4 lsa interface definition
7 import "misc.idl", "security.idl";
9 [ uuid("12345778-1234-abcd-ef00-0123456789ab"),
11 endpoint("ncacn_np:[\\pipe\\lsarpc]","ncacn_np:[\\pipe\\netlogon]","ncacn_np:[\\pipe\\lsass]", "ncacn_ip_tcp:", "ncalrpc:"),
12 pointer_default(unique),
13 helpstring("Local Security Authority")
16 typedef bitmap security_secinfo security_secinfo;
17 typedef bitmap kerb_EncTypes kerb_EncTypes;
19 typedef [public] struct {
20 [value(2*strlen_m(string))] uint16 length;
21 [value(2*strlen_m(string))] uint16 size;
22 [charset(UTF16),size_is(size/2),length_is(length/2)] uint16 *string;
25 typedef [public] struct {
26 [value(2*strlen_m(string))] uint16 length;
27 [value(2*strlen_m_term(string))] uint16 size;
28 [charset(UTF16),size_is(size/2),length_is(length/2)] uint16 *string;
31 typedef [public] struct {
33 [size_is(count)] lsa_String *names;
36 typedef [public] struct {
37 [value(strlen_m(string))] uint16 length;
38 [value(strlen_m(string))] uint16 size;
39 [charset(DOS),size_is(size),length_is(length)] uint8 *string;
42 typedef [public] struct {
43 [value(strlen_m(string))] uint16 length;
44 [value(strlen_m_term(string))] uint16 size;
45 [charset(DOS),size_is(size),length_is(length)] uint8 *string;
46 } lsa_AsciiStringLarge;
48 typedef [public] struct {
51 [size_is(size/2),length_is(length/2)] uint16 *array;
57 [in,out] policy_handle *handle
63 [public] NTSTATUS lsa_Delete (
64 [in] policy_handle *handle
82 [size_is(count)] lsa_PrivEntry *privs;
85 [public] NTSTATUS lsa_EnumPrivs (
86 [in] policy_handle *handle,
87 [in,out,ref] uint32 *resume_handle,
88 [out,ref] lsa_PrivArray *privs,
94 NTSTATUS lsa_QuerySecurity (
95 [in] policy_handle *handle,
96 [in] security_secinfo sec_info,
97 [out,ref] sec_desc_buf **sdbuf
102 NTSTATUS lsa_SetSecObj(
103 [in] policy_handle *handle,
104 [in] security_secinfo sec_info,
105 [in,ref] sec_desc_buf *sdbuf
110 [todo] NTSTATUS lsa_ChangePassword ();
116 uint32 len; /* ignored */
117 uint16 impersonation_level;
119 uint8 effective_only;
123 uint32 len; /* ignored */
125 [string,charset(UTF16)] uint16 *object_name;
127 security_descriptor *sec_desc;
128 lsa_QosInfo *sec_qos;
129 } lsa_ObjectAttribute;
131 typedef [public,bitmap32bit] bitmap {
132 LSA_POLICY_VIEW_LOCAL_INFORMATION = 0x00000001,
133 LSA_POLICY_VIEW_AUDIT_INFORMATION = 0x00000002,
134 LSA_POLICY_GET_PRIVATE_INFORMATION = 0x00000004,
135 LSA_POLICY_TRUST_ADMIN = 0x00000008,
136 LSA_POLICY_CREATE_ACCOUNT = 0x00000010,
137 LSA_POLICY_CREATE_SECRET = 0x00000020,
138 LSA_POLICY_CREATE_PRIVILEGE = 0x00000040,
139 LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080,
140 LSA_POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100,
141 LSA_POLICY_AUDIT_LOG_ADMIN = 0x00000200,
142 LSA_POLICY_SERVER_ADMIN = 0x00000400,
143 LSA_POLICY_LOOKUP_NAMES = 0x00000800
144 } lsa_PolicyAccessMask;
146 const int LSA_POLICY_ALL_ACCESS =
147 (STANDARD_RIGHTS_REQUIRED_ACCESS |
148 LSA_POLICY_VIEW_LOCAL_INFORMATION |
149 LSA_POLICY_VIEW_AUDIT_INFORMATION |
150 LSA_POLICY_GET_PRIVATE_INFORMATION |
151 LSA_POLICY_TRUST_ADMIN |
152 LSA_POLICY_CREATE_ACCOUNT |
153 LSA_POLICY_CREATE_SECRET |
154 LSA_POLICY_CREATE_PRIVILEGE |
155 LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS |
156 LSA_POLICY_SET_AUDIT_REQUIREMENTS |
157 LSA_POLICY_AUDIT_LOG_ADMIN |
158 LSA_POLICY_SERVER_ADMIN |
159 LSA_POLICY_LOOKUP_NAMES);
161 const int LSA_POLICY_READ =
162 (STANDARD_RIGHTS_READ_ACCESS |
163 LSA_POLICY_VIEW_LOCAL_INFORMATION |
164 LSA_POLICY_VIEW_AUDIT_INFORMATION |
165 LSA_POLICY_GET_PRIVATE_INFORMATION);
167 const int LSA_POLICY_WRITE =
168 (STANDARD_RIGHTS_READ_ACCESS |
169 LSA_POLICY_TRUST_ADMIN |
170 LSA_POLICY_CREATE_ACCOUNT |
171 LSA_POLICY_CREATE_SECRET |
172 LSA_POLICY_CREATE_PRIVILEGE |
173 LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS |
174 LSA_POLICY_SET_AUDIT_REQUIREMENTS |
175 LSA_POLICY_AUDIT_LOG_ADMIN |
176 LSA_POLICY_SERVER_ADMIN);
178 const int LSA_POLICY_EXECUTE =
179 (STANDARD_RIGHTS_EXECUTE_ACCESS |
180 LSA_POLICY_VIEW_LOCAL_INFORMATION |
181 LSA_POLICY_LOOKUP_NAMES);
183 /* notice the screwup with the system_name - thats why MS created
185 [public] NTSTATUS lsa_OpenPolicy (
186 [in,unique] uint16 *system_name,
187 [in] lsa_ObjectAttribute *attr,
188 [in] lsa_PolicyAccessMask access_mask,
189 [out] policy_handle *handle
199 uint32 maximum_log_size;
200 hyper retention_time;
201 uint8 shutdown_in_progress;
202 hyper time_to_shutdown;
203 uint32 next_audit_record;
206 typedef [v1_enum] enum {
207 LSA_AUDIT_POLICY_NONE=0,
208 LSA_AUDIT_POLICY_SUCCESS=1,
209 LSA_AUDIT_POLICY_FAILURE=2,
210 LSA_AUDIT_POLICY_ALL=(LSA_AUDIT_POLICY_SUCCESS|LSA_AUDIT_POLICY_FAILURE),
211 LSA_AUDIT_POLICY_CLEAR=4
212 } lsa_PolicyAuditPolicy;
215 LSA_AUDIT_CATEGORY_SYSTEM = 0,
216 LSA_AUDIT_CATEGORY_LOGON = 1,
217 LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS = 2,
218 LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS = 3,
219 LSA_AUDIT_CATEGORY_PROCCESS_TRACKING = 4,
220 LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES = 5,
221 LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT = 6,
222 LSA_AUDIT_CATEGORY_DIRECTORY_SERVICE_ACCESS = 7, /* only in win2k/2k3 */
223 LSA_AUDIT_CATEGORY_ACCOUNT_LOGON = 8 /* only in win2k/2k3 */
224 } lsa_PolicyAuditEventType;
227 uint32 auditing_mode;
228 [size_is(count)] lsa_PolicyAuditPolicy *settings;
230 } lsa_AuditEventsInfo;
233 lsa_StringLarge name;
241 typedef [v1_enum] enum {
253 } lsa_ReplicaSourceInfo;
257 uint32 non_paged_pool;
262 } lsa_DefaultQuotaInfo;
266 NTTIME_hyper db_create_time;
267 } lsa_ModificationInfo;
270 uint8 shutdown_on_full;
271 } lsa_AuditFullSetInfo;
274 uint8 shutdown_on_full;
276 } lsa_AuditFullQueryInfo;
279 /* it's important that we use the lsa_StringLarge here,
280 * because otherwise windows clients result with such dns hostnames
281 * e.g. w2k3-client.samba4.samba.orgsamba4.samba.org
283 * w2k3-client.samba4.samba.org
285 lsa_StringLarge name;
286 lsa_StringLarge dns_domain;
287 lsa_StringLarge dns_forest;
293 LSA_POLICY_INFO_AUDIT_LOG=1,
294 LSA_POLICY_INFO_AUDIT_EVENTS=2,
295 LSA_POLICY_INFO_DOMAIN=3,
296 LSA_POLICY_INFO_PD=4,
297 LSA_POLICY_INFO_ACCOUNT_DOMAIN=5,
298 LSA_POLICY_INFO_ROLE=6,
299 LSA_POLICY_INFO_REPLICA=7,
300 LSA_POLICY_INFO_QUOTA=8,
301 LSA_POLICY_INFO_MOD=9,
302 LSA_POLICY_INFO_AUDIT_FULL_SET=10,
303 LSA_POLICY_INFO_AUDIT_FULL_QUERY=11,
304 LSA_POLICY_INFO_DNS=12,
305 LSA_POLICY_INFO_DNS_INT=13,
306 LSA_POLICY_INFO_L_ACCOUNT_DOMAIN=14
309 typedef [switch_type(uint16)] union {
310 [case(LSA_POLICY_INFO_AUDIT_LOG)] lsa_AuditLogInfo audit_log;
311 [case(LSA_POLICY_INFO_AUDIT_EVENTS)] lsa_AuditEventsInfo audit_events;
312 [case(LSA_POLICY_INFO_DOMAIN)] lsa_DomainInfo domain;
313 [case(LSA_POLICY_INFO_PD)] lsa_PDAccountInfo pd;
314 [case(LSA_POLICY_INFO_ACCOUNT_DOMAIN)] lsa_DomainInfo account_domain;
315 [case(LSA_POLICY_INFO_ROLE)] lsa_ServerRole role;
316 [case(LSA_POLICY_INFO_REPLICA)] lsa_ReplicaSourceInfo replica;
317 [case(LSA_POLICY_INFO_QUOTA)] lsa_DefaultQuotaInfo quota;
318 [case(LSA_POLICY_INFO_MOD)] lsa_ModificationInfo mod;
319 [case(LSA_POLICY_INFO_AUDIT_FULL_SET)] lsa_AuditFullSetInfo auditfullset;
320 [case(LSA_POLICY_INFO_AUDIT_FULL_QUERY)] lsa_AuditFullQueryInfo auditfullquery;
321 [case(LSA_POLICY_INFO_DNS)] lsa_DnsDomainInfo dns;
322 [case(LSA_POLICY_INFO_DNS_INT)] lsa_DnsDomainInfo dns;
323 [case(LSA_POLICY_INFO_L_ACCOUNT_DOMAIN)] lsa_DomainInfo l_account_domain;
324 } lsa_PolicyInformation;
326 NTSTATUS lsa_QueryInfoPolicy(
327 [in] policy_handle *handle,
328 [in] lsa_PolicyInfo level,
329 [out,ref,switch_is(level)] lsa_PolicyInformation **info
334 NTSTATUS lsa_SetInfoPolicy (
335 [in] policy_handle *handle,
336 [in] lsa_PolicyInfo level,
337 [in,switch_is(level)] lsa_PolicyInformation *info
342 [todo] NTSTATUS lsa_ClearAuditLog ();
346 [public] NTSTATUS lsa_CreateAccount (
347 [in] policy_handle *handle,
348 [in,ref] dom_sid2 *sid,
349 [in] uint32 access_mask,
350 [out] policy_handle *acct_handle
354 /* NOTE: This only returns accounts that have at least
362 typedef [public] struct {
363 [range(0,1000)] uint32 num_sids;
364 [size_is(num_sids)] lsa_SidPtr *sids;
367 [public] NTSTATUS lsa_EnumAccounts(
368 [in] policy_handle *handle,
369 [in,out,ref] uint32 *resume_handle,
370 [out,ref] lsa_SidArray *sids,
371 [in,range(0,8192)] uint32 num_entries
374 /*************************************************/
377 [public] NTSTATUS lsa_CreateTrustedDomain(
378 [in] policy_handle *policy_handle,
379 [in] lsa_DomainInfo *info,
380 [in] uint32 access_mask,
381 [out] policy_handle *trustdom_handle
388 /* w2k3 treats max_size as max_domains*60 */
389 const int LSA_ENUM_TRUST_DOMAIN_MULTIPLIER = 60;
393 [size_is(count)] lsa_DomainInfo *domains;
396 NTSTATUS lsa_EnumTrustDom(
397 [in] policy_handle *handle,
398 [in,out,ref] uint32 *resume_handle,
399 [out,ref] lsa_DomainList *domains,
406 typedef [public] enum {
407 SID_NAME_USE_NONE = 0,/* NOTUSED */
408 SID_NAME_USER = 1, /* user */
409 SID_NAME_DOM_GRP = 2, /* domain group */
410 SID_NAME_DOMAIN = 3, /* domain: don't know what this is */
411 SID_NAME_ALIAS = 4, /* local group */
412 SID_NAME_WKN_GRP = 5, /* well-known group */
413 SID_NAME_DELETED = 6, /* deleted account: needed for c2 rating */
414 SID_NAME_INVALID = 7, /* invalid account */
415 SID_NAME_UNKNOWN = 8, /* oops. */
416 SID_NAME_COMPUTER = 9 /* machine */
420 lsa_SidType sid_type;
426 [range(0,1000)] uint32 count;
427 [size_is(count)] lsa_TranslatedSid *sids;
430 const int LSA_REF_DOMAIN_LIST_MULTIPLIER = 32;
432 [range(0,1000)] uint32 count;
433 [size_is(count)] lsa_DomainInfo *domains;
437 /* Level 1: Ask everywhere
438 * Level 2: Ask domain and trusted domains, no builtin and wkn
439 * Level 3: Only ask domain
440 * Level 4: W2k3ad: Only ask AD trusts
441 * Level 5: Only ask transitive forest trusts
446 LSA_LOOKUP_NAMES_ALL = 1,
447 LSA_LOOKUP_NAMES_DOMAINS_ONLY = 2,
448 LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY = 3,
449 LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY = 4,
450 LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY = 5,
451 LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 = 6,
452 LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC = 7
453 } lsa_LookupNamesLevel;
455 [public] NTSTATUS lsa_LookupNames (
456 [in] policy_handle *handle,
457 [in,range(0,1000)] uint32 num_names,
458 [in,size_is(num_names)] lsa_String names[],
459 [out,ref] lsa_RefDomainList **domains,
460 [in,out,ref] lsa_TransSidArray *sids,
461 [in] lsa_LookupNamesLevel level,
462 [in,out,ref] uint32 *count
470 lsa_SidType sid_type;
473 } lsa_TranslatedName;
476 [range(0,1000)] uint32 count;
477 [size_is(count)] lsa_TranslatedName *names;
478 } lsa_TransNameArray;
480 [public] NTSTATUS lsa_LookupSids(
481 [in] policy_handle *handle,
482 [in,ref] lsa_SidArray *sids,
483 [out,ref] lsa_RefDomainList **domains,
484 [in,out,ref] lsa_TransNameArray *names,
486 [in,out,ref] uint32 *count
491 [public] NTSTATUS lsa_CreateSecret(
492 [in] policy_handle *handle,
493 [in] lsa_String name,
494 [in] uint32 access_mask,
495 [out] policy_handle *sec_handle
499 /*****************************************/
501 NTSTATUS lsa_OpenAccount(
502 [in] policy_handle *handle,
503 [in,ref] dom_sid2 *sid,
504 [in] uint32 access_mask,
505 [out] policy_handle *acct_handle
509 /****************************************/
518 [range(0,1000)] uint32 count;
520 [size_is(count)] lsa_LUIDAttribute set[*];
523 NTSTATUS lsa_EnumPrivsAccount(
524 [in] policy_handle *handle,
525 [out,ref] lsa_PrivilegeSet **privs
529 /****************************************/
531 NTSTATUS lsa_AddPrivilegesToAccount(
532 [in] policy_handle *handle,
533 [in,ref] lsa_PrivilegeSet *privs
537 /****************************************/
539 NTSTATUS lsa_RemovePrivilegesFromAccount(
540 [in] policy_handle *handle,
541 [in] uint8 remove_all,
542 [in,unique] lsa_PrivilegeSet *privs
546 [todo] NTSTATUS lsa_GetQuotasForAccount();
549 [todo] NTSTATUS lsa_SetQuotasForAccount();
551 typedef [bitmap32bit] bitmap {
552 LSA_POLICY_MODE_INTERACTIVE = 0x00000001,
553 LSA_POLICY_MODE_NETWORK = 0x00000002,
554 LSA_POLICY_MODE_BATCH = 0x00000004,
555 LSA_POLICY_MODE_SERVICE = 0x00000010,
556 LSA_POLICY_MODE_PROXY = 0x00000020,
557 LSA_POLICY_MODE_DENY_INTERACTIVE = 0x00000040,
558 LSA_POLICY_MODE_DENY_NETWORK = 0x00000080,
559 LSA_POLICY_MODE_DENY_BATCH = 0x00000100,
560 LSA_POLICY_MODE_DENY_SERVICE = 0x00000200,
561 LSA_POLICY_MODE_REMOTE_INTERACTIVE = 0x00000400,
562 LSA_POLICY_MODE_DENY_REMOTE_INTERACTIVE = 0x00000800,
563 LSA_POLICY_MODE_ALL = 0x00000FF7,
564 LSA_POLICY_MODE_ALL_NT4 = 0x00000037
565 } lsa_SystemAccessModeFlags;
568 NTSTATUS lsa_GetSystemAccessAccount(
569 [in] policy_handle *handle,
570 [out,ref] uint32 *access_mask
574 NTSTATUS lsa_SetSystemAccessAccount(
575 [in] policy_handle *handle,
576 [in] uint32 access_mask
580 NTSTATUS lsa_OpenTrustedDomain(
581 [in] policy_handle *handle,
583 [in] uint32 access_mask,
584 [out] policy_handle *trustdom_handle
587 typedef [flag(NDR_PAHEX)] struct {
590 [size_is(size),length_is(length)] uint8 *data;
593 typedef [flag(NDR_PAHEX)] struct {
594 [range(0,65536)] uint32 size;
595 [size_is(size)] uint8 *data;
599 LSA_TRUSTED_DOMAIN_INFO_NAME = 1,
600 LSA_TRUSTED_DOMAIN_INFO_CONTROLLERS = 2,
601 LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET = 3,
602 LSA_TRUSTED_DOMAIN_INFO_PASSWORD = 4,
603 LSA_TRUSTED_DOMAIN_INFO_BASIC = 5,
604 LSA_TRUSTED_DOMAIN_INFO_INFO_EX = 6,
605 LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO = 7,
606 LSA_TRUSTED_DOMAIN_INFO_FULL_INFO = 8,
607 LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL = 9,
608 LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL = 10,
609 LSA_TRUSTED_DOMAIN_INFO_INFO_EX2_INTERNAL = 11,
610 LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL = 12,
611 LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRTYPION_TYPES = 13
612 } lsa_TrustDomInfoEnum;
614 typedef [public,bitmap32bit] bitmap {
615 LSA_TRUST_DIRECTION_INBOUND = 0x00000001,
616 LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002
617 } lsa_TrustDirection;
619 typedef [v1_enum] enum {
620 LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001,
621 LSA_TRUST_TYPE_UPLEVEL = 0x00000002,
622 LSA_TRUST_TYPE_MIT = 0x00000003
625 typedef [public,bitmap32bit] bitmap {
626 LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE = 0x00000001,
627 LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY = 0x00000002,
628 LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN = 0x00000004,
629 LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE = 0x00000008,
630 LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION = 0x00000010,
631 LSA_TRUST_ATTRIBUTE_WITHIN_FOREST = 0x00000020,
632 LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL = 0x00000040,
633 LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION = 0x00000080
634 } lsa_TrustAttributes;
637 lsa_StringLarge netbios_name;
638 } lsa_TrustDomainInfoName;
643 [size_is(entries)] lsa_StringLarge *netbios_names;
644 } lsa_TrustDomainInfoControllers;
648 } lsa_TrustDomainInfoPosixOffset;
651 lsa_DATA_BUF *password;
652 lsa_DATA_BUF *old_password;
653 } lsa_TrustDomainInfoPassword;
656 lsa_String netbios_name;
658 } lsa_TrustDomainInfoBasic;
661 lsa_StringLarge domain_name;
662 lsa_StringLarge netbios_name;
664 lsa_TrustDirection trust_direction;
665 lsa_TrustType trust_type;
666 lsa_TrustAttributes trust_attributes;
667 } lsa_TrustDomainInfoInfoEx;
669 typedef [public,v1_enum] enum {
670 TRUST_AUTH_TYPE_NONE = 0,
671 TRUST_AUTH_TYPE_NT4OWF = 1,
672 TRUST_AUTH_TYPE_CLEAR = 2,
673 TRUST_AUTH_TYPE_VERSION = 3
677 NTTIME_hyper last_update_time;
678 lsa_TrustAuthType AuthType;
680 } lsa_TrustDomainInfoBuffer;
683 uint32 incoming_count;
684 lsa_TrustDomainInfoBuffer *incoming_current_auth_info;
685 lsa_TrustDomainInfoBuffer *incoming_previous_auth_info;
686 uint32 outgoing_count;
687 lsa_TrustDomainInfoBuffer *outgoing_current_auth_info;
688 lsa_TrustDomainInfoBuffer *outgoing_previous_auth_info;
689 } lsa_TrustDomainInfoAuthInfo;
692 lsa_TrustDomainInfoInfoEx info_ex;
693 lsa_TrustDomainInfoPosixOffset posix_offset;
694 lsa_TrustDomainInfoAuthInfo auth_info;
695 } lsa_TrustDomainInfoFullInfo;
698 lsa_DATA_BUF2 auth_blob;
699 } lsa_TrustDomainInfoAuthInfoInternal;
702 lsa_TrustDomainInfoInfoEx info_ex;
703 lsa_TrustDomainInfoPosixOffset posix_offset;
704 lsa_TrustDomainInfoAuthInfoInternal auth_info;
705 } lsa_TrustDomainInfoFullInfoInternal;
708 lsa_TrustDomainInfoInfoEx info_ex;
709 uint32 forest_trust_length;
710 [size_is(forest_trust_length)] uint8 *forest_trust_data;
711 } lsa_TrustDomainInfoInfoEx2Internal;
714 lsa_TrustDomainInfoInfoEx2Internal info;
715 lsa_TrustDomainInfoPosixOffset posix_offset;
716 lsa_TrustDomainInfoAuthInfo auth_info;
717 } lsa_TrustDomainInfoFullInfo2Internal;
720 kerb_EncTypes enc_types;
721 } lsa_TrustDomainInfoSupportedEncTypes;
723 typedef [switch_type(lsa_TrustDomInfoEnum)] union {
724 [case(LSA_TRUSTED_DOMAIN_INFO_NAME)]
725 lsa_TrustDomainInfoName name;
726 [case(LSA_TRUSTED_DOMAIN_INFO_CONTROLLERS)]
727 lsa_TrustDomainInfoControllers controllers;
728 [case(LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET)]
729 lsa_TrustDomainInfoPosixOffset posix_offset;
730 [case(LSA_TRUSTED_DOMAIN_INFO_PASSWORD)]
731 lsa_TrustDomainInfoPassword password;
732 [case(LSA_TRUSTED_DOMAIN_INFO_BASIC)]
733 lsa_TrustDomainInfoBasic info_basic;
734 [case(LSA_TRUSTED_DOMAIN_INFO_INFO_EX)]
735 lsa_TrustDomainInfoInfoEx info_ex;
736 [case(LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO)]
737 lsa_TrustDomainInfoAuthInfo auth_info;
738 [case(LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)]
739 lsa_TrustDomainInfoFullInfo full_info;
740 [case(LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL)]
741 lsa_TrustDomainInfoAuthInfoInternal auth_info_internal;
742 [case(LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL)]
743 lsa_TrustDomainInfoFullInfoInternal full_info_internal;
744 [case(LSA_TRUSTED_DOMAIN_INFO_INFO_EX2_INTERNAL)]
745 lsa_TrustDomainInfoInfoEx2Internal info_ex2_internal;
746 [case(LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL)]
747 lsa_TrustDomainInfoFullInfo2Internal full_info2_internal;
748 [case(LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRTYPION_TYPES)]
749 lsa_TrustDomainInfoSupportedEncTypes enc_types;
750 } lsa_TrustedDomainInfo;
753 NTSTATUS lsa_QueryTrustedDomainInfo(
754 [in] policy_handle *trustdom_handle,
755 [in] lsa_TrustDomInfoEnum level,
756 [out,switch_is(level),ref] lsa_TrustedDomainInfo **info
760 NTSTATUS lsa_SetInformationTrustedDomain(
761 [in] policy_handle *trustdom_handle,
762 [in] lsa_TrustDomInfoEnum level,
763 [in,switch_is(level)] lsa_TrustedDomainInfo *info
767 [public] NTSTATUS lsa_OpenSecret(
768 [in] policy_handle *handle,
769 [in] lsa_String name,
770 [in] uint32 access_mask,
771 [out] policy_handle *sec_handle
776 [public] NTSTATUS lsa_SetSecret(
777 [in] policy_handle *sec_handle,
778 [in,unique] lsa_DATA_BUF *new_val,
779 [in,unique] lsa_DATA_BUF *old_val
787 [public] NTSTATUS lsa_QuerySecret (
788 [in] policy_handle *sec_handle,
789 [in,out,unique] lsa_DATA_BUF_PTR *new_val,
790 [in,out,unique] NTTIME_hyper *new_mtime,
791 [in,out,unique] lsa_DATA_BUF_PTR *old_val,
792 [in,out,unique] NTTIME_hyper *old_mtime
796 NTSTATUS lsa_LookupPrivValue(
797 [in] policy_handle *handle,
798 [in,ref] lsa_String *name,
799 [out,ref] lsa_LUID *luid
804 NTSTATUS lsa_LookupPrivName(
805 [in] policy_handle *handle,
806 [in,ref] lsa_LUID *luid,
807 [out,ref] lsa_StringLarge **name
811 /*******************/
813 NTSTATUS lsa_LookupPrivDisplayName(
814 [in] policy_handle *handle,
815 [in,ref] lsa_String *name,
816 [in] uint16 language_id,
817 [in] uint16 language_id_sys,
818 [out,ref] lsa_StringLarge **disp_name,
819 /* see http://www.microsoft.com/globaldev/nlsweb/ for
820 language definitions */
821 [out,ref] uint16 *returned_language_id
824 /*******************/
826 NTSTATUS lsa_DeleteObject (
827 [in,out] policy_handle *handle
830 /*******************/
832 NTSTATUS lsa_EnumAccountsWithUserRight (
833 [in] policy_handle *handle,
834 [in,unique] lsa_String *name,
835 [out] lsa_SidArray *sids
840 [string,charset(UTF16)] uint16 *name;
841 } lsa_RightAttribute;
844 [range(0,256)] uint32 count;
845 [size_is(count)] lsa_StringLarge *names;
848 NTSTATUS lsa_EnumAccountRights (
849 [in] policy_handle *handle,
850 [in,ref] dom_sid2 *sid,
851 [out,ref] lsa_RightSet *rights
855 /**********************/
857 NTSTATUS lsa_AddAccountRights (
858 [in] policy_handle *handle,
859 [in,ref] dom_sid2 *sid,
860 [in,ref] lsa_RightSet *rights
863 /**********************/
865 NTSTATUS lsa_RemoveAccountRights (
866 [in] policy_handle *handle,
867 [in,ref] dom_sid2 *sid,
868 [in] uint8 remove_all,
869 [in,ref] lsa_RightSet *rights
873 NTSTATUS lsa_QueryTrustedDomainInfoBySid(
874 [in] policy_handle *handle,
875 [in,ref] dom_sid2 *dom_sid,
876 [in] lsa_TrustDomInfoEnum level,
877 [out,switch_is(level),ref] lsa_TrustedDomainInfo **info
881 NTSTATUS lsa_SetTrustedDomainInfo(
882 [in] policy_handle *handle,
883 [in] dom_sid2 *dom_sid,
884 [in] lsa_TrustDomInfoEnum level,
885 [in,switch_is(level)] lsa_TrustedDomainInfo *info
889 NTSTATUS lsa_DeleteTrustedDomain(
890 [in] policy_handle *handle,
891 [in] dom_sid2 *dom_sid
895 [todo] NTSTATUS lsa_StorePrivateData();
897 [todo] NTSTATUS lsa_RetrievePrivateData();
900 /**********************/
902 [public] NTSTATUS lsa_OpenPolicy2 (
903 [in,unique] [string,charset(UTF16)] uint16 *system_name,
904 [in] lsa_ObjectAttribute *attr,
905 [in] lsa_PolicyAccessMask access_mask,
906 [out] policy_handle *handle
909 /**********************/
911 NTSTATUS lsa_GetUserName(
912 [in,unique] [string,charset(UTF16)] uint16 *system_name,
913 [in,out,ref] lsa_String **account_name,
914 [in,out,unique] lsa_String **authority_name
917 /**********************/
920 NTSTATUS lsa_QueryInfoPolicy2(
921 [in] policy_handle *handle,
922 [in] lsa_PolicyInfo level,
923 [out,ref,switch_is(level)] lsa_PolicyInformation **info
927 NTSTATUS lsa_SetInfoPolicy2(
928 [in] policy_handle *handle,
929 [in] lsa_PolicyInfo level,
930 [in,switch_is(level)] lsa_PolicyInformation *info
933 /**********************/
935 NTSTATUS lsa_QueryTrustedDomainInfoByName(
936 [in] policy_handle *handle,
937 [in,ref] lsa_String *trusted_domain,
938 [in] lsa_TrustDomInfoEnum level,
939 [out,ref,switch_is(level)] lsa_TrustedDomainInfo **info
942 /**********************/
944 NTSTATUS lsa_SetTrustedDomainInfoByName(
945 [in] policy_handle *handle,
946 [in] lsa_String trusted_domain,
947 [in] lsa_TrustDomInfoEnum level,
948 [in,unique,switch_is(level)] lsa_TrustedDomainInfo *info
953 /* w2k3 treats max_size as max_domains*82 */
954 const int LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER = 82;
958 [size_is(count)] lsa_TrustDomainInfoInfoEx *domains;
961 NTSTATUS lsa_EnumTrustedDomainsEx (
962 [in] policy_handle *handle,
963 [in,out] uint32 *resume_handle,
964 [out] lsa_DomainListEx *domains,
969 NTSTATUS lsa_CreateTrustedDomainEx(
970 [in] policy_handle *policy_handle,
971 [in] lsa_TrustDomainInfoInfoEx *info,
972 [in] lsa_TrustDomainInfoAuthInfoInternal *auth_info,
973 [in] uint32 access_mask,
974 [out] policy_handle *trustdom_handle
979 NTSTATUS lsa_CloseTrustedDomainEx(
980 [in,out] policy_handle *handle
985 /* w2k3 returns either 0x000bbbd000000000 or 0x000a48e800000000
988 uint32 enforce_restrictions;
989 hyper service_tkt_lifetime;
990 hyper user_tkt_lifetime;
991 hyper user_tkt_renewaltime;
994 } lsa_DomainInfoKerberos;
998 [size_is(blob_size)] uint8 *efs_blob;
1002 LSA_DOMAIN_INFO_POLICY_EFS=2,
1003 LSA_DOMAIN_INFO_POLICY_KERBEROS=3
1004 } lsa_DomainInfoEnum;
1006 typedef [switch_type(uint16)] union {
1007 [case(LSA_DOMAIN_INFO_POLICY_EFS)] lsa_DomainInfoEfs efs_info;
1008 [case(LSA_DOMAIN_INFO_POLICY_KERBEROS)] lsa_DomainInfoKerberos kerberos_info;
1009 } lsa_DomainInformationPolicy;
1011 NTSTATUS lsa_QueryDomainInformationPolicy(
1012 [in] policy_handle *handle,
1014 [out,ref,switch_is(level)] lsa_DomainInformationPolicy **info
1018 NTSTATUS lsa_SetDomainInformationPolicy(
1019 [in] policy_handle *handle,
1021 [in,unique,switch_is(level)] lsa_DomainInformationPolicy *info
1024 /**********************/
1026 NTSTATUS lsa_OpenTrustedDomainByName(
1027 [in] policy_handle *handle,
1028 [in] lsa_String name,
1029 [in] uint32 access_mask,
1030 [out] policy_handle *trustdom_handle
1034 [todo] NTSTATUS lsa_TestCall();
1036 /**********************/
1040 lsa_SidType sid_type;
1044 } lsa_TranslatedName2;
1047 [range(0,1000)] uint32 count;
1048 [size_is(count)] lsa_TranslatedName2 *names;
1049 } lsa_TransNameArray2;
1051 [public] NTSTATUS lsa_LookupSids2(
1052 [in] policy_handle *handle,
1053 [in,ref] lsa_SidArray *sids,
1054 [out,ref] lsa_RefDomainList **domains,
1055 [in,out,ref] lsa_TransNameArray2 *names,
1057 [in,out,ref] uint32 *count,
1058 [in] uint32 unknown1,
1059 [in] uint32 unknown2
1062 /**********************/
1066 lsa_SidType sid_type;
1070 } lsa_TranslatedSid2;
1073 [range(0,1000)] uint32 count;
1074 [size_is(count)] lsa_TranslatedSid2 *sids;
1075 } lsa_TransSidArray2;
1077 [public] NTSTATUS lsa_LookupNames2 (
1078 [in] policy_handle *handle,
1079 [in,range(0,1000)] uint32 num_names,
1080 [in,size_is(num_names)] lsa_String names[],
1081 [out,ref] lsa_RefDomainList **domains,
1082 [in,out,ref] lsa_TransSidArray2 *sids,
1083 [in] lsa_LookupNamesLevel level,
1084 [in,out,ref] uint32 *count,
1085 [in] uint32 lookup_options,
1086 [in] uint32 client_revision /* LSA_CLIENT_REVISION* */
1090 NTSTATUS lsa_CreateTrustedDomainEx2(
1091 [in] policy_handle *policy_handle,
1092 [in] lsa_TrustDomainInfoInfoEx *info,
1093 [in] lsa_TrustDomainInfoAuthInfoInternal *auth_info,
1094 [in] uint32 access_mask,
1095 [out] policy_handle *trustdom_handle
1099 [todo] NTSTATUS lsa_CREDRWRITE();
1102 [todo] NTSTATUS lsa_CREDRREAD();
1105 [todo] NTSTATUS lsa_CREDRENUMERATE();
1108 [todo] NTSTATUS lsa_CREDRWRITEDOMAINCREDENTIALS();
1111 [todo] NTSTATUS lsa_CREDRREADDOMAINCREDENTIALS();
1114 [todo] NTSTATUS lsa_CREDRDELETE();
1117 [todo] NTSTATUS lsa_CREDRGETTARGETINFO();
1120 [todo] NTSTATUS lsa_CREDRPROFILELOADED();
1122 /**********************/
1125 lsa_SidType sid_type;
1129 } lsa_TranslatedSid3;
1132 [range(0,1000)] uint32 count;
1133 [size_is(count)] lsa_TranslatedSid3 *sids;
1134 } lsa_TransSidArray3;
1136 [public] NTSTATUS lsa_LookupNames3 (
1137 [in] policy_handle *handle,
1138 [in,range(0,1000)] uint32 num_names,
1139 [in,size_is(num_names)] lsa_String names[],
1140 [out,ref] lsa_RefDomainList **domains,
1141 [in,out,ref] lsa_TransSidArray3 *sids,
1142 [in] lsa_LookupNamesLevel level,
1143 [in,out,ref] uint32 *count,
1144 [in] uint32 lookup_options,
1145 [in] uint32 client_revision /* LSA_CLIENT_REVISION* */
1149 [todo] NTSTATUS lsa_CREDRGETSESSIONTYPES();
1152 [todo] NTSTATUS lsa_LSARREGISTERAUDITEVENT();
1155 [todo] NTSTATUS lsa_LSARGENAUDITEVENT();
1158 [todo] NTSTATUS lsa_LSARUNREGISTERAUDITEVENT();
1162 [range(0,131072)] uint32 length;
1163 [size_is(length)] uint8 *data;
1164 } lsa_ForestTrustBinaryData;
1167 dom_sid2 *domain_sid;
1168 lsa_StringLarge dns_domain_name;
1169 lsa_StringLarge netbios_domain_name;
1170 } lsa_ForestTrustDomainInfo;
1172 typedef [switch_type(uint32)] union {
1173 [case(LSA_FOREST_TRUST_TOP_LEVEL_NAME)] lsa_String top_level_name;
1174 [case(LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX)] lsa_StringLarge top_level_name_ex;
1175 [case(LSA_FOREST_TRUST_DOMAIN_INFO)] lsa_ForestTrustDomainInfo domain_info;
1176 [default] lsa_ForestTrustBinaryData data;
1177 } lsa_ForestTrustData;
1179 typedef [v1_enum] enum {
1180 LSA_FOREST_TRUST_TOP_LEVEL_NAME = 0,
1181 LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX = 1,
1182 LSA_FOREST_TRUST_DOMAIN_INFO = 2,
1183 LSA_FOREST_TRUST_RECORD_TYPE_LAST = 3
1184 } lsa_ForestTrustRecordType;
1188 lsa_ForestTrustRecordType level;
1190 [switch_is(level)] lsa_ForestTrustData forest_trust_data;
1191 } lsa_ForestTrustRecord;
1193 typedef [public] struct {
1194 [range(0,4000)] uint32 count;
1195 [size_is(count)] lsa_ForestTrustRecord **entries;
1196 } lsa_ForestTrustInformation;
1198 NTSTATUS lsa_lsaRQueryForestTrustInformation(
1199 [in] policy_handle *handle,
1200 [in,ref] lsa_String *trusted_domain_name,
1201 [in] uint16 unknown, /* level ? */
1202 [out,ref] lsa_ForestTrustInformation **forest_trust_info
1206 [todo] NTSTATUS lsa_LSARSETFORESTTRUSTINFORMATION();
1209 [todo] NTSTATUS lsa_CREDRRENAME();
1214 [public] NTSTATUS lsa_LookupSids3(
1215 [in,ref] lsa_SidArray *sids,
1216 [out,ref] lsa_RefDomainList **domains,
1217 [in,out,ref] lsa_TransNameArray2 *names,
1219 [in,out,ref] uint32 *count,
1220 [in] uint32 unknown1,
1221 [in] uint32 unknown2
1224 const int LSA_CLIENT_REVISION_NO_DNS = 0x00000001;
1225 const int LSA_CLIENT_REVISION_DNS = 0x00000002;
1227 const int LSA_LOOKUP_OPTIONS_NO_ISOLATED = 0x80000000;
1230 NTSTATUS lsa_LookupNames4(
1231 [in,range(0,1000)] uint32 num_names,
1232 [in,size_is(num_names)] lsa_String names[],
1233 [out,ref] lsa_RefDomainList **domains,
1234 [in,out,ref] lsa_TransSidArray3 *sids,
1235 [in] lsa_LookupNamesLevel level,
1236 [in,out,ref] uint32 *count,
1237 [in] uint32 lookup_options,
1238 [in] uint32 client_revision /* LSA_CLIENT_REVISION* */
1242 [todo] NTSTATUS lsa_LSAROPENPOLICYSCE();
1245 [todo] NTSTATUS lsa_LSARADTREGISTERSECURITYEVENTSOURCE();
1248 [todo] NTSTATUS lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE();
1251 [todo] NTSTATUS lsa_LSARADTREPORTSECURITYEVENT();