technical content. 6/20/2008 9.0 Major Updated and revised the technical content. 7/25/2008 9.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 10.0 Major Updated and revised the technical content. 10/24/2008 11.0 Major Updated and revised the technical content. 12/5/2008 12.0 Major Updated and revised the technical content. 1/16/2009 13.0 Major Updated and revised the technical content. 2/27/2009 14.0 Major Updated and revised the technical content. 4/10/2009 15.0 Major Updated and revised the technical content. 5/22/2009 16.0 Major Updated and revised the technical content. 7/2/2009 17.0 Major Updated and revised the
technical content. 8/14/2009 18.0 Updated and revised the technical content. 9/25/2009 19.0 Major Updated and revised the technical content. 11/6/2009 20.0 Major Updated and revised the technical content. 12/18/2009 21.0 Major Updated and revised the technical content. 1/29/2010 22.0 Major Updated and revised the technical content. 3/12/2010 23.0 Major Updated and revised the technical content. 4/23/2010 23.1 Clarified the meaning of the technical content. 6/4/2010 24.0 Major Updated and revised the technical content. 7/16/2010 25.0 Major Updated and revised the technical content. 8/27/2010 26.0 Updated and revised the technical content.
10/8/2010 27.0 Major Updated and revised the technical content. 11/19/2010 28.0 Major Updated and revised the technical content. 1/7/2011 29.0 Major Updated and revised the technical content. 2/11/2011 30.0 Major Updated and revised the technical content. 3/25/2011 31.0 Major Updated and revised the technical content. 5/6/2011 32.0 Updated and revised the technical content. 6/17/2011 33.0 Major Updated and revised the technical content. 9/23/2011 33.0 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 34.0 Updated and revised the technical content. 3/30/2012 35.0 Major Updated and revised the
technical content. 7/12/2012 35.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 36.0 Major Updated and revised the technical content. 1/31/2013 36.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 37.0 Major Updated and revised the technical content. 11/14/2013 37.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 37.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 37.0 None No changes to the meaning, language, or formatting of the
technical content. 6/30/2015 38.0 Major Significantly changed the technical content. 10/16/2015 38.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 39.0 Major Significantly changed the technical content. 6/1/2017 40.0 Major Significantly changed the technical content. 9/15/2017 41.0 Major Significantly changed the technical content.
0x40000000 TRUSTED_SET_CONTROLLERS | TRUSTED_SET_POSIX | READ_CONTROL 0x00020014 0x20000000 TRUSTED_QUERY_CONTROLLERS | TRUSTED_QUERY_POSIX | READ_CONTROL 0x0002000A 0x10000000 TRUSTED_QUERY_DOMAIN_NAME | TRUSTED_QUERY_CONTROLLERS | TRUSTED_SET_CONTROLLERS | TRUSTED_QUERY_POSIX | TRUSTED_SET_POSIX | TRUSTED_SET_AUTH | TRUSTED_QUERY_AUTH | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER 0x000F007F ACCESS_MASK for Policy Objects The following flags apply to policy objects. Value Meaning 0x00000000 No access. POLICY_VIEW_LOCAL_INFORMATION 0x00000001 Access to view information. POLICY_VIEW_AUDIT_INFORMATION 0x00000002 Access to view audit information. POLICY_GET_PRIVATE_INFORMATION 0x00000004 Access to view private information. POLICY_TRUST_ADMIN 0x00000008 Access to administer relationships. POLICY_CREATE_ACCOUNT 0x00000010 Access to create . POLICY_CREATE_SECRET 0x00000020 Access to create . POLICY_CREATE_PRIVILEGE 0x00000040 Access to create .
ACCOUNT_ADJUST_SYSTEM_ACCESS 0x00000008 Change system access. ACCESS_MASK for Secret Objects The following flags apply to . Value Meaning SECRET_SET_VALUE 0x00000001 Set secret value. SECRET_QUERY_VALUE 0x00000002 Query secret value. ACCESS_MASK for Trusted Domain Objects The following flags apply to .<10> Meaning TRUSTED_QUERY_DOMAIN_NAME 0x00000001 View information. TRUSTED_QUERY_CONTROLLERS 0x00000002 View "Domain Controllers" information. TRUSTED_SET_CONTROLLERS 0x00000004 Change "Domain Controllers" information. TRUSTED_QUERY_POSIX 0x00000008 View POSIX information. TRUSTED_SET_POSIX 0x00000010 Change POSIX information. TRUSTED_SET_AUTH 0x00000020 Change authentication information. TRUSTED_QUERY_AUTH 0x00000040 View authentication information.
section 6.1.6.7.8) Trust Type section 6.1.6.7.15) unsigned int (as specified in section TrustType) trustType ([MS-ADA3] section 2.327) Trust Direction section 6.1.6.7.12) unsigned int (as specified in section 2.2.7.9 TrustDirection) trustDirection ([MS-ADA3] section 2.323) Trust Attributes section 6.1.6.7.9) unsigned int (as specified in section 2.2.7.9 TrustAttributes) trustAttributes section 2.320) Posix Offset section 6.1.6.7.14) trustPosixOffset section 2.326) Trust Incoming Passwords section 6.1.6.7.10) Array of trustAuthIncoming section 2.321) Trust Outgoing Passwords section 6.1.6.7.11) of LSAPR_AUTH_INFORMATION trustAuthOutgoing section 2.322) Supported Encryption section 6.1.6.7.3) ([MS-ADA2] section 2.464) Forest Trust Information section 6.1.6.7.4) ([MS-ADA2] section 2.479)
LsarOpenAccount (opnum 17) Opens a handle to an existing account object. LsarEnumeratePrivilegesAccount (opnum 18) Enumerates all rights and of an account. LsarAddPrivilegesToAccount (opnum 19) Adds new privileges to an existing account object. LsarRemovePrivilegesFromAccount (opnum 20) Removes privileges from an existing account object. LsarGetSystemAccessAccount 23) Retrieves system access flags from the account object. LsarSetSystemAccessAccount (opnum 24) Sets system access flags on the account object. LsarEnumerateAccountsWithUserRight 35) Enumerates all account objects in the server's policy database that a given user right. LsarEnumerateAccountRights (opnum 36) Enumerates all rights of an account object in the server's policy database. LsarAddAccountRights (opnum 37) Adds new rights to an account object in the server's
policy database. LsarRemoveAccountRights (opnum 38) Removes rights from an account object in the server's policy database. LsarCreateAccount (Opnum 10) The LsarCreateAccount method is invoked to create a new in the server's database. NTSTATUS LsarCreateAccount( [in] LSAPR_HANDLE PolicyHandle, [in] PRPC_SID AccountSid, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* AccountHandle ); PolicyHandle: An context handle obtained from either or . AccountSid: The of the account to be created. DesiredAccess: A bitmask specifying accesses to be granted to the newly created and opened account at this time. AccountHandle: Used to return a handle to the newly created account object. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC0000035 STATUS_OBJECT_NAME_COLLISION An account with this SID already exists. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a valid handle. 0xC000000D STATUS_INVALID_PARAMETER Some of the parameters supplied were invalid. Processing: This message takes four arguments:
Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC0000034 STATUS_OBJECT_NAME_NOT_FOUND The secret with the specified name was not found. 0xC0000008 STATUS_INVALID_HANDLE PolicyHandle is not a handle. 0xC000000D STATUS_INVALID_PARAMETER Some of the parameters supplied were invalid. Processing: This message takes four arguments: PolicyHandle: An open handle to the policy object. If the handle is not a valid context handle to the policy object or PolicyHandle.HandleType does not equal "Policy", the server MUST return STATUS_INVALID_HANDLE. PolicyHandle.GrantedAccess MUST NOT be considered for this call because the access check MUST happen on the secret object. SecretName: The name of the secret to be opened. The server MUST verify that the name syntax restrictions on secrets specified in section are satisfied, and fail the request with STATUS_INVALID_PARAMETER otherwise. The server MUST verify that the secret object with this name exists in its policy database and fail the request with STATUS_OBJECT_NAME_NOT_FOUND otherwise.<70> DesiredAccess: A bitmask specifying the type of access that the caller attempts to obtain from the secret object, which is access-checked according to section . The method-specific portion of the check is as follows: IF (IsRequestorAnonymous() and LsaRestrictAnonymous is set to TRUE) THEN Return STATUS_OBJECT_NAME_NOT_FOUND END IF The secret-rights bits are specified in section and the is specified in section . The IsRequestorAnonymous procedure is specified in section . SecretHandle: If the request is successful, this parameter is used to return a handle (section ) to the opened secret object with its fields initialized as follows: LsaContextHandle.HandleType = "Secret" LsaContextHandle.Object = the secret object LsaContextHandle.GrantedAccess = as specified in section 3.1.4.2.1 LsarSetSecret (Opnum 29) The LsarSetSecret method is invoked to set the current and old values of the . NTSTATUS LsarSetSecret(
LsarEnumerateTrustedDomains (opnum 13) Enumerates trusted domain objects in the server's policy database. LsarQueryForestTrustInformation (opnum 73) Obtains information from a trusted domain object corresponding to a relationship. LsarSetForestTrustInformation (opnum 74) Sets information on a trusted domain object corresponding to a cross-forest trust relationship. LsarOpenTrustedDomain (Opnum 25) The LsarOpenTrustedDomain method is invoked to obtain a handle to a . NTSTATUS LsarOpenTrustedDomain( [in] LSAPR_HANDLE PolicyHandle, [in] PRPC_SID TrustedDomainSid, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* TrustedDomainHandle ); PolicyHandle: An context handle obtained from either or . TrustedDomainSid: A of the that is being opened. DesiredAccess: A bitmask of access rights to open the object with. TrustedDomainHandle: Used to return the trusted domain object handle. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied parameters is invalid. For instance, this can happen if the security identifier TrustedDomainSid is not a valid
The LsarCreateTrustedDomainEx method is invoked to create a new . NTSTATUS LsarCreateTrustedDomainEx( [in] LSAPR_HANDLE PolicyHandle, [in] PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX TrustedDomainInformation, [in] PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION AuthenticationInformation, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* TrustedDomainHandle ); PolicyHandle: An context handle obtained from either or . TrustedDomainInformation: Information about the new TDO to be created. AuthenticationInformation: Encrypted authentication information for the new TDO. DesiredAccess: An access mask that specifies desired access to the TDO handle. TrustedDomainHandle: Used to return the handle for the newly created TDO. Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows. Return value/code Description 0x00000000 STATUS_SUCCESS The request was successfully completed. 0xC0000022 STATUS_ACCESS_DENIED The caller does not have the permissions to perform this operation. 0xC000000D STATUS_INVALID_PARAMETER One of the supplied arguments is invalid. 0xC0000300 STATUS_NOT_SUPPORTED_ON_SBS The operation is not supported on a particular product.<88> 0xC00000DD STATUS_INVALID_DOMAIN_STATE The operation cannot complete in the current state of the . 0xC00002B1 STATUS_DIRECTORY_SERVICE_REQUIRED The was not available on the server. 0xC0000078 STATUS_INVALID_SID The of the is not valid.
Message 9: Update the on the account object. Direction and method Parameter field Parameter Send [Implementation-specific returned in Step 6.] Send DACL_SECURITY_INFORMATION Send Security descriptor representation of the DACL in self-relative form. Message 10: Success: Security descriptor of the account object has been updated. Direction and method Parameter field Parameter Receive LsarSetSecurityObject Status STATUS_SUCCESS Message 11: Retrieve the Locally Unique Identifier (LUID) that the server assigns to the "SeTcbPrivilege" . Direction and method Parameter field Parameter value Send LsarLookupPrivilegeValue PolicyHandle [Implementation-specific value returned in Step 2.] Send LsarLookupPrivilegeValue Name "SeTcbPrivilege" Message 12: Success: Return the of SeTcbPrivilege. Direction and method Parameter field Parameter Receive LsarLookupPrivilegeValue Status STATUS_SUCCESS Receive LsarLookupPrivilegeValue Value The LUID assigned by the server to SeTcbPrivilege. Message 13: Add a privilege to the account object. Direction and method Parameter field Parameter value Send [Implementation-specific value returned in Step 6.] Send Privileges A LSAPR_PRIVILEGE_SET structure containing one privilege (the LUID of which was returned in Step 12).
Windows XP and Windows Server 2003 <9> Section 2.2.1.1.2: The following is a timeline of when each access mask was introduced. All access continue to be available in subsequent versions of Windows according to the applicability lists at the beginning of this section. Product 0x00000000 Windows NT 3.1 POLICY_VIEW_LOCAL_INFORMATION 0x00000001 Windows NT 3.1 POLICY_VIEW_AUDIT_INFORMATION 0x00000002 Windows NT 3.1 POLICY_GET_PRIVATE_INFORMATION 0x00000004 Windows NT 3.1 POLICY_TRUST_ADMIN 0x00000008 Windows NT 3.1 POLICY_CREATE_ACCOUNT 0x00000010 Windows NT 3.1 POLICY_CREATE_SECRET 0x00000020 Windows NT 3.1 POLICY_CREATE_PRIVILEGE 0x00000040 Windows NT 3.1 POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080 Windows NT 3.1 POLICY_SET_AUDIT_REQUIREMENTS 0x00000100 Windows NT 3.1 POLICY_AUDIT_LOG_ADMIN 0x00000200 Windows NT 3.1 POLICY_SERVER_ADMIN 0x00000400 Windows NT 3.1 POLICY_LOOKUP_NAMES 0x00000800 Windows NT 3.1 POLICY_NOTIFICATION 0x00001000 Windows 2000
Change Tracking This section identifies changes that were made to this document since the last release. Changes are classified as Major, Minor, or None. The revision class Major means that the technical content in the document was significantly revised. Major changes affect protocol interoperability or implementation. Examples of major changes are: A document revision that incorporates changes to interoperability requirements. A document revision that captures changes to protocol functionality. The revision class Minor means that the meaning of the technical content was clarified. Minor changes do not affect protocol interoperability or implementation. Examples of minor changes are updates to clarify ambiguity at the sentence, paragraph, or table level. The revision class None means that no new technical changes were introduced. Minor editorial and formatting changes may have been made, but the relevant technical content is identical to the last released version. The changes made to this document are listed in the following table. For more information, please contact . Section Description Revision class Appendix B: Product Behavior Windows Server operating system to the list of applicable products.
61 61 52 47 109 104 155 99 112 136 134 132 154 125 108 100 107 147 103 129 128 105 150 149 148 102 89 88 113 120 131 96 142 92 90 137 116 151 121 126 110 105 118 97 143 95 93 139 115 153 106 122 127 117 M 161 164 167 79 79 Messages 23 23 23 Methods 84 98 98 88 151 151 156 84 88 88 146 146 111 111 119 119 N 13 O 84 84 14 P 177 177 63 65 64 63 64 61 46 46 35 59 48 47 33 41 40 43 44 41 40 65 42 65 47 35 34 48 51 57 55 56 56 56
57 52 54 51 61 61 52 47 Policy object 67 88 88 46 43 42 39 43 45 44 37 41 42 42 43 42 39 45 44 42 42 21 21 Privilege 69 146 146 194 Protocol Details 67 37 34 60 52 R 173 13 14 13 19 S 66 Secret 173 173 111 Secret objects 73 164 111 173 173 177 36 37 79 79 Server 67 84 98 88 151 156 79 160 79 84 88 146 111 79 160 79 119 67 22 34 169 72 T 160 160 79 79 216 23 23 119 Trusted domain objects 75 167 119 60 49 52 V 156 22 22