-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathntsam.h
1899 lines (1625 loc) · 51.3 KB
/
ntsam.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* Security Account Manager support functions
*
* This file is part of System Informer.
*/
#ifndef _NTSAM_H
#define _NTSAM_H
#define SAM_MAXIMUM_LOOKUP_COUNT (1000)
#define SAM_MAXIMUM_LOOKUP_LENGTH (32000)
#define SAM_MAX_PASSWORD_LENGTH (256)
#define SAM_PASSWORD_ENCRYPTION_SALT_LEN (16)
typedef PVOID SAM_HANDLE, *PSAM_HANDLE;
typedef ULONG SAM_ENUMERATE_HANDLE, *PSAM_ENUMERATE_HANDLE;
typedef struct _SAM_RID_ENUMERATION
{
ULONG RelativeId;
UNICODE_STRING Name;
} SAM_RID_ENUMERATION, *PSAM_RID_ENUMERATION;
typedef struct _SAM_SID_ENUMERATION
{
PSID Sid;
UNICODE_STRING Name;
} SAM_SID_ENUMERATION, *PSAM_SID_ENUMERATION;
typedef struct _SAM_BYTE_ARRAY
{
ULONG Size;
_Field_size_bytes_(Size) PUCHAR Data;
} SAM_BYTE_ARRAY, *PSAM_BYTE_ARRAY;
typedef struct _SAM_BYTE_ARRAY_32K
{
ULONG Size;
_Field_size_bytes_(Size) PUCHAR Data;
} SAM_BYTE_ARRAY_32K, *PSAM_BYTE_ARRAY_32K;
typedef SAM_BYTE_ARRAY_32K SAM_SHELL_OBJECT_PROPERTIES, *PSAM_SHELL_OBJECT_PROPERTIES;
// Basic
NTSYSAPI
NTSTATUS
NTAPI
SamFreeMemory(
_In_ PVOID Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamCloseHandle(
_In_ SAM_HANDLE SamHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamSetSecurityObject(
_In_ SAM_HANDLE ObjectHandle,
_In_ SECURITY_INFORMATION SecurityInformation,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
NTSYSAPI
NTSTATUS
NTAPI
SamQuerySecurityObject(
_In_ SAM_HANDLE ObjectHandle,
_In_ SECURITY_INFORMATION SecurityInformation,
_Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor
);
NTSYSAPI
NTSTATUS
NTAPI
SamRidToSid(
_In_ SAM_HANDLE ObjectHandle,
_In_ ULONG Rid,
_Outptr_ PSID *Sid
);
// Server
#define SAM_SERVER_CONNECT 0x0001
#define SAM_SERVER_SHUTDOWN 0x0002
#define SAM_SERVER_INITIALIZE 0x0004
#define SAM_SERVER_CREATE_DOMAIN 0x0008
#define SAM_SERVER_ENUMERATE_DOMAINS 0x0010
#define SAM_SERVER_LOOKUP_DOMAIN 0x0020
#define SAM_SERVER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
SAM_SERVER_CONNECT | \
SAM_SERVER_INITIALIZE | \
SAM_SERVER_CREATE_DOMAIN | \
SAM_SERVER_SHUTDOWN | \
SAM_SERVER_ENUMERATE_DOMAINS | \
SAM_SERVER_LOOKUP_DOMAIN)
#define SAM_SERVER_READ (STANDARD_RIGHTS_READ | \
SAM_SERVER_ENUMERATE_DOMAINS)
#define SAM_SERVER_WRITE (STANDARD_RIGHTS_WRITE | \
SAM_SERVER_INITIALIZE | \
SAM_SERVER_CREATE_DOMAIN | \
SAM_SERVER_SHUTDOWN)
#define SAM_SERVER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
SAM_SERVER_CONNECT | \
SAM_SERVER_LOOKUP_DOMAIN)
typedef struct _RPC_AUTH_IDENTITY_HANDLE *PRPC_AUTH_IDENTITY_HANDLE;
// Functions
NTSYSAPI
NTSTATUS
NTAPI
SamConnect(
_In_opt_ PCUNICODE_STRING ServerName,
_Out_ PSAM_HANDLE ServerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
SamConnectWithCreds(
_In_ PCUNICODE_STRING ServerName,
_Out_ PSAM_HANDLE ServerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PRPC_AUTH_IDENTITY_HANDLE Creds,
_In_ PWCHAR Spn,
_Out_ BOOL* pfDstIsW2K
);
NTSYSAPI
NTSTATUS
NTAPI
SamShutdownSamServer(
_In_ SAM_HANDLE ServerHandle
);
// Domain
#define DOMAIN_READ_PASSWORD_PARAMETERS 0x0001
#define DOMAIN_WRITE_PASSWORD_PARAMS 0x0002
#define DOMAIN_READ_OTHER_PARAMETERS 0x0004
#define DOMAIN_WRITE_OTHER_PARAMETERS 0x0008
#define DOMAIN_CREATE_USER 0x0010
#define DOMAIN_CREATE_GROUP 0x0020
#define DOMAIN_CREATE_ALIAS 0x0040
#define DOMAIN_GET_ALIAS_MEMBERSHIP 0x0080
#define DOMAIN_LIST_ACCOUNTS 0x0100
#define DOMAIN_LOOKUP 0x0200
#define DOMAIN_ADMINISTER_SERVER 0x0400
#define DOMAIN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
DOMAIN_READ_OTHER_PARAMETERS | \
DOMAIN_WRITE_OTHER_PARAMETERS | \
DOMAIN_WRITE_PASSWORD_PARAMS | \
DOMAIN_CREATE_USER | \
DOMAIN_CREATE_GROUP | \
DOMAIN_CREATE_ALIAS | \
DOMAIN_GET_ALIAS_MEMBERSHIP | \
DOMAIN_LIST_ACCOUNTS | \
DOMAIN_READ_PASSWORD_PARAMETERS | \
DOMAIN_LOOKUP | \
DOMAIN_ADMINISTER_SERVER)
#define DOMAIN_READ (STANDARD_RIGHTS_READ | \
DOMAIN_GET_ALIAS_MEMBERSHIP | \
DOMAIN_READ_OTHER_PARAMETERS)
#define DOMAIN_WRITE (STANDARD_RIGHTS_WRITE | \
DOMAIN_WRITE_OTHER_PARAMETERS | \
DOMAIN_WRITE_PASSWORD_PARAMS | \
DOMAIN_CREATE_USER | \
DOMAIN_CREATE_GROUP | \
DOMAIN_CREATE_ALIAS | \
DOMAIN_ADMINISTER_SERVER)
#define DOMAIN_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
DOMAIN_READ_PASSWORD_PARAMETERS | \
DOMAIN_LIST_ACCOUNTS | \
DOMAIN_LOOKUP)
#define DOMAIN_PROMOTION_INCREMENT { 0x0, 0x10 }
#define DOMAIN_PROMOTION_MASK { 0x0, 0xfffffff0 }
// SamQueryInformationDomain/SamSetInformationDomain types
typedef enum _DOMAIN_INFORMATION_CLASS
{
DomainPasswordInformation = 1, // q; s: DOMAIN_PASSWORD_INFORMATION
DomainGeneralInformation, // q: DOMAIN_GENERAL_INFORMATION
DomainLogoffInformation, // q; s: DOMAIN_LOGOFF_INFORMATION
DomainOemInformation, // q; s: DOMAIN_OEM_INFORMATION
DomainNameInformation, // q: DOMAIN_NAME_INFORMATION
DomainReplicationInformation, // q; s: DOMAIN_REPLICATION_INFORMATION
DomainServerRoleInformation, // q; s: DOMAIN_SERVER_ROLE_INFORMATION
DomainModifiedInformation, // q: DOMAIN_MODIFIED_INFORMATION
DomainStateInformation, // q; s: DOMAIN_STATE_INFORMATION
DomainUasInformation, // q; s: DOMAIN_UAS_INFORMATION
DomainGeneralInformation2, // q: DOMAIN_GENERAL_INFORMATION2
DomainLockoutInformation, // q; s: DOMAIN_LOCKOUT_INFORMATION
DomainModifiedInformation2 // q: DOMAIN_MODIFIED_INFORMATION2
} DOMAIN_INFORMATION_CLASS;
typedef enum _DOMAIN_SERVER_ENABLE_STATE
{
DomainServerEnabled = 1,
DomainServerDisabled
} DOMAIN_SERVER_ENABLE_STATE, *PDOMAIN_SERVER_ENABLE_STATE;
typedef enum _DOMAIN_SERVER_ROLE
{
DomainServerRoleBackup = 2,
DomainServerRolePrimary
} DOMAIN_SERVER_ROLE, *PDOMAIN_SERVER_ROLE;
#include <pshpack4.h>
typedef struct _DOMAIN_GENERAL_INFORMATION
{
LARGE_INTEGER ForceLogoff;
UNICODE_STRING OemInformation;
UNICODE_STRING DomainName;
UNICODE_STRING ReplicaSourceNodeName;
LARGE_INTEGER DomainModifiedCount;
DOMAIN_SERVER_ENABLE_STATE DomainServerState;
DOMAIN_SERVER_ROLE DomainServerRole;
BOOLEAN UasCompatibilityRequired;
ULONG UserCount;
ULONG GroupCount;
ULONG AliasCount;
} DOMAIN_GENERAL_INFORMATION, *PDOMAIN_GENERAL_INFORMATION;
#include <poppack.h>
#include <pshpack4.h>
typedef struct _DOMAIN_GENERAL_INFORMATION2
{
DOMAIN_GENERAL_INFORMATION I1;
LARGE_INTEGER LockoutDuration; // delta time
LARGE_INTEGER LockoutObservationWindow; // delta time
USHORT LockoutThreshold;
} DOMAIN_GENERAL_INFORMATION2, *PDOMAIN_GENERAL_INFORMATION2;
#include <poppack.h>
typedef struct _DOMAIN_UAS_INFORMATION
{
BOOLEAN UasCompatibilityRequired;
} DOMAIN_UAS_INFORMATION;
#ifndef _DOMAIN_PASSWORD_INFORMATION_DEFINED // defined in ntsecapi.h
#define _DOMAIN_PASSWORD_INFORMATION_DEFINED
typedef struct _DOMAIN_PASSWORD_INFORMATION
{
USHORT MinPasswordLength;
USHORT PasswordHistoryLength;
ULONG PasswordProperties;
LARGE_INTEGER MaxPasswordAge;
LARGE_INTEGER MinPasswordAge;
} DOMAIN_PASSWORD_INFORMATION, *PDOMAIN_PASSWORD_INFORMATION;
// PasswordProperties flags
#define DOMAIN_PASSWORD_COMPLEX 0x00000001L
#define DOMAIN_PASSWORD_NO_ANON_CHANGE 0x00000002L
#define DOMAIN_PASSWORD_NO_CLEAR_CHANGE 0x00000004L
#define DOMAIN_LOCKOUT_ADMINS 0x00000008L
#define DOMAIN_PASSWORD_STORE_CLEARTEXT 0x00000010L
#define DOMAIN_REFUSE_PASSWORD_CHANGE 0x00000020L
#define DOMAIN_NO_LM_OWF_CHANGE 0x00000040L
#endif // _DOMAIN_PASSWORD_INFORMATION_DEFINED
typedef enum _DOMAIN_PASSWORD_CONSTRUCTION
{
DomainPasswordSimple = 1,
DomainPasswordComplex
} DOMAIN_PASSWORD_CONSTRUCTION;
typedef struct _DOMAIN_LOGOFF_INFORMATION
{
LARGE_INTEGER ForceLogoff;
} DOMAIN_LOGOFF_INFORMATION, *PDOMAIN_LOGOFF_INFORMATION;
typedef struct _DOMAIN_OEM_INFORMATION
{
UNICODE_STRING OemInformation;
} DOMAIN_OEM_INFORMATION, *PDOMAIN_OEM_INFORMATION;
typedef struct _DOMAIN_NAME_INFORMATION
{
UNICODE_STRING DomainName;
} DOMAIN_NAME_INFORMATION, *PDOMAIN_NAME_INFORMATION;
typedef struct _DOMAIN_SERVER_ROLE_INFORMATION
{
DOMAIN_SERVER_ROLE DomainServerRole;
} DOMAIN_SERVER_ROLE_INFORMATION, *PDOMAIN_SERVER_ROLE_INFORMATION;
typedef struct _DOMAIN_REPLICATION_INFORMATION
{
UNICODE_STRING ReplicaSourceNodeName;
} DOMAIN_REPLICATION_INFORMATION, *PDOMAIN_REPLICATION_INFORMATION;
typedef struct _DOMAIN_MODIFIED_INFORMATION
{
LARGE_INTEGER DomainModifiedCount;
LARGE_INTEGER CreationTime;
} DOMAIN_MODIFIED_INFORMATION, *PDOMAIN_MODIFIED_INFORMATION;
typedef struct _DOMAIN_MODIFIED_INFORMATION2
{
LARGE_INTEGER DomainModifiedCount;
LARGE_INTEGER CreationTime;
LARGE_INTEGER ModifiedCountAtLastPromotion;
} DOMAIN_MODIFIED_INFORMATION2, *PDOMAIN_MODIFIED_INFORMATION2;
typedef struct _DOMAIN_STATE_INFORMATION
{
DOMAIN_SERVER_ENABLE_STATE DomainServerState;
} DOMAIN_STATE_INFORMATION, *PDOMAIN_STATE_INFORMATION;
typedef struct _DOMAIN_LOCKOUT_INFORMATION
{
LARGE_INTEGER LockoutDuration; // delta time
LARGE_INTEGER LockoutObservationWindow; // delta time
USHORT LockoutThreshold; // zero means no lockout
} DOMAIN_LOCKOUT_INFORMATION, *PDOMAIN_LOCKOUT_INFORMATION;
// SamQueryDisplayInformation types
typedef enum _DOMAIN_DISPLAY_INFORMATION
{
DomainDisplayUser = 1, // DOMAIN_DISPLAY_USER
DomainDisplayMachine, // DOMAIN_DISPLAY_MACHINE
DomainDisplayGroup, // DOMAIN_DISPLAY_GROUP
DomainDisplayOemUser, // DOMAIN_DISPLAY_OEM_USER
DomainDisplayOemGroup, // DOMAIN_DISPLAY_OEM_GROUP
DomainDisplayServer
} DOMAIN_DISPLAY_INFORMATION, *PDOMAIN_DISPLAY_INFORMATION;
typedef struct _DOMAIN_DISPLAY_USER
{
ULONG Index;
ULONG Rid;
ULONG AccountControl;
UNICODE_STRING LogonName;
UNICODE_STRING AdminComment;
UNICODE_STRING FullName;
} DOMAIN_DISPLAY_USER, *PDOMAIN_DISPLAY_USER;
typedef struct _DOMAIN_DISPLAY_MACHINE
{
ULONG Index;
ULONG Rid;
ULONG AccountControl;
UNICODE_STRING Machine;
UNICODE_STRING Comment;
} DOMAIN_DISPLAY_MACHINE, *PDOMAIN_DISPLAY_MACHINE;
typedef struct _DOMAIN_DISPLAY_GROUP
{
ULONG Index;
ULONG Rid;
ULONG Attributes;
UNICODE_STRING Group;
UNICODE_STRING Comment;
} DOMAIN_DISPLAY_GROUP, *PDOMAIN_DISPLAY_GROUP;
typedef struct _DOMAIN_DISPLAY_OEM_USER
{
ULONG Index;
OEM_STRING User;
} DOMAIN_DISPLAY_OEM_USER, *PDOMAIN_DISPLAY_OEM_USER;
typedef struct _DOMAIN_DISPLAY_OEM_GROUP
{
ULONG Index;
OEM_STRING Group;
} DOMAIN_DISPLAY_OEM_GROUP, *PDOMAIN_DISPLAY_OEM_GROUP;
// SamQueryLocalizableAccountsInDomain types
typedef enum _DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION
{
DomainLocalizableAccountsBasic = 1,
} DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION, *PDOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION;
typedef struct _DOMAIN_LOCALIZABLE_ACCOUNTS_ENTRY
{
ULONG Rid;
SID_NAME_USE Use;
UNICODE_STRING Name;
UNICODE_STRING AdminComment;
} DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY, *PDOMAIN_LOCALIZABLE_ACCOUNT_ENTRY;
typedef struct _DOMAIN_LOCALIZABLE_ACCOUNTS
{
ULONG Count;
_Field_size_(Count) DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY *Entries;
} DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC, *PDOMAIN_LOCALIZABLE_ACCOUNTS_BASIC;
typedef union _DOMAIN_LOCALIZABLE_INFO_BUFFER
{
DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC Basic;
} DOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER, *PDOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER;
// Functions
NTSYSAPI
NTSTATUS
NTAPI
SamLookupDomainInSamServer(
_In_ SAM_HANDLE ServerHandle,
_In_ PCUNICODE_STRING Name,
_Outptr_ PSID *DomainId
);
NTSYSAPI
NTSTATUS
NTAPI
SamEnumerateDomainsInSamServer(
_In_ SAM_HANDLE ServerHandle,
_Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,
_Outptr_ PVOID *Buffer, // PSAM_SID_ENUMERATION *Buffer
_In_ ULONG PreferedMaximumLength,
_Out_ PULONG CountReturned
);
NTSYSAPI
NTSTATUS
NTAPI
SamOpenDomain(
_In_ SAM_HANDLE ServerHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ PSID DomainId,
_Out_ PSAM_HANDLE DomainHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamQueryInformationDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ DOMAIN_INFORMATION_CLASS DomainInformationClass,
_Outptr_ PVOID *Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamSetInformationDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ DOMAIN_INFORMATION_CLASS DomainInformationClass,
_In_ PVOID DomainInformation
);
NTSYSAPI
NTSTATUS
NTAPI
SamLookupNamesInDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ ULONG Count,
_In_reads_(Count) PCUNICODE_STRING Names,
_Out_ _Deref_post_count_(Count) PULONG *RelativeIds,
_Out_ _Deref_post_count_(Count) PSID_NAME_USE *Use
);
NTSYSAPI
NTSTATUS
NTAPI
SamLookupNamesInDomain2(
_In_ SAM_HANDLE DomainHandle,
_In_ ULONG Count,
_In_reads_(Count) PCUNICODE_STRING Names,
_Out_ _Deref_post_count_(Count) PSID* Sids,
_Out_ _Deref_post_count_(Count) PSID_NAME_USE* Use
);
NTSYSAPI
NTSTATUS
NTAPI
SamLookupIdsInDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ ULONG Count,
_In_reads_(Count) PULONG RelativeIds,
_Out_ _Deref_post_count_(Count) PUNICODE_STRING *Names,
_Out_ _Deref_post_opt_count_(Count) PSID_NAME_USE *Use
);
NTSYSAPI
NTSTATUS
NTAPI
SamRemoveMemberFromForeignDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ PSID MemberId
);
NTSYSAPI
NTSTATUS
NTAPI
SamQueryLocalizableAccountsInDomain(
_In_ SAM_HANDLE Domain,
_In_ ULONG Flags,
_In_ ULONG LanguageId,
_In_ DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION Class,
_Outptr_ PVOID *Buffer
);
// Group
#define GROUP_READ_INFORMATION 0x0001
#define GROUP_WRITE_ACCOUNT 0x0002
#define GROUP_ADD_MEMBER 0x0004
#define GROUP_REMOVE_MEMBER 0x0008
#define GROUP_LIST_MEMBERS 0x0010
#define GROUP_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
GROUP_LIST_MEMBERS | \
GROUP_WRITE_ACCOUNT | \
GROUP_ADD_MEMBER | \
GROUP_REMOVE_MEMBER | \
GROUP_READ_INFORMATION)
#define GROUP_READ (STANDARD_RIGHTS_READ | \
GROUP_LIST_MEMBERS)
#define GROUP_WRITE (STANDARD_RIGHTS_WRITE | \
GROUP_WRITE_ACCOUNT | \
GROUP_ADD_MEMBER | \
GROUP_REMOVE_MEMBER)
#define GROUP_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
GROUP_READ_INFORMATION)
typedef struct _GROUP_MEMBERSHIP
{
ULONG RelativeId;
ULONG Attributes;
} GROUP_MEMBERSHIP, *PGROUP_MEMBERSHIP;
// SamQueryInformationGroup/SamSetInformationGroup types
typedef enum _GROUP_INFORMATION_CLASS
{
GroupGeneralInformation = 1, // q: GROUP_GENERAL_INFORMATION
GroupNameInformation, // q; s: GROUP_NAME_INFORMATION
GroupAttributeInformation, // q; s: GROUP_ATTRIBUTE_INFORMATION
GroupAdminCommentInformation, // q; s: GROUP_ADM_COMMENT_INFORMATION
GroupReplicationInformation
} GROUP_INFORMATION_CLASS;
typedef struct _GROUP_GENERAL_INFORMATION
{
UNICODE_STRING Name;
ULONG Attributes;
ULONG MemberCount;
UNICODE_STRING AdminComment;
} GROUP_GENERAL_INFORMATION, *PGROUP_GENERAL_INFORMATION;
typedef struct _GROUP_NAME_INFORMATION
{
UNICODE_STRING Name;
} GROUP_NAME_INFORMATION, *PGROUP_NAME_INFORMATION;
typedef struct _GROUP_ATTRIBUTE_INFORMATION
{
ULONG Attributes;
} GROUP_ATTRIBUTE_INFORMATION, *PGROUP_ATTRIBUTE_INFORMATION;
typedef struct _GROUP_ADM_COMMENT_INFORMATION
{
UNICODE_STRING AdminComment;
} GROUP_ADM_COMMENT_INFORMATION, *PGROUP_ADM_COMMENT_INFORMATION;
// Functions
NTSYSAPI
NTSTATUS
NTAPI
SamEnumerateGroupsInDomain(
_In_ SAM_HANDLE DomainHandle,
_Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,
_Outptr_ PVOID *Buffer, // PSAM_RID_ENUMERATION *
_In_ ULONG PreferedMaximumLength,
_Out_ PULONG CountReturned
);
NTSYSAPI
NTSTATUS
NTAPI
SamCreateGroupInDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ PCUNICODE_STRING AccountName,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PSAM_HANDLE GroupHandle,
_Out_ PULONG RelativeId
);
NTSYSAPI
NTSTATUS
NTAPI
SamOpenGroup(
_In_ SAM_HANDLE DomainHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG GroupId,
_Out_ PSAM_HANDLE GroupHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamDeleteGroup(
_In_ SAM_HANDLE GroupHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamQueryInformationGroup(
_In_ SAM_HANDLE GroupHandle,
_In_ GROUP_INFORMATION_CLASS GroupInformationClass,
_Outptr_ PVOID *Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamSetInformationGroup(
_In_ SAM_HANDLE GroupHandle,
_In_ GROUP_INFORMATION_CLASS GroupInformationClass,
_In_ PVOID Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamAddMemberToGroup(
_In_ SAM_HANDLE GroupHandle,
_In_ ULONG MemberId,
_In_ ULONG Attributes
);
NTSYSAPI
NTSTATUS
NTAPI
SamRemoveMemberFromGroup(
_In_ SAM_HANDLE GroupHandle,
_In_ ULONG MemberId
);
NTSYSAPI
NTSTATUS
NTAPI
SamGetMembersInGroup(
_In_ SAM_HANDLE GroupHandle,
_Out_ _Deref_post_count_(*MemberCount) PULONG *MemberIds,
_Out_ _Deref_post_count_(*MemberCount) PULONG *Attributes,
_Out_ PULONG MemberCount
);
NTSYSAPI
NTSTATUS
NTAPI
SamSetMemberAttributesOfGroup(
_In_ SAM_HANDLE GroupHandle,
_In_ ULONG MemberId,
_In_ ULONG Attributes
);
// Alias
#define ALIAS_ADD_MEMBER 0x0001
#define ALIAS_REMOVE_MEMBER 0x0002
#define ALIAS_LIST_MEMBERS 0x0004
#define ALIAS_READ_INFORMATION 0x0008
#define ALIAS_WRITE_ACCOUNT 0x0010
#define ALIAS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
ALIAS_READ_INFORMATION | \
ALIAS_WRITE_ACCOUNT | \
ALIAS_LIST_MEMBERS | \
ALIAS_ADD_MEMBER | \
ALIAS_REMOVE_MEMBER)
#define ALIAS_READ (STANDARD_RIGHTS_READ | \
ALIAS_LIST_MEMBERS)
#define ALIAS_WRITE (STANDARD_RIGHTS_WRITE | \
ALIAS_WRITE_ACCOUNT | \
ALIAS_ADD_MEMBER | \
ALIAS_REMOVE_MEMBER)
#define ALIAS_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
ALIAS_READ_INFORMATION)
// SamQueryInformationAlias/SamSetInformationAlias types
typedef enum _ALIAS_INFORMATION_CLASS
{
AliasGeneralInformation = 1, // q: ALIAS_GENERAL_INFORMATION
AliasNameInformation, // q; s: ALIAS_NAME_INFORMATION
AliasAdminCommentInformation, // q; s: ALIAS_ADM_COMMENT_INFORMATION
AliasReplicationInformation,
AliasExtendedInformation,
} ALIAS_INFORMATION_CLASS;
typedef struct _ALIAS_GENERAL_INFORMATION
{
UNICODE_STRING Name;
ULONG MemberCount;
UNICODE_STRING AdminComment;
} ALIAS_GENERAL_INFORMATION, *PALIAS_GENERAL_INFORMATION;
typedef struct _ALIAS_NAME_INFORMATION
{
UNICODE_STRING Name;
} ALIAS_NAME_INFORMATION, *PALIAS_NAME_INFORMATION;
typedef struct _ALIAS_ADM_COMMENT_INFORMATION
{
UNICODE_STRING AdminComment;
} ALIAS_ADM_COMMENT_INFORMATION, *PALIAS_ADM_COMMENT_INFORMATION;
#define ALIAS_ALL_NAME (0x00000001L)
#define ALIAS_ALL_MEMBER_COUNT (0x00000002L)
#define ALIAS_ALL_ADMIN_COMMENT (0x00000004L)
#define ALIAS_ALL_SHELL_ADMIN_OBJECT_PROPERTIES (0x00000008L)
typedef struct _ALIAS_EXTENDED_INFORMATION
{
ULONG WhichFields;
SAM_SHELL_OBJECT_PROPERTIES ShellAdminObjectProperties;
} ALIAS_EXTENDED_INFORMATION, *PALIAS_EXTENDED_INFORMATION;
// Functions
NTSYSAPI
NTSTATUS
NTAPI
SamEnumerateAliasesInDomain(
_In_ SAM_HANDLE DomainHandle,
_Inout_ PSAM_ENUMERATE_HANDLE EnumerationContext,
_Outptr_ PVOID *Buffer, // PSAM_RID_ENUMERATION *Buffer
_In_ ULONG PreferedMaximumLength,
_Out_ PULONG CountReturned
);
NTSYSAPI
NTSTATUS
NTAPI
SamCreateAliasInDomain(
_In_ SAM_HANDLE DomainHandle,
_In_ PCUNICODE_STRING AccountName,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PSAM_HANDLE AliasHandle,
_Out_ PULONG RelativeId
);
NTSYSAPI
NTSTATUS
NTAPI
SamOpenAlias(
_In_ SAM_HANDLE DomainHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG AliasId,
_Out_ PSAM_HANDLE AliasHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamDeleteAlias(
_In_ SAM_HANDLE AliasHandle
);
NTSYSAPI
NTSTATUS
NTAPI
SamQueryInformationAlias(
_In_ SAM_HANDLE AliasHandle,
_In_ ALIAS_INFORMATION_CLASS AliasInformationClass,
_Outptr_ PVOID *Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamSetInformationAlias(
_In_ SAM_HANDLE AliasHandle,
_In_ ALIAS_INFORMATION_CLASS AliasInformationClass,
_In_ PVOID Buffer
);
NTSYSAPI
NTSTATUS
NTAPI
SamAddMemberToAlias(
_In_ SAM_HANDLE AliasHandle,
_In_ PSID MemberId
);
NTSYSAPI
NTSTATUS
NTAPI
SamAddMultipleMembersToAlias(
_In_ SAM_HANDLE AliasHandle,
_In_reads_(MemberCount) PSID *MemberIds,
_In_ ULONG MemberCount
);
NTSYSAPI
NTSTATUS
NTAPI
SamRemoveMemberFromAlias(
_In_ SAM_HANDLE AliasHandle,
_In_ PSID MemberId
);
NTSYSAPI
NTSTATUS
NTAPI
SamRemoveMultipleMembersFromAlias(
_In_ SAM_HANDLE AliasHandle,
_In_reads_(MemberCount) PSID *MemberIds,
_In_ ULONG MemberCount
);
NTSYSAPI
NTSTATUS
NTAPI
SamGetMembersInAlias(
_In_ SAM_HANDLE AliasHandle,
_Out_ _Deref_post_count_(*MemberCount) PSID **MemberIds,
_Out_ PULONG MemberCount
);
NTSYSAPI
NTSTATUS
NTAPI
SamGetAliasMembership(
_In_ SAM_HANDLE DomainHandle,
_In_ ULONG PassedCount,
_In_reads_(PassedCount) PSID *Sids,
_Out_ PULONG MembershipCount,
_Out_ _Deref_post_count_(*MembershipCount) PULONG *Aliases
);
// Group types
#define GROUP_TYPE_BUILTIN_LOCAL_GROUP 0x00000001
#define GROUP_TYPE_ACCOUNT_GROUP 0x00000002
#define GROUP_TYPE_RESOURCE_GROUP 0x00000004
#define GROUP_TYPE_UNIVERSAL_GROUP 0x00000008
#define GROUP_TYPE_APP_BASIC_GROUP 0x00000010
#define GROUP_TYPE_APP_QUERY_GROUP 0x00000020
#define GROUP_TYPE_SECURITY_ENABLED 0x80000000
#define GROUP_TYPE_RESOURCE_BEHAVOIR (GROUP_TYPE_RESOURCE_GROUP | \
GROUP_TYPE_APP_BASIC_GROUP | \
GROUP_TYPE_APP_QUERY_GROUP)
// User
#define USER_READ_GENERAL 0x0001
#define USER_READ_PREFERENCES 0x0002
#define USER_WRITE_PREFERENCES 0x0004
#define USER_READ_LOGON 0x0008
#define USER_READ_ACCOUNT 0x0010
#define USER_WRITE_ACCOUNT 0x0020
#define USER_CHANGE_PASSWORD 0x0040
#define USER_FORCE_PASSWORD_CHANGE 0x0080
#define USER_LIST_GROUPS 0x0100
#define USER_READ_GROUP_INFORMATION 0x0200
#define USER_WRITE_GROUP_INFORMATION 0x0400
#define USER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
USER_READ_PREFERENCES | \
USER_READ_LOGON | \
USER_LIST_GROUPS | \
USER_READ_GROUP_INFORMATION | \
USER_WRITE_PREFERENCES | \
USER_CHANGE_PASSWORD | \
USER_FORCE_PASSWORD_CHANGE | \
USER_READ_GENERAL | \
USER_READ_ACCOUNT | \
USER_WRITE_ACCOUNT | \
USER_WRITE_GROUP_INFORMATION)
#define USER_READ (STANDARD_RIGHTS_READ | \
USER_READ_PREFERENCES | \
USER_READ_LOGON | \
USER_READ_ACCOUNT | \
USER_LIST_GROUPS | \
USER_READ_GROUP_INFORMATION)
#define USER_WRITE (STANDARD_RIGHTS_WRITE | \
USER_WRITE_PREFERENCES | \
USER_CHANGE_PASSWORD)
#define USER_EXECUTE (STANDARD_RIGHTS_EXECUTE | \
USER_READ_GENERAL | \
USER_CHANGE_PASSWORD)
// User account control flags
#define USER_ACCOUNT_DISABLED (0x00000001)
#define USER_HOME_DIRECTORY_REQUIRED (0x00000002)
#define USER_PASSWORD_NOT_REQUIRED (0x00000004)
#define USER_TEMP_DUPLICATE_ACCOUNT (0x00000008)
#define USER_NORMAL_ACCOUNT (0x00000010)
#define USER_MNS_LOGON_ACCOUNT (0x00000020)
#define USER_INTERDOMAIN_TRUST_ACCOUNT (0x00000040)
#define USER_WORKSTATION_TRUST_ACCOUNT (0x00000080)
#define USER_SERVER_TRUST_ACCOUNT (0x00000100)
#define USER_DONT_EXPIRE_PASSWORD (0x00000200)
#define USER_ACCOUNT_AUTO_LOCKED (0x00000400)
#define USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED (0x00000800)
#define USER_SMARTCARD_REQUIRED (0x00001000)
#define USER_TRUSTED_FOR_DELEGATION (0x00002000)
#define USER_NOT_DELEGATED (0x00004000)
#define USER_USE_DES_KEY_ONLY (0x00008000)
#define USER_DONT_REQUIRE_PREAUTH (0x00010000)
#define USER_PASSWORD_EXPIRED (0x00020000)
#define USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (0x00040000)
#define USER_NO_AUTH_DATA_REQUIRED (0x00080000)
#define USER_PARTIAL_SECRETS_ACCOUNT (0x00100000)
#define USER_USE_AES_KEYS (0x00200000)
#define NEXT_FREE_ACCOUNT_CONTROL_BIT (USER_USE_AES_KEYS << 1)
#define USER_MACHINE_ACCOUNT_MASK ( \
USER_INTERDOMAIN_TRUST_ACCOUNT | \
USER_WORKSTATION_TRUST_ACCOUNT | \
USER_SERVER_TRUST_ACCOUNT \
)
#define USER_ACCOUNT_TYPE_MASK ( \
USER_TEMP_DUPLICATE_ACCOUNT | \
USER_NORMAL_ACCOUNT | \
USER_MACHINE_ACCOUNT_MASK \
)
#define USER_COMPUTED_ACCOUNT_CONTROL_BITS ( \
USER_ACCOUNT_AUTO_LOCKED | \
USER_PASSWORD_EXPIRED \
)
// Logon times may be expressed in day, hour, or minute granularity.
#define SAM_DAYS_PER_WEEK (7)
#define SAM_HOURS_PER_WEEK (24 * SAM_DAYS_PER_WEEK)
#define SAM_MINUTES_PER_WEEK (60 * SAM_HOURS_PER_WEEK)
typedef struct _LOGON_HOURS
{
USHORT UnitsPerWeek;
// UnitsPerWeek is the number of equal length time units the week is
// divided into. This value is used to compute the length of the bit
// string in logon_hours. Must be less than or equal to
// SAM_UNITS_PER_WEEK (10080) for this release.
//
// LogonHours is a bit map of valid logon times. Each bit represents
// a unique division in a week. The largest bit map supported is 1260
// bytes (10080 bits), which represents minutes per week. In this case
// the first bit (bit 0, byte 0) is Sunday, 00:00:00 - 00-00:59; bit 1,
// byte 0 is Sunday, 00:01:00 - 00:01:59, etc. A NULL pointer means
// DONT_CHANGE for SamSetInformationUser() calls.
PUCHAR LogonHours;
} LOGON_HOURS, *PLOGON_HOURS;
typedef struct _SR_SECURITY_DESCRIPTOR
{
ULONG Length;
PUCHAR SecurityDescriptor;
} SR_SECURITY_DESCRIPTOR, *PSR_SECURITY_DESCRIPTOR;
// SamQueryInformationUser/SamSetInformationUser types
typedef enum _USER_INFORMATION_CLASS
{
UserGeneralInformation = 1, // q: USER_GENERAL_INFORMATION
UserPreferencesInformation, // q; s: USER_PREFERENCES_INFORMATION
UserLogonInformation, // q: USER_LOGON_INFORMATION
UserLogonHoursInformation, // q; s: USER_LOGON_HOURS_INFORMATION
UserAccountInformation, // q: USER_ACCOUNT_INFORMATION
UserNameInformation, // q; s: USER_NAME_INFORMATION
UserAccountNameInformation, // q; s: USER_ACCOUNT_NAME_INFORMATION