technical content. 6/20/2008 9.0 Major Updated and revised the technical content. 7/25/2008 9.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 10.0 Major Updated and revised the technical content. 10/24/2008 11.0 Updated and revised the technical content. 12/5/2008 12.0 Major Updated and revised the technical content. 1/16/2009 13.0 Major Updated and revised the technical content. 2/27/2009 14.0 Major Updated and revised the technical content. 4/10/2009 15.0 Major Updated and revised the technical content. 5/22/2009 16.0 Major Updated and revised the technical content. 7/2/2009 17.0 Major Updated and revised the
technical content. 8/14/2009 18.0 Major Updated and revised the technical content. 9/25/2009 19.0 Major Updated and revised the technical content. 11/6/2009 20.0 Major Updated and revised the technical content. 12/18/2009 21.0 Major Updated and revised the technical content. 1/29/2010 22.0 Major Updated and revised the technical content. 3/12/2010 23.0 Major Updated and revised the technical content. 4/23/2010 23.1 Minor Clarified the meaning of the technical content. 6/4/2010 24.0 Major Updated and revised the technical content. 7/16/2010 25.0 Major Updated and revised the technical content. 8/27/2010 26.0 Updated and revised the technical content.
10/8/2010 27.0 Major Updated and revised the technical content. 11/19/2010 28.0 Major Updated and revised the technical content. 1/7/2011 29.0 Major Updated and revised the technical content. 2/11/2011 30.0 Updated and revised the technical content. 3/25/2011 31.0 Major Updated and revised the technical content. 5/6/2011 32.0 Major Updated and revised the technical content. 6/17/2011 33.0 Updated and revised the technical content. 9/23/2011 33.0 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 34.0 Major Updated and revised the technical content. 3/30/2012 35.0 Major Updated and revised the
technical content. 7/12/2012 35.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 36.0 Major Updated and revised the technical content. 1/31/2013 36.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 37.0 Major Updated and revised the technical content. 11/14/2013 37.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 37.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 37.0 None No changes to the meaning, language, or formatting of the
technical content. 6/30/2015 38.0 Major Significantly changed the technical content. 10/16/2015 38.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 39.0 Major Significantly changed the technical content. 6/1/2017 40.0 Significantly changed the technical content. 9/15/2017 41.0 Significantly changed the technical content. 12/1/2017 41.0 None No changes to the meaning, language, or formatting of the technical content.
ACCOUNT_ADJUST_SYSTEM_ACCESS 0x00000008 Change system access. ACCESS_MASK for Secret Objects The following flags apply to . Value Meaning SECRET_SET_VALUE 0x00000001 Set secret value. SECRET_QUERY_VALUE 0x00000002 Query secret value. ACCESS_MASK for Trusted Domain Objects The following flags apply to .<10> Meaning TRUSTED_QUERY_DOMAIN_NAME 0x00000001 View information. TRUSTED_QUERY_CONTROLLERS 0x00000002 View "Domain Controllers" information. TRUSTED_SET_CONTROLLERS 0x00000004 Change "Domain Controllers" information. TRUSTED_QUERY_POSIX 0x00000008 View POSIX information. TRUSTED_SET_POSIX 0x00000010 Change POSIX information. TRUSTED_SET_AUTH 0x00000020 Change authentication information. TRUSTED_QUERY_AUTH 0x00000040 View authentication information.
section 6.1.6.7.8) Type section 6.1.6.7.15) unsigned int (as specified in section TrustType) trustType ([MS-ADA3] section 2.327) Trust Direction section 6.1.6.7.12) unsigned int (as specified in section 2.2.7.9 TrustDirection) trustDirection ([MS-ADA3] section 2.323) Trust Attributes section 6.1.6.7.9) unsigned int (as specified in section 2.2.7.9 TrustAttributes) trustAttributes section 2.320) Posix Offset section 6.1.6.7.14) trustPosixOffset section 2.326) Incoming Passwords section 6.1.6.7.10) Array of trustAuthIncoming section 2.321) Trust Outgoing Passwords section 6.1.6.7.11) of LSAPR_AUTH_INFORMATION trustAuthOutgoing section 2.322) Supported Encryption Types section 6.1.6.7.3) ([MS-ADA2] section 2.464) Forest Trust Information section 6.1.6.7.4) ([MS-ADA2] section 2.479)
The LsarCreateTrustedDomainEx method is invoked to create a new . NTSTATUS LsarCreateTrustedDomainEx( [in] LSAPR_HANDLE PolicyHandle, [in] PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX TrustedDomainInformation, [in] PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION AuthenticationInformation, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* TrustedDomainHandle ); PolicyHandle: An context handle obtained from either or . TrustedDomainInformation: Information about the new TDO to be created. AuthenticationInformation: Encrypted authentication information for the new TDO. DesiredAccess: An access mask that specifies desired access to the TDO handle. TrustedDomainHandle: Used to return the handle for the newly created TDO. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<88> 0xC00000DD STATUS_INVALID_DOMAIN_STATE The operation cannot complete in the current state of the . 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The was not available on the server. 0xC0000078 STATUS_INVALID_SID The of the is not valid.
Message 4: Failure: Secret name "NL$" is a reserved prefix name and cannot be used. Direction and method Parameter field Parameter value Receive LsarCreateSecret Status STATUS_INVALID_PARAMETER Receive LsarCreateSecret SecretHandle NULL Message 5: Attempt to create a secret object with name "MyBigSecret". Direction and method Parameter field Parameter value Send LsarCreateSecret PolicyHandle [Implementation-specific value returned in Step 2.] Send LsarCreateSecret Secretname "MyBigSecret" Send LsarCreateSecret DesiredAccess SECRET_SET_VALUE Message 6: Success: Secret created. Direction and method Parameter field Parameter Receive LsarCreateSecret Status STATUS_SUCCESS Receive LsarCreateSecret SecretHandle [Implementation-specific value] Message 7: Set the value of the secret object. Direction and method Parameter Parameter value Send LsarSetSecret SecretHandle [Implementation-specific value returned in Step 6.] Send LsarSetSecret EncryptedCurrentValue Byte BLOB encrypted with session key. Send LsarSetSecret EncryptedOldValue NULL Message 8: Success: Secret value set. Direction and method Parameter field Parameter value Receive LsarSetSecret Status STATUS_SUCCESS Message 9: Done with this secret; close the handle.
Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows NT 3.1 Windows 2000 Windows NT 3.1 Windows NT 3.1
Windows XP and Windows Server 2003 <9> Section 2.2.1.1.2: The following is a timeline of when each access mask was introduced. All access masks continue to be available in subsequent versions of Windows according to the applicability lists at the beginning of this section. Value Product 0x00000000 Windows NT 3.1 POLICY_VIEW_LOCAL_INFORMATION 0x00000001 Windows NT 3.1 POLICY_VIEW_AUDIT_INFORMATION 0x00000002 Windows NT 3.1 POLICY_GET_PRIVATE_INFORMATION 0x00000004 Windows NT 3.1 POLICY_TRUST_ADMIN 0x00000008 Windows NT 3.1 POLICY_CREATE_ACCOUNT 0x00000010 Windows NT 3.1 POLICY_CREATE_SECRET 0x00000020 Windows NT 3.1 POLICY_CREATE_PRIVILEGE 0x00000040 Windows NT 3.1 POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080 Windows NT 3.1 POLICY_SET_AUDIT_REQUIREMENTS 0x00000100 Windows NT 3.1 POLICY_AUDIT_LOG_ADMIN 0x00000200 Windows NT 3.1 POLICY_SERVER_ADMIN 0x00000400 Windows NT 3.1 POLICY_LOOKUP_NAMES 0x00000800 Windows NT 3.1 POLICY_NOTIFICATION 0x00001000 Windows 2000
Audit Full Windows XP and later, and Windows Server 2003 and Windows Server 2003 R2 and later return STATUS_INVALID_PARAMETER for this information class. Event Auditing Options On Windows 2000 and Windows XP: AuditingMode = FALSE MaximumAuditEventCount = 9 EventAuditingOptions = { 0, 0, 0, 0, 0, 0, 0, 0, 0 } On Windows Server 2003 and Windows Server 2003 R2: AuditingMode = TRUE MaximumAuditEventCount = 9 EventAuditingOptions = { 0, 1, 0, 0, 0, 0, 0, 0, 1 } On Windows and later and Windows Server 2008 and later: AuditingMode = TRUE MaximumAuditEventCount = 9 EventAuditingOptions = { 0, 0, 0, 0, 0, 0, 0, 0, 0 } Primary Domain Name = <Workgroup Name> Sid = NULL DNS Domain Name = <Workgroup Name> DnsDomainName = <Empty String> DnsForestName = <Empty String> DomainGuid = { 0 } Sid = NULL Account Domain DomainName = <Machine Netbios name> DomainSid = < S-1-5-21-X-Y-Z> where X, Y, Z are random numbers Server Role LsaServerRole = PolicyServerRolePrimary Replica Source ReplicaSource=<Empty String> ReplicaAccountName=<Empty String> Policy <No value> File System (EFS) Policy <No
SE_INC_BASE_PRIORITY_NAME "SeIncreaseBasePriorityPrivilege" Windows NT 3.1 SE_INCREASE_QUOTA_NAME "SeIncreaseQuotaPrivilege" Windows NT 3.1 SE_LOAD_DRIVER_NAME "SeLoadDriverPrivilege" Windows NT 3.1 SE_LOCK_MEMORY_NAME "SeLockMemoryPrivilege" Windows NT 3.1 SE_MACHINE_ACCOUNT_NAME "SeMachineAccountPrivilege" Windows NT 3.5 SE_MANAGE_VOLUME_NAME "SeManageVolumePrivilege" Windows 2000 SP4 and Windows XP SE_PROF_SINGLE_PROCESS_NAME "SeProfileSingleProcessPrivilege" Windows NT 3.1 SE_REMOTE_SHUTDOWN_NAME "SeRemoteShutdownPrivilege" Windows NT 3.1 SE_RESTORE_NAME "SeRestorePrivilege" Windows NT 3.1 SE_SECURITY_NAME "SeSecurityPrivilege" Windows NT 3.1 SE_SHUTDOWN_NAME "SeShutdownPrivilege" Windows NT 3.1 SE_SYNC_AGENT_NAME "SeSyncAgentPrivilege" Windows 2000 SE_SYSTEM_ENVIRONMENT_NAME "SeSystemEnvironment" Windows NT 3.1 SE_SYSTEM_PROFILE_NAME "SeSystemProfilePrivilege" Windows NT 3.1 SE_SYSTEMTIME_NAME "SeSystemtimePrivilege" Windows NT 3.1 SE_TAKE_OWNERSHIP_NAME "SeTakeOwnershipPrivilege" Windows NT 3.1 SE_TCB_NAME "SeTcbPrivilege" Windows NT 3.1 SE_UNDOCK_NAME "SeUndockPrivilege" Windows NT 3.1
Index A 67 67 Access 84 84 84 98 Account objects 73 161 98 69 21 C 22 216 88 88 23 151 151 D 67 67 23 23 156 156 173 175 66 E 66 173 Events 160 160 161 161 164 167 161 169 F 22 178 G 8 H Handles 88 84 I 178 173 173 177 14 79 79 8 L Local events 160 160 160 63 65 64 64 63 64 61 63 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56 57 52 54 51 61 61
52 47 109 104 155 99 112 136 134 132 154 125 108 100 107 147 103 129 128 105 150 149 148 102 89 88 113 120 131 96 142 92 90 137 116 151 121 126 110 105 118 97 143 95 93 139 115 153 106 122 127 117 M 161 164 167 79 79 Messages 23 23 23 Methods 84 98 98 88 151 151 156 84 88 88 146 146 111 111 119 119 N 13 O 84 84 14 P 177 177 63 65 64 63 64 61 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56 57 52
54 51 61 61 52 47 Policy object 67 88 88 46 43 42 39 43 45 44 37 41 42 42 43 42 39 45 44 42 42 21 21 Privilege 69 146 146 194 Protocol Details 67 37 34 60 52 R 173 13 14 13 19 S 66 Secret 173 173 111 Secret objects 73 164 111 173 173 177 36 37 79 79 Server 67 84 98 88 151 156 79 160 79 84 88 146 111 79 160 79 119 67 22 34 169 72 T 160 160 79 79 216 23 23 119 Trusted domain objects 75 167 119 60 49 52 V 156 22 22