 160 79 119 67 22 34 169 72 T 160 160 79 79 217 23 23 119 Trusted domain objects 75 167 119 60 49 52 V 155 22 22