samsrv.h File Reference

#include <stdio.h>
#include <stdlib.h>
#include <windef.h>
#include <winbase.h>
#include <winreg.h>
#include <ndk/kefuncs.h>
#include <ndk/obfuncs.h>
#include <ndk/rtlfuncs.h>
#include <ddk/ntsam.h>
#include <sddl.h>
#include <sam_s.h>
#include <wine/debug.h>

Include dependency graph for samsrv.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_SAM_DB_OBJECT
struct	_SAM_ALIAS_FIXED_DATA
struct	_SAM_DOMAIN_FIXED_DATA
struct	_SAM_GROUP_FIXED_DATA
struct	_SAM_USER_FIXED_DATA

Macros
#define	WIN32_NO_STATUS
#define	_INC_WINDOWS
#define	COM_NO_WINDOWS_H
#define	NTOS_MODE_USER
#define	SAMP_DB_SIGNATURE   0x87654321

Typedefs
typedef enum _SAM_DB_OBJECT_TYPE	SAM_DB_OBJECT_TYPE
typedef struct _SAM_DB_OBJECT	SAM_DB_OBJECT
typedef struct _SAM_DB_OBJECT *	PSAM_DB_OBJECT
typedef struct _SAM_ALIAS_FIXED_DATA	SAM_ALIAS_FIXED_DATA
typedef struct _SAM_ALIAS_FIXED_DATA *	PSAM_ALIAS_FIXED_DATA
typedef struct _SAM_DOMAIN_FIXED_DATA	SAM_DOMAIN_FIXED_DATA
typedef struct _SAM_DOMAIN_FIXED_DATA *	PSAM_DOMAIN_FIXED_DATA
typedef struct _SAM_GROUP_FIXED_DATA	SAM_GROUP_FIXED_DATA
typedef struct _SAM_GROUP_FIXED_DATA *	PSAM_GROUP_FIXED_DATA
typedef struct _SAM_USER_FIXED_DATA	SAM_USER_FIXED_DATA
typedef struct _SAM_USER_FIXED_DATA *	PSAM_USER_FIXED_DATA

Enumerations
enum	_SAM_DB_OBJECT_TYPE {   SamDbIgnoreObject, SamDbServerObject, SamDbDomainObject, SamDbAliasObject,   SamDbGroupObject, SamDbUserObject }

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (samsrv)
NTSTATUS	SampOpenAliasObject (IN PSAM_DB_OBJECT DomainObject, IN ULONG AliasId, IN ACCESS_MASK DesiredAccess, OUT PSAM_DB_OBJECT *AliasObject)
NTSTATUS	SampAddMemberToAlias (IN PSAM_DB_OBJECT AliasObject, IN PRPC_SID MemberId)
NTSTATUS NTAPI	SampRemoveMemberFromAlias (IN PSAM_DB_OBJECT AliasObject, IN PRPC_SID MemberId)
NTSTATUS	SampGetMembersInAlias (IN PSAM_DB_OBJECT AliasObject, OUT PULONG MemberCount, OUT PSAMPR_SID_INFORMATION *MemberArray)
NTSTATUS	SampRemoveAllMembersFromAlias (IN PSAM_DB_OBJECT AliasObject)
NTSTATUS	SampInitDatabase (VOID)
NTSTATUS	SampCreateDbObject (IN PSAM_DB_OBJECT ParentObject, IN LPWSTR ContainerName, IN LPWSTR ObjectName, IN ULONG RelativeId, IN SAM_DB_OBJECT_TYPE ObjectType, IN ACCESS_MASK DesiredAccess, OUT PSAM_DB_OBJECT *DbObject)
NTSTATUS	SampOpenDbObject (IN PSAM_DB_OBJECT ParentObject, IN LPWSTR ContainerName, IN LPWSTR ObjectName, IN ULONG RelativeId, IN SAM_DB_OBJECT_TYPE ObjectType, IN ACCESS_MASK DesiredAccess, OUT PSAM_DB_OBJECT *DbObject)
NTSTATUS	SampValidateDbObject (SAMPR_HANDLE Handle, SAM_DB_OBJECT_TYPE ObjectType, ACCESS_MASK DesiredAccess, PSAM_DB_OBJECT *DbObject)
NTSTATUS	SampCloseDbObject (PSAM_DB_OBJECT DbObject)
NTSTATUS	SampDeleteAccountDbObject (PSAM_DB_OBJECT DbObject)
NTSTATUS	SampSetObjectAttribute (PSAM_DB_OBJECT DbObject, LPWSTR AttributeName, ULONG AttributeType, LPVOID AttributeData, ULONG AttributeSize)
NTSTATUS	SampGetObjectAttribute (PSAM_DB_OBJECT DbObject, LPWSTR AttributeName, PULONG AttributeType, LPVOID AttributeData, PULONG AttributeSize)
NTSTATUS	SampGetObjectAttributeString (PSAM_DB_OBJECT DbObject, LPWSTR AttributeName, PRPC_UNICODE_STRING String)
NTSTATUS	SampSetObjectAttributeString (PSAM_DB_OBJECT DbObject, LPWSTR AttributeName, PRPC_UNICODE_STRING String)
NTSTATUS	SampSetAccountNameInDomain (IN PSAM_DB_OBJECT DomainObject, IN LPCWSTR lpContainerName, IN LPCWSTR lpAccountName, IN ULONG ulRelativeId)
NTSTATUS	SampRemoveAccountNameFromDomain (IN PSAM_DB_OBJECT DomainObject, IN LPCWSTR lpContainerName, IN LPCWSTR lpAccountName)
NTSTATUS	SampCheckAccountNameInDomain (IN PSAM_DB_OBJECT DomainObject, IN LPCWSTR lpAccountName)
NTSTATUS	SampRemoveMemberFromAllAliases (IN PSAM_DB_OBJECT DomainObject, IN PRPC_SID MemberSid)
NTSTATUS	SampCreateAccountSid (IN PSAM_DB_OBJECT DomainObject, IN ULONG ulRelativeId, IN OUT PSID *AccountSid)
NTSTATUS	SampOpenGroupObject (IN PSAM_DB_OBJECT DomainObject, IN ULONG GroupId, IN ACCESS_MASK DesiredAccess, OUT PSAM_DB_OBJECT *GroupObject)
NTSTATUS	SampAddMemberToGroup (IN PSAM_DB_OBJECT GroupObject, IN ULONG MemberId)
NTSTATUS	SampRemoveMemberFromGroup (IN PSAM_DB_OBJECT GroupObject, IN ULONG MemberId)
NTSTATUS	SampRegCloseKey (IN OUT PHANDLE KeyHandle)
NTSTATUS	SampRegCreateKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT PHANDLE KeyHandle)
NTSTATUS	SampRegDeleteKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName)
NTSTATUS	SampRegEnumerateSubKey (IN HANDLE KeyHandle, IN ULONG Index, IN ULONG Length, OUT LPWSTR Buffer)
NTSTATUS	SampRegOpenKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT PHANDLE KeyHandle)
NTSTATUS	SampRegQueryKeyInfo (IN HANDLE KeyHandle, OUT PULONG SubKeyCount, OUT PULONG ValueCount)
NTSTATUS	SampRegDeleteValue (IN HANDLE KeyHandle, IN LPCWSTR ValueName)
NTSTATUS	SampRegEnumerateValue (IN HANDLE KeyHandle, IN ULONG Index, OUT LPWSTR Name, IN OUT PULONG NameLength, OUT PULONG Type OPTIONAL, OUT PVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	SampRegQueryValue (IN HANDLE KeyHandle, IN LPCWSTR ValueName, OUT PULONG Type OPTIONAL, OUT LPVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	SampRegSetValue (IN HANDLE KeyHandle, IN LPCWSTR ValueName, IN ULONG Type, IN LPVOID Data, IN ULONG DataLength)
VOID	SampStartRpcServer (VOID)
NTSTATUS	SampCreateServerSD (OUT PSECURITY_DESCRIPTOR *ServerSd, OUT PULONG Size)
NTSTATUS	SampCreateBuiltinDomainSD (OUT PSECURITY_DESCRIPTOR *DomainSd, OUT PULONG Size)
NTSTATUS	SampCreateAccountDomainSD (OUT PSECURITY_DESCRIPTOR *DomainSd, OUT PULONG Size)
NTSTATUS	SampCreateAliasSD (OUT PSECURITY_DESCRIPTOR *AliasSd, OUT PULONG Size)
NTSTATUS	SampCreateGroupSD (OUT PSECURITY_DESCRIPTOR *GroupSd, OUT PULONG Size)
NTSTATUS	SampCreateUserSD (IN PSID UserSid, OUT PSECURITY_DESCRIPTOR *UserSd, OUT PULONG Size)
BOOL	SampInitializeSAM (VOID)
NTSTATUS	SampOpenUserObject (IN PSAM_DB_OBJECT DomainObject, IN ULONG UserId, IN ACCESS_MASK DesiredAccess, OUT PSAM_DB_OBJECT *UserObject)
NTSTATUS	SampAddGroupMembershipToUser (IN PSAM_DB_OBJECT UserObject, IN ULONG GroupId, IN ULONG Attributes)
NTSTATUS	SampRemoveGroupMembershipFromUser (IN PSAM_DB_OBJECT UserObject, IN ULONG GroupId)
NTSTATUS	SampGetUserGroupAttributes (IN PSAM_DB_OBJECT DomainObject, IN ULONG UserId, IN ULONG GroupId, OUT PULONG GroupAttributes)
NTSTATUS	SampSetUserGroupAttributes (IN PSAM_DB_OBJECT DomainObject, IN ULONG UserId, IN ULONG GroupId, IN ULONG GroupAttributes)
NTSTATUS	SampRemoveUserFromAllGroups (IN PSAM_DB_OBJECT UserObject)
NTSTATUS	SampRemoveUserFromAllAliases (IN PSAM_DB_OBJECT UserObject)
NTSTATUS	SampSetUserPassword (IN PSAM_DB_OBJECT UserObject, IN PENCRYPTED_NT_OWF_PASSWORD NtPassword, IN BOOLEAN NtPasswordPresent, IN PENCRYPTED_LM_OWF_PASSWORD LmPassword, IN BOOLEAN LmPasswordPresent)
NTSTATUS	SampGetLogonHoursAttribute (IN PSAM_DB_OBJECT UserObject, IN OUT PSAMPR_LOGON_HOURS LogonHours)
NTSTATUS	SampSetLogonHoursAttribute (IN PSAM_DB_OBJECT UserObject, IN PSAMPR_LOGON_HOURS LogonHours)
INT	SampLoadString (HINSTANCE hInstance, UINT uId, LPWSTR lpBuffer, INT nBufferMax)
BOOL	SampIsSetupRunning (VOID)
PSID	AppendRidToSid (PSID SrcSid, ULONG Rid)
NTSTATUS	SampGetRidFromSid (IN PSID Sid, OUT PULONG Rid)
NTSTATUS	SampCheckAccountName (IN PRPC_UNICODE_STRING AccountName, IN USHORT MaxLength)
NTSTATUS WINAPI	SystemFunction006 (LPCSTR password, LPSTR hash)
NTSTATUS WINAPI	SystemFunction007 (PUNICODE_STRING string, LPBYTE hash)
NTSTATUS WINAPI	SystemFunction013 (const BYTE *in, const BYTE *key, LPBYTE out)

Variables
PGENERIC_MAPPING	pServerMapping
ENCRYPTED_NT_OWF_PASSWORD	EmptyNtHash
ENCRYPTED_LM_OWF_PASSWORD	EmptyLmHash
RTL_RESOURCE	SampResource

Macro Definition Documentation

_INC_WINDOWS

#define _INC_WINDOWS

Definition at line 17 of file samsrv.h.

COM_NO_WINDOWS_H

#define COM_NO_WINDOWS_H

Definition at line 18 of file samsrv.h.

NTOS_MODE_USER

#define NTOS_MODE_USER

Definition at line 23 of file samsrv.h.

SAMP_DB_SIGNATURE

#define SAMP_DB_SIGNATURE   0x87654321

Definition at line 58 of file samsrv.h.

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 16 of file samsrv.h.

Typedef Documentation

PSAM_ALIAS_FIXED_DATA

typedef struct _SAM_ALIAS_FIXED_DATA * PSAM_ALIAS_FIXED_DATA

PSAM_DB_OBJECT

typedef struct _SAM_DB_OBJECT * PSAM_DB_OBJECT

PSAM_DOMAIN_FIXED_DATA

typedef struct _SAM_DOMAIN_FIXED_DATA * PSAM_DOMAIN_FIXED_DATA

PSAM_GROUP_FIXED_DATA

typedef struct _SAM_GROUP_FIXED_DATA * PSAM_GROUP_FIXED_DATA

PSAM_USER_FIXED_DATA

typedef struct _SAM_USER_FIXED_DATA * PSAM_USER_FIXED_DATA

SAM_ALIAS_FIXED_DATA

typedef struct _SAM_ALIAS_FIXED_DATA SAM_ALIAS_FIXED_DATA

SAM_DB_OBJECT

typedef struct _SAM_DB_OBJECT SAM_DB_OBJECT

SAM_DB_OBJECT_TYPE

typedef enum _SAM_DB_OBJECT_TYPE SAM_DB_OBJECT_TYPE

SAM_DOMAIN_FIXED_DATA

typedef struct _SAM_DOMAIN_FIXED_DATA SAM_DOMAIN_FIXED_DATA

SAM_GROUP_FIXED_DATA

typedef struct _SAM_GROUP_FIXED_DATA SAM_GROUP_FIXED_DATA

SAM_USER_FIXED_DATA

typedef struct _SAM_USER_FIXED_DATA SAM_USER_FIXED_DATA

Enumeration Type Documentation

_SAM_DB_OBJECT_TYPE

enum _SAM_DB_OBJECT_TYPE

Enumerator
SamDbIgnoreObject
SamDbServerObject
SamDbDomainObject
SamDbAliasObject
SamDbGroupObject
SamDbUserObject

Definition at line 34 of file samsrv.h.

{
    SamDbIgnoreObject,
    SamDbServerObject,
    SamDbDomainObject,
    SamDbAliasObject,
    SamDbGroupObject,
    SamDbUserObject
} SAM_DB_OBJECT_TYPE;

Function Documentation

AppendRidToSid()

PSID AppendRidToSid	(	PSID	SrcSid,
		ULONG	Rid
	)

Definition at line 103 of file utils.c.

{
    ULONG Rids[8] = {0, 0, 0, 0, 0, 0, 0, 0};
    UCHAR RidCount;
    PSID DstSid;
    ULONG i;

    RidCount = *RtlSubAuthorityCountSid(SrcSid);
    if (RidCount >= 8)
        return NULL;

    for (i = 0; i < RidCount; i++)
        Rids[i] = *RtlSubAuthoritySid(SrcSid, i);

    Rids[RidCount] = Rid;
    RidCount++;

    RtlAllocateAndInitializeSid(RtlIdentifierAuthoritySid(SrcSid),
                                RidCount,
                                Rids[0],
                                Rids[1],
                                Rids[2],
                                Rids[3],
                                Rids[4],
                                Rids[5],
                                Rids[6],
                                Rids[7],
                                &DstSid);

    return DstSid;
}

SampAddGroupMembershipToUser()

NTSTATUS SampAddGroupMembershipToUser	(	IN PSAM_DB_OBJECT	UserObject,
		IN ULONG	GroupId,
		IN ULONG	Attributes
	)

Definition at line 39 of file user.c.

{
    PGROUP_MEMBERSHIP GroupsBuffer = NULL;
    ULONG GroupsCount = 0;
    ULONG Length = 0;
    ULONG i;
    NTSTATUS Status;

    TRACE("(%p %lu %lx)\n",
          UserObject, GroupId, Attributes);

    Status = SampGetObjectAttribute(UserObject,
                                    L"Groups",
                                    NULL,
                                    NULL,
                                    &Length);
    if (!NT_SUCCESS(Status) && Status != STATUS_OBJECT_NAME_NOT_FOUND)
        goto done;

    GroupsBuffer = midl_user_allocate(Length + sizeof(GROUP_MEMBERSHIP));
    if (GroupsBuffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    if (Status != STATUS_OBJECT_NAME_NOT_FOUND)
    {
        Status = SampGetObjectAttribute(UserObject,
                                        L"Groups",
                                        NULL,
                                        GroupsBuffer,
                                        &Length);
        if (!NT_SUCCESS(Status))
            goto done;

        GroupsCount = Length / sizeof(GROUP_MEMBERSHIP);
    }

    for (i = 0; i < GroupsCount; i++)
    {
        if (GroupsBuffer[i].RelativeId == GroupId)
        {
            Status = STATUS_MEMBER_IN_GROUP;
            goto done;
        }
    }

    GroupsBuffer[GroupsCount].RelativeId = GroupId;
    GroupsBuffer[GroupsCount].Attributes = Attributes;
    Length += sizeof(GROUP_MEMBERSHIP);

    Status = SampSetObjectAttribute(UserObject,
                                    L"Groups",
                                    REG_BINARY,
                                    GroupsBuffer,
                                    Length);

done:
    if (GroupsBuffer != NULL)
        midl_user_free(GroupsBuffer);

    return Status;
}

Referenced by SamrAddMemberToGroup().

SampAddMemberToAlias()

NTSTATUS SampAddMemberToAlias	(	IN PSAM_DB_OBJECT	AliasObject,
		IN PRPC_SID	MemberId
	)

Definition at line 39 of file alias.c.

{
    LPWSTR MemberIdString = NULL;
    HANDLE MembersKeyHandle = NULL;
    HANDLE MemberKeyHandle = NULL;
    ULONG MemberIdLength;
    NTSTATUS Status;

    TRACE("(%p %p)\n",
          AliasObject, MemberId);

    ConvertSidToStringSidW(MemberId, &MemberIdString);
    TRACE("Member SID: %S\n", MemberIdString);

    MemberIdLength = RtlLengthSid(MemberId);

    Status = SampRegCreateKey(AliasObject->KeyHandle,
                              L"Members",
                              KEY_WRITE,
                              &MembersKeyHandle);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegCreateKey failed with status 0x%08lx\n", Status);
        goto done;
    }

    Status = SampRegSetValue(MembersKeyHandle,
                             MemberIdString,
                             REG_BINARY,
                             MemberId,
                             MemberIdLength);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegSetValue failed with status 0x%08lx\n", Status);
        goto done;
    }

    Status = SampRegCreateKey(AliasObject->MembersKeyHandle,
                              MemberIdString,
                              KEY_WRITE,
                              &MemberKeyHandle);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegCreateKey failed with status 0x%08lx\n", Status);
        goto done;
    }

    Status = SampRegSetValue(MemberKeyHandle,
                             AliasObject->Name,
                             REG_BINARY,
                             MemberId,
                             MemberIdLength);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegSetValue failed with status 0x%08lx\n", Status);
        goto done;
    }

done:
    SampRegCloseKey(&MemberKeyHandle);
    SampRegCloseKey(&MembersKeyHandle);

    if (MemberIdString != NULL)
        LocalFree(MemberIdString);

    return Status;
}

Referenced by SamrAddMemberToAlias().

SampAddMemberToGroup()

NTSTATUS SampAddMemberToGroup	(	IN PSAM_DB_OBJECT	GroupObject,
		IN ULONG	MemberId
	)

Definition at line 39 of file group.c.

{
    PULONG MembersBuffer = NULL;
    ULONG MembersCount = 0;
    ULONG Length = 0;
    ULONG i;
    NTSTATUS Status;

    Status = SampGetObjectAttribute(GroupObject,
                                    L"Members",
                                    NULL,
                                    NULL,
                                    &Length);
    if (!NT_SUCCESS(Status) && Status != STATUS_OBJECT_NAME_NOT_FOUND)
        goto done;

    MembersBuffer = midl_user_allocate(Length + sizeof(ULONG));
    if (MembersBuffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    if (Status != STATUS_OBJECT_NAME_NOT_FOUND)
    {
        Status = SampGetObjectAttribute(GroupObject,
                                        L"Members",
                                        NULL,
                                        MembersBuffer,
                                        &Length);
        if (!NT_SUCCESS(Status))
            goto done;

        MembersCount = Length / sizeof(ULONG);
    }

    for (i = 0; i < MembersCount; i++)
    {
        if (MembersBuffer[i] == MemberId)
        {
            Status = STATUS_MEMBER_IN_GROUP;
            goto done;
        }
    }

    MembersBuffer[MembersCount] = MemberId;
    Length += sizeof(ULONG);

    Status = SampSetObjectAttribute(GroupObject,
                                    L"Members",
                                    REG_BINARY,
                                    MembersBuffer,
                                    Length);

done:
    if (MembersBuffer != NULL)
        midl_user_free(MembersBuffer);

    return Status;
}

Referenced by SamrAddMemberToGroup().

SampCheckAccountName()

NTSTATUS SampCheckAccountName	(	IN PRPC_UNICODE_STRING	AccountName,
		IN USHORT	MaxLength
	)

Definition at line 154 of file utils.c.

{
    if (AccountName->Length > MaxLength * sizeof(WCHAR))
        return STATUS_INVALID_ACCOUNT_NAME;

    return STATUS_SUCCESS;
}

Referenced by SampSetAliasName(), SampSetGroupName(), SampSetUserName(), SamrCreateAliasInDomain(), SamrCreateGroupInDomain(), SamrCreateUser2InDomain(), and SamrCreateUserInDomain().

SampCheckAccountNameInDomain()

NTSTATUS SampCheckAccountNameInDomain	(	IN PSAM_DB_OBJECT	DomainObject,
		IN LPCWSTR	lpAccountName
	)

Definition at line 96 of file domain.c.

{
    HANDLE AccountKey = NULL;
    HANDLE NamesKey = NULL;
    NTSTATUS Status;

    TRACE("SampCheckAccountNameInDomain()\n");

    Status = SampRegOpenKey(DomainObject->KeyHandle,
                            L"Aliases",
                            KEY_READ,
                            &AccountKey);
    if (NT_SUCCESS(Status))
    {
        Status = SampRegOpenKey(AccountKey,
                                L"Names",
                                KEY_READ,
                                &NamesKey);
        if (NT_SUCCESS(Status))
        {
            Status = SampRegQueryValue(NamesKey,
                                       lpAccountName,
                                       NULL,
                                       NULL,
                                       NULL);
            if (Status == STATUS_SUCCESS)
            {
                SampRegCloseKey(&NamesKey);
                Status = STATUS_ALIAS_EXISTS;
            }
            else if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
                Status = STATUS_SUCCESS;
        }

        SampRegCloseKey(&AccountKey);
    }

    if (!NT_SUCCESS(Status))
    {
        TRACE("Checking for alias account failed (Status 0x%08lx)\n", Status);
        return Status;
    }

    Status = SampRegOpenKey(DomainObject->KeyHandle,
                            L"Groups",
                            KEY_READ,
                            &AccountKey);
    if (NT_SUCCESS(Status))
    {
        Status = SampRegOpenKey(AccountKey,
                                L"Names",
                                KEY_READ,
                                &NamesKey);
        if (NT_SUCCESS(Status))
        {
            Status = SampRegQueryValue(NamesKey,
                                       lpAccountName,
                                       NULL,
                                       NULL,
                                       NULL);
            if (Status == STATUS_SUCCESS)
            {
                SampRegCloseKey(&NamesKey);
                Status = STATUS_ALIAS_EXISTS;
            }
            else if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
                Status = STATUS_SUCCESS;
        }

        SampRegCloseKey(&AccountKey);
    }

    if (!NT_SUCCESS(Status))
    {
        TRACE("Checking for group account failed (Status 0x%08lx)\n", Status);
        return Status;
    }

    Status = SampRegOpenKey(DomainObject->KeyHandle,
                            L"Users",
                            KEY_READ,
                            &AccountKey);
    if (NT_SUCCESS(Status))
    {
        Status = SampRegOpenKey(AccountKey,
                                L"Names",
                                KEY_READ,
                                &NamesKey);
        if (NT_SUCCESS(Status))
        {
            Status = SampRegQueryValue(NamesKey,
                                       lpAccountName,
                                       NULL,
                                       NULL,
                                       NULL);
            if (Status == STATUS_SUCCESS)
            {
                SampRegCloseKey(&NamesKey);
                Status = STATUS_ALIAS_EXISTS;
            }
            else if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
                Status = STATUS_SUCCESS;
        }

        SampRegCloseKey(&AccountKey);
    }

    if (!NT_SUCCESS(Status))
    {
        TRACE("Checking for user account failed (Status 0x%08lx)\n", Status);
    }

    return Status;
}

Referenced by SampSetAliasName(), SampSetGroupName(), SampSetUserName(), SamrCreateAliasInDomain(), SamrCreateGroupInDomain(), SamrCreateUser2InDomain(), and SamrCreateUserInDomain().

SampCloseDbObject()

NTSTATUS SampCloseDbObject

(

PSAM_DB_OBJECT

DbObject

)

Definition at line 344 of file database.c.

{
    NTSTATUS Status = STATUS_SUCCESS;

    DbObject->RefCount--;

    if (DbObject->RefCount > 0)
        return STATUS_SUCCESS;

    SampRegCloseKey(&DbObject->KeyHandle);
    SampRegCloseKey(&DbObject->MembersKeyHandle);

    if (DbObject->Name != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, DbObject->Name);

    RtlFreeHeap(RtlGetProcessHeap(), 0, DbObject);

    return Status;
}

Referenced by SampGetUserGroupAttributes(), SampRemoveUserFromAllGroups(), SampSetUserGroupAttributes(), SamrAddMemberToGroup(), SamrCloseHandle(), SamrGetDomainPasswordInformation(), and SamrRemoveMemberFromGroup().

SampCreateAccountDomainSD()

NTSTATUS SampCreateAccountDomainSD	(	OUT PSECURITY_DESCRIPTOR *	DomainSd,
		OUT PULONG	Size
	)

Definition at line 545 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PSID UsersSid = NULL;
    PSID GuestsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Users SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_USERS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &UsersSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Guests SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_GUESTS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &GuestsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;


    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               4 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid) +
               RtlLengthSid(UsersSid) +
               RtlLengthSid(GuestsSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DOMAIN_READ | DOMAIN_EXECUTE,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DOMAIN_READ | DOMAIN_EXECUTE,
                                    UsersSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DOMAIN_ALL_ACCESS & ~DOMAIN_CREATE_GROUP,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DOMAIN_READ | DOMAIN_EXECUTE | DOMAIN_CREATE_USER | DOMAIN_CREATE_ALIAS,
                                    GuestsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  SAM_SERVER_CREATE_DOMAIN | SAM_SERVER_INITIALIZE |
                                  SAM_SERVER_SHUTDOWN,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *ServerSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateDomain().

SampCreateAccountSid()

NTSTATUS SampCreateAccountSid	(	IN PSAM_DB_OBJECT	DomainObject,
		IN ULONG	ulRelativeId,
		IN OUT PSID *	AccountSid
	)

Definition at line 303 of file domain.c.

{
    PSID DomainSid = NULL;
    ULONG Length = 0;
    NTSTATUS Status;

    Status = SampGetObjectAttribute(DomainObject,
                                    L"SID",
                                    NULL,
                                    NULL,
                                    &Length);
    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
    {
        TRACE("Status 0x%08lx\n", Status);
        goto done;
    }

    TRACE("Length: %lu\n", Length);

    DomainSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, Length);
    if (DomainSid == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    Status = SampGetObjectAttribute(DomainObject,
                                    L"SID",
                                    NULL,
                                    DomainSid,
                                    &Length);
    if (!NT_SUCCESS(Status))
    {
        TRACE("Status 0x%08lx\n", Status);
        goto done;
    }

    *AccountSid = AppendRidToSid(DomainSid,
                                 ulRelativeId);

done:
    if (DomainSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, DomainSid);

    return Status;
}

Referenced by SamrCreateUser2InDomain(), and SamrCreateUserInDomain().

SampCreateAliasSD()

NTSTATUS SampCreateAliasSD	(	OUT PSECURITY_DESCRIPTOR *	AliasSd,
		OUT PULONG	Size
	)

Definition at line 859 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PSID AccountOperatorsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Account Operators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ACCOUNT_OPS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AccountOperatorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               3 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid) +
               RtlLengthSid(AccountOperatorsSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    READ_CONTROL | ALIAS_READ_INFORMATION | ALIAS_LIST_MEMBERS,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    ALIAS_ALL_ACCESS,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    ALIAS_ALL_ACCESS,
                                    AccountOperatorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  ALIAS_WRITE_ACCOUNT | ALIAS_REMOVE_MEMBER |
                                  ALIAS_ADD_MEMBER,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *AliasSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateAliasAccount(), and SamrCreateAliasInDomain().

SampCreateBuiltinDomainSD()

NTSTATUS SampCreateBuiltinDomainSD	(	OUT PSECURITY_DESCRIPTOR *	DomainSd,
		OUT PULONG	Size
	)

Definition at line 283 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;


    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    DOMAIN_READ | DOMAIN_EXECUTE,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    SAM_SERVER_ALL_ACCESS,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  SAM_SERVER_CREATE_DOMAIN | SAM_SERVER_INITIALIZE |
                                  SAM_SERVER_SHUTDOWN,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *ServerSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateDomain().

SampCreateDbObject()

NTSTATUS SampCreateDbObject	(	IN PSAM_DB_OBJECT	ParentObject,
		IN LPWSTR	ContainerName,
		IN LPWSTR	ObjectName,
		IN ULONG	RelativeId,
		IN SAM_DB_OBJECT_TYPE	ObjectType,
		IN ACCESS_MASK	DesiredAccess,
		OUT PSAM_DB_OBJECT *	DbObject
	)

Definition at line 42 of file database.c.

{
    PSAM_DB_OBJECT NewObject = NULL;
    HANDLE ParentKeyHandle;
    HANDLE ContainerKeyHandle = NULL;
    HANDLE ObjectKeyHandle = NULL;
    HANDLE MembersKeyHandle = NULL;
    NTSTATUS Status;

    if (DbObject == NULL)
        return STATUS_INVALID_PARAMETER;

    *DbObject = NULL;

    if (ParentObject == NULL)
        ParentKeyHandle = SamKeyHandle;
    else
        ParentKeyHandle = ParentObject->KeyHandle;

    if (ContainerName != NULL)
    {
        /* Open the container key */
        Status = SampRegOpenKey(ParentKeyHandle,
                                ContainerName,
                                KEY_ALL_ACCESS,
                                &ContainerKeyHandle);
        if (!NT_SUCCESS(Status))
        {
            goto done;
        }

        /* Create the object key */
        Status = SampRegCreateKey(ContainerKeyHandle,
                                  ObjectName,
                                  KEY_ALL_ACCESS,
                                  &ObjectKeyHandle);
        if (!NT_SUCCESS(Status))
        {
            goto done;
        }

        if (ObjectType == SamDbAliasObject)
        {
            /* Create the object key */
            Status = SampRegCreateKey(ContainerKeyHandle,
                                      L"Members",
                                      KEY_ALL_ACCESS,
                                      &MembersKeyHandle);
            if (!NT_SUCCESS(Status))
            {
                goto done;
            }
        }
    }
    else
    {
        /* Create the object key */
        Status = SampRegCreateKey(ParentKeyHandle,
                                  ObjectName,
                                  KEY_ALL_ACCESS,
                                  &ObjectKeyHandle);
        if (!NT_SUCCESS(Status))
        {
            goto done;
        }
    }

    NewObject = RtlAllocateHeap(RtlGetProcessHeap(),
                                HEAP_ZERO_MEMORY,
                                sizeof(SAM_DB_OBJECT));
    if (NewObject == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    NewObject->Name = RtlAllocateHeap(RtlGetProcessHeap(),
                                      0,
                                      (wcslen(ObjectName) + 1) * sizeof(WCHAR));
    if (NewObject->Name == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    wcscpy(NewObject->Name, ObjectName);

    NewObject->Signature = SAMP_DB_SIGNATURE;
    NewObject->RefCount = 1;
    NewObject->ObjectType = ObjectType;
    NewObject->Access = DesiredAccess;
    NewObject->KeyHandle = ObjectKeyHandle;
    NewObject->MembersKeyHandle = MembersKeyHandle;
    NewObject->RelativeId = RelativeId;
    NewObject->ParentObject = ParentObject;

    if (ParentObject != NULL)
        NewObject->Trusted = ParentObject->Trusted;

    *DbObject = NewObject;

done:
    if (!NT_SUCCESS(Status))
    {
        if (NewObject != NULL)
        {
            if (NewObject->Name != NULL)
                RtlFreeHeap(RtlGetProcessHeap(), 0, NewObject->Name);

            RtlFreeHeap(RtlGetProcessHeap(), 0, NewObject);
        }

        SampRegCloseKey(&MembersKeyHandle);
        SampRegCloseKey(&ObjectKeyHandle);
    }

    SampRegCloseKey(&ContainerKeyHandle);

    return Status;
}

Referenced by SamrCreateAliasInDomain(), SamrCreateGroupInDomain(), SamrCreateUser2InDomain(), and SamrCreateUserInDomain().

SampCreateGroupSD()

NTSTATUS SampCreateGroupSD	(	OUT PSECURITY_DESCRIPTOR *	GroupSd,
		OUT PULONG	Size
	)

Definition at line 1146 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PSID AccountOperatorsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Account Operators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ACCOUNT_OPS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AccountOperatorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               3 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid) +
               RtlLengthSid(AccountOperatorsSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    READ_CONTROL | GROUP_LIST_MEMBERS | GROUP_READ_INFORMATION,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    GROUP_ALL_ACCESS,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    GROUP_ALL_ACCESS,
                                    AccountOperatorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  GROUP_REMOVE_MEMBER | GROUP_ADD_MEMBER |
                                  GROUP_WRITE_ACCOUNT,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *GroupSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateGroupAccount(), and SamrCreateGroupInDomain().

SampCreateServerSD()

NTSTATUS SampCreateServerSD	(	OUT PSECURITY_DESCRIPTOR *	ServerSd,
		OUT PULONG	Size
	)

Definition at line 21 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;


    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    SAM_SERVER_READ | SAM_SERVER_EXECUTE,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    SAM_SERVER_ALL_ACCESS,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  SAM_SERVER_CREATE_DOMAIN | SAM_SERVER_INITIALIZE |
                                  SAM_SERVER_SHUTDOWN,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *ServerSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateServer().

SampCreateUserSD()

NTSTATUS SampCreateUserSD	(	IN PSID	UserSid,
		OUT PSECURITY_DESCRIPTOR *	UserSd,
		OUT PULONG	Size
	)

Definition at line 1433 of file security.c.

{
    PSECURITY_DESCRIPTOR AbsSD = NULL;
    PSECURITY_DESCRIPTOR RelSD = NULL;
    PSID EveryoneSid = NULL;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PACL Dacl = NULL;
    PACL Sacl = NULL;
    ULONG DaclSize;
    ULONG SaclSize;
    ULONG RelSDSize = 0;
    NTSTATUS Status = STATUS_SUCCESS;


    /* Create the Everyone SID */
    Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Anonymous SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Create the Administrators SID */
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* Allocate a buffer for the absolute SD */
    AbsSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            sizeof(SECURITY_DESCRIPTOR));
    if (AbsSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Create the absolute SD */
    Status = RtlCreateSecurityDescriptor(AbsSD,
                                         SECURITY_DESCRIPTOR_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the DACL */
    DaclSize = sizeof(ACL) + 
               3 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AdministratorsSid) +
               RtlLengthSid(UserSid);

    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    READ_CONTROL | USER_READ_GROUP_INFORMATION | USER_LIST_GROUPS |
                                    USER_CHANGE_PASSWORD | USER_READ_ACCOUNT | USER_READ_LOGON |
                                    USER_READ_PREFERENCES | USER_READ_GENERAL,
                                    EveryoneSid);
    ASSERT(NT_SUCCESS(Status));
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    USER_ALL_ACCESS,
                                    AdministratorsSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    READ_CONTROL | USER_CHANGE_PASSWORD | USER_WRITE_PREFERENCES,
                                    UserSid);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the DACL */
    Status = RtlSetDaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* allocate and create the SACL */
    SaclSize = sizeof(ACL) + 
               2 * sizeof(ACE) +
               RtlLengthSid(EveryoneSid) +
               RtlLengthSid(AnonymousSid);

    Sacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Sacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    Status = RtlCreateAcl(Sacl,
                          SaclSize,
                          ACL_REVISION);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  ACCESS_SYSTEM_SECURITY | WRITE_DAC | DELETE |
                                  USER_CHANGE_PASSWORD | USER_WRITE_PREFERENCES,
                                  EveryoneSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    Status = RtlAddAuditAccessAce(Sacl,
                                  ACL_REVISION,
                                  STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL,
                                  AnonymousSid,
                                  TRUE,
                                  TRUE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the SACL */
    Status = RtlSetSaclSecurityDescriptor(AbsSD,
                                          TRUE,
                                          Sacl,
                                          FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the owner SID */
    Status = RtlSetOwnerSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Set the group SID */
    Status = RtlSetGroupSecurityDescriptor(AbsSD,
                                           AdministratorsSid,
                                           FALSE);
    ASSERT(Status == STATUS_SUCCESS);
    if (!NT_SUCCESS(Status))
        goto done;

    /* Get the reqired buffer size for the self-relative SD */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         NULL,
                                         &RelSDSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;

    /* Allocate a buffer for the self-relative SD */
    RelSD = RtlAllocateHeap(RtlGetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            RelSDSize);
    if (RelSD == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    /* Convert the absolute SD to self-relative format */
    Status = RtlAbsoluteToSelfRelativeSD(AbsSD,
                                         RelSD,
                                         &RelSDSize);
    if (Status == STATUS_BUFFER_TOO_SMALL)
    {
    ASSERT(Status == STATUS_SUCCESS);
        goto done;
    }

    *UserSd = RelSD;
    *Size = RelSDSize;

done:
    if (!NT_SUCCESS(Status))
    {
        if (RelSD != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelSD);
    }

    if (EveryoneSid != NULL)
        RtlFreeSid(EveryoneSid);

    if (AnonymousSid != NULL)
        RtlFreeSid(AnonymousSid);

    if (AdministratorsSid != NULL)
        RtlFreeSid(AdministratorsSid);

    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);

    if (Sacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Sacl);

    if (AbsSD != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AbsSD);

    return Status;
}

Referenced by SampSetupCreateUserAccount(), SamrCreateUser2InDomain(), and SamrCreateUserInDomain().

SampDeleteAccountDbObject()

NTSTATUS SampDeleteAccountDbObject

(

PSAM_DB_OBJECT

DbObject

)

Definition at line 366 of file database.c.

{
    LPCWSTR ContainerName;
    LPWSTR AccountName = NULL;
    HANDLE ContainerKey = NULL;
    HANDLE NamesKey = NULL;
    ULONG Length = 0;
    NTSTATUS Status = STATUS_SUCCESS;

    TRACE("(%p)\n", DbObject);

    /* Server and Domain objects cannot be deleted */
    switch (DbObject->ObjectType)
    {
        case SamDbAliasObject:
            ContainerName = L"Aliases";
            break;

        case SamDbGroupObject:
            ContainerName = L"Groups";
            break;

        case SamDbUserObject:
            ContainerName = L"Users";
            break;

        default:
           return STATUS_INVALID_PARAMETER;
    }

    /* Get the account name */
    Status = SampGetObjectAttribute(DbObject,
                                    L"Name",
                                    NULL,
                                    NULL,
                                    &Length);
    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
    {
        TRACE("SampGetObjectAttribute failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    AccountName = RtlAllocateHeap(RtlGetProcessHeap(),
                                  HEAP_ZERO_MEMORY,
                                  Length);
    if (AccountName == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    Status = SampGetObjectAttribute(DbObject,
                                    L"Name",
                                    NULL,
                                    (PVOID)AccountName,
                                    &Length);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampGetObjectAttribute failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    SampRegCloseKey(&DbObject->KeyHandle);

    if (DbObject->ObjectType == SamDbAliasObject)
    {
        SampRegCloseKey(&DbObject->MembersKeyHandle);

        SampRegDeleteKey(DbObject->KeyHandle,
                         L"Members");
    }

    /* Open the domain container key */
    Status = SampRegOpenKey(DbObject->ParentObject->KeyHandle,
                            ContainerName,
                            DELETE | KEY_SET_VALUE,
                            &ContainerKey);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegOpenKey failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    /* Open the Names key */
    Status = SampRegOpenKey(ContainerKey,
                            L"Names",
                            KEY_SET_VALUE,
                            &NamesKey);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegOpenKey failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    /* Remove the account from the Names key */
    Status = SampRegDeleteValue(NamesKey,
                                AccountName);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegDeleteValue failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    /* Remove the account key from the container */
    Status = SampRegDeleteKey(ContainerKey,
                              DbObject->Name);
    if (!NT_SUCCESS(Status))
    {
        TRACE("SampRegDeleteKey failed (Status 0x%08lx)\n", Status);
        goto done;
    }

    /* Release the database object name */
    if (DbObject->Name != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, DbObject->Name);

    /* Release the database object */
    RtlFreeHeap(RtlGetProcessHeap(), 0, DbObject);

    Status = STATUS_SUCCESS;

done:
    SampRegCloseKey(&NamesKey);
    SampRegCloseKey(&ContainerKey);

    if (AccountName != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AccountName);

    return Status;
}

Referenced by SamrDeleteAlias(), SamrDeleteGroup(), and SamrDeleteUser().

SampGetLogonHoursAttribute()

NTSTATUS SampGetLogonHoursAttribute	(	IN PSAM_DB_OBJECT	UserObject,
		IN OUT PSAMPR_LOGON_HOURS	LogonHours
	)

Definition at line 619 of file user.c.

{
    PUCHAR RawBuffer = NULL;
    ULONG Length = 0;
    ULONG BufferLength = 0;
    NTSTATUS Status;

    Status = SampGetObjectAttribute(UserObject,
                                    L"LogonHours",
                                    NULL,
                                    NULL,
                                    &Length);
    if (Status != STATUS_BUFFER_OVERFLOW)
    {
        TRACE("SampGetObjectAttribute failed (Status 0x%08lx)\n", Status);
        return Status;
    }

    Status = STATUS_SUCCESS;

    if (Length == 0)
    {
        LogonHours->UnitsPerWeek = 0;
        LogonHours->LogonHours = NULL;
    }
    else
    {
        RawBuffer = midl_user_allocate(Length);
        if (RawBuffer == NULL)
        {
            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto done;
        }

        Status = SampGetObjectAttribute(UserObject,
                                        L"LogonHours",
                                        NULL,
                                        (PVOID)RawBuffer,
                                        &Length);
        if (!NT_SUCCESS(Status))
            goto done;

        LogonHours->UnitsPerWeek = *((PUSHORT)RawBuffer);

        BufferLength = (((ULONG)LogonHours->UnitsPerWeek) + 7) / 8;

        LogonHours->LogonHours = midl_user_allocate(BufferLength);
        if (LogonHours->LogonHours == NULL)
        {
            TRACE("Failed to allocate LogonHours buffer!\n");
            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto done;
        }

        memcpy(LogonHours->LogonHours,
               &(RawBuffer[2]),
               BufferLength);
    }

done:

    if (RawBuffer != NULL)
        midl_user_free(RawBuffer);

    return Status;
}

Referenced by SampQueryUserAccount(), SampQueryUserAll(), SampQueryUserLogon(), and SampQueryUserLogonHours().

SampGetMembersInAlias()

NTSTATUS SampGetMembersInAlias	(	IN PSAM_DB_OBJECT	AliasObject,
		OUT PULONG	MemberCount,
		OUT PSAMPR_SID_INFORMATION *	MemberArray
	)

Definition at line 218 of file alias.c.

{
    HANDLE MembersKeyHandle = NULL;
    PSAMPR_SID_INFORMATION Members = NULL;
    ULONG Count = 0;
    ULONG DataLength;
    ULONG Index;
    NTSTATUS Status;

    /* Open the members key of the alias object */
    Status = SampRegOpenKey(AliasObject->KeyHandle,
                            L"Members",
                            KEY_READ,
                            &MembersKeyHandle);
    if (!NT_SUCCESS(Status))
    {
        ERR("SampRegOpenKey failed with status 0x%08lx\n", Status);
        goto done;
    }

    /* Get the number of members */
    Status = SampRegQueryKeyInfo(MembersKeyHandle,
                                 NULL,
                                 &Count);
    if (!NT_SUCCESS(Status))
    {
        ERR("SampRegQueryKeyInfo failed with status 0x%08lx\n", Status);
        goto done;
    }

    /* Allocate the member array */
    Members = midl_user_allocate(Count * sizeof(SAMPR_SID_INFORMATION));
    if (Members == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    /* Enumerate the members */
    Index = 0;
    while (TRUE)
    {
        /* Get the size of the next SID */
        DataLength = 0;
        Status = SampRegEnumerateValue(MembersKeyHandle,
                                       Index,
                                       NULL,
                                       NULL,
                                       NULL,
                                       NULL,
                                       &DataLength);
        if (!NT_SUCCESS(Status))
        {
            if (Status == STATUS_NO_MORE_ENTRIES)
                Status = STATUS_SUCCESS;
            break;
        }

        /* Allocate a buffer for the SID */
        Members[Index].SidPointer = midl_user_allocate(DataLength);
        if (Members[Index].SidPointer == NULL)
        {
            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto done;
        }

        /* Read the SID into the buffer */
        Status = SampRegEnumerateValue(MembersKeyHandle,
                                       Index,
                                       NULL,
                                       NULL,
                                       NULL,
                                       (PVOID)Members[Index].SidPointer,
                                       &DataLength);
        if (!NT_SUCCESS(Status))
        {
            goto done;
        }

        Index++;
    }

    if (NT_SUCCESS(Status))
    {
        *MemberCount = Count;
        *MemberArray = Members;
    }

done:
    return Status;
}

Referenced by SampRemoveAllMembersFromAlias(), and SamrGetMembersInAlias().

SampGetObjectAttribute()

NTSTATUS SampGetObjectAttribute	(	PSAM_DB_OBJECT	DbObject,
		LPWSTR	AttributeName,
		PULONG	AttributeType,
		LPVOID	AttributeData,
		PULONG	AttributeSize
	)

Definition at line 514 of file database.c.

{
    return SampRegQueryValue(DbObject->KeyHandle,
                             AttributeName,
                             AttributeType,
                             AttributeData,
                             AttributeSize);
}

Referenced by SampAddGroupMembershipToUser(), SampAddMemberToGroup(), SampCreateAccountSid(), SampDeleteAccountDbObject(), SampGetLogonHoursAttribute(), SampGetObjectAttributeString(), SampGetUserGroupAttributes(), SampQueryDomainGeneral(), SampQueryDomainGeneral2(), SampQueryDomainLockout(), SampQueryDomainLogoff(), SampQueryDomainModified(), SampQueryDomainModified2(), SampQueryDomainPassword(), SampQueryDomainServerRole(), SampQueryDomainState(), SampQueryGroupAttribute(), SampQueryGroupGeneral(), SampQueryUserAccount(), SampQueryUserAll(), SampQueryUserControl(), SampQueryUserExpires(), SampQueryUserGeneral(), SampQueryUserInternal1(), SampQueryUserInternal2(), SampQueryUserLogon(), SampQueryUserPreferences(), SampQueryUserPrimaryGroup(), SampRemoveGroupMembershipFromUser(), SampRemoveMemberFromGroup(), SampRemoveUserFromAllGroups(), SampSetDomainLockout(), SampSetDomainLogoff(), SampSetDomainPassword(), SampSetDomainServerRole(), SampSetDomainState(), SampSetGroupAttribute(), SampSetUserAll(), SampSetUserControl(), SampSetUserExpires(), SampSetUserGeneral(), SampSetUserGroupAttributes(), SampSetUserInternal1(), SampSetUserInternal2(), SampSetUserPassword(), SampSetUserPreferences(), SampSetUserPrimaryGroup(), SamrChangePasswordUser(), SamrCreateAliasInDomain(), SamrCreateGroupInDomain(), SamrCreateUser2InDomain(), SamrCreateUserInDomain(), SamrDeleteGroup(), SamrGetDomainPasswordInformation(), SamrGetGroupsForUser(), SamrGetMembersInGroup(), SamrGetUserDomainPasswordInformation(), SamrQuerySecurityObject(), and SamrSetSecurityObject().

SampGetObjectAttributeString()

NTSTATUS SampGetObjectAttributeString	(	PSAM_DB_OBJECT	DbObject,
		LPWSTR	AttributeName,
		PRPC_UNICODE_STRING	String
	)

Definition at line 529 of file database.c.

{
    ULONG Length = 0;
    NTSTATUS Status;

    Status = SampGetObjectAttribute(DbObject,
                                    AttributeName,
                                    NULL,
                                    NULL,
                                    &Length);
    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
    {
        TRACE("Status 0x%08lx\n", Status);
        goto done;
    }

    if (Length == 0)
    {
        String->Length = 0;
        String->MaximumLength = 0;
        String->Buffer = NULL;

        Status = STATUS_SUCCESS;
        goto done;
    }

    String->Length = (USHORT)(Length - sizeof(WCHAR));
    String->MaximumLength = (USHORT)Length;
    String->Buffer = midl_user_allocate(Length);
    if (String->Buffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    TRACE("Length: %lu\n", Length);
    Status = SampGetObjectAttribute(DbObject,
                                    AttributeName,
                                    NULL,
                                    (PVOID)String->Buffer,
                                    &Length);
    if (!NT_SUCCESS(Status))
    {
        TRACE("Status 0x%08lx\n", Status);
        goto done;
    }

done:
    if (!NT_SUCCESS(Status))
    {
        if (String->Buffer != NULL)
        {
            midl_user_free(String->Buffer);
            String->Buffer = NULL;
        }
    }

    return Status;
}

Referenced by SampQueryAliasAdminComment(), SampQueryAliasGeneral(), SampQueryAliasName(), SampQueryDomainGeneral(), SampQueryDomainGeneral2(), SampQueryDomainName(), SampQueryDomainOem(), SampQueryDomainReplication(), SampQueryGroupAdminComment(), SampQueryGroupGeneral(), SampQueryGroupName(), SampQueryUserAccount(), SampQueryUserAccountName(), SampQueryUserAdminComment(), SampQueryUserAll(), SampQueryUserFullName(), SampQueryUserGeneral(), SampQueryUserHome(), SampQueryUserLogon(), SampQueryUserName(), SampQueryUserParameters(), SampQueryUserPreferences(), SampQueryUserProfile(), SampQueryUserScript(), SampQueryUserWorkStations(), SampSetAliasName(), SampSetGroupName(), and SampSetUserName().

SampGetRidFromSid()

NTSTATUS SampGetRidFromSid	(	IN PSID	Sid,
		OUT PULONG	Rid
	)

Definition at line 138 of file utils.c.

{
    UCHAR RidCount;

    RidCount = *RtlSubAuthorityCountSid(Sid);
    if (RidCount < 1)
        return STATUS_INVALID_SID;

    *Rid = *RtlSubAuthoritySid(Sid, RidCount - 1);

    return STATUS_SUCCESS;
}

Referenced by SamrRemoveMemberFromForeignDomain().

SampGetUserGroupAttributes()

NTSTATUS SampGetUserGroupAttributes	(	IN PSAM_DB_OBJECT	DomainObject,
		IN ULONG	UserId,
		IN ULONG	GroupId,
		OUT PULONG	GroupAttributes
	)

Definition at line 183 of file user.c.

{
    PSAM_DB_OBJECT UserObject = NULL;
    PGROUP_MEMBERSHIP GroupsBuffer = NULL;
    ULONG Length = 0;
    ULONG i;
    NTSTATUS Status;

    Status = SampOpenUserObject(DomainObject,
                                UserId,
                                0,
                                &UserObject);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    SampGetObjectAttribute(UserObject,
                           L"Groups",
                           NULL,
                           NULL,
                           &Length);

    if (Length == 0)
        return STATUS_UNSUCCESSFUL; /* FIXME */

    GroupsBuffer = midl_user_allocate(Length);
    if (GroupsBuffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }

    Status = SampGetObjectAttribute(UserObject,
                                    L"Groups",
                                    NULL,
                                    GroupsBuffer,
                                    &Length);
    if (!NT_SUCCESS(Status))
        goto done;

    for (i = 0; i < (Length / sizeof(GROUP_MEMBERSHIP)); i++)
    {
        if (GroupsBuffer[i].RelativeId == GroupId)
        {
            *GroupAttributes = GroupsBuffer[i].Attributes;
            goto done;
        }
    }

done:
    if (GroupsBuffer != NULL)
        midl_user_free(GroupsBuffer);

    if (UserObject != NULL)
        SampCloseDbObject(UserObject);

    return Status;
}

Referenced by SamrGetMembersInGroup().

SampInitDatabase()

NTSTATUS SampInitDatabase

(

VOID

)

Definition at line 19 of file database.c.

{
    NTSTATUS Status;

    TRACE("SampInitDatabase()\n");

    Status = SampRegOpenKey(NULL,
                            L"\\Registry\\Machine\\SAM",
                            KEY_READ | KEY_CREATE_SUB_KEY | KEY_ENUMERATE_SUB_KEYS,
                            &SamKeyHandle);
    if (!NT_SUCCESS(Status))
    {
        ERR("Failed to open the SAM key (Status: 0x%08lx)\n", Status);
        return Status;
    }

    TRACE("SampInitDatabase() done\n");

    return STATUS_SUCCESS;
}

Referenced by SamIInitialize().

SampInitializeSAM()

BOOL SampInitializeSAM

(

VOID

)

Definition at line 888 of file setup.c.

{
    PPOLICY_ACCOUNT_DOMAIN_INFO AccountDomainInfo = NULL;
    HANDLE hSamKey = NULL;
    HANDLE hServerKey = NULL;
    HANDLE hBuiltinDomainKey = NULL;
    HANDLE hAccountDomainKey = NULL;
    PSID pBuiltinSid = NULL;
    PSID pInteractiveSid = NULL;
    PSID pAuthenticatedUserSid = NULL;
    BOOL bResult = TRUE;
    PSID pSid;
    HINSTANCE hInstance;
    WCHAR szComment[256];
    WCHAR szName[80];
    NTSTATUS Status;

    TRACE("SampInitializeSAM() called\n");

    hInstance = GetModuleHandleW(L"samsrv.dll");

    /* Open the SAM key */
    Status = SampRegOpenKey(NULL,
                            L"\\Registry\\Machine\\SAM",
                            KEY_READ | KEY_CREATE_SUB_KEY | KEY_ENUMERATE_SUB_KEYS,
                            &hSamKey);
    if (!NT_SUCCESS(Status))
    {
        ERR("Failed to open the SAM key (Status: 0x%08lx)\n", Status);
        return FALSE;
    }

    /* Create the SAM Server object */
    Status = SampSetupCreateServer(hSamKey,
                                   &hServerKey);
    if (!NT_SUCCESS(Status))
    {
        bResult = FALSE;
        goto done;
    }

    /* Create and initialize the Builtin Domain SID */
    pBuiltinSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, RtlLengthRequiredSid(1));
    if (pBuiltinSid == NULL)
    {
        ERR("Failed to allocate the Builtin Domain SID\n");
        bResult = FALSE;
        goto done;
    }

    RtlInitializeSid(pBuiltinSid, &SecurityNtAuthority, 1);
    *(RtlSubAuthoritySid(pBuiltinSid, 0)) = SECURITY_BUILTIN_DOMAIN_RID;

    /* Create and initialize the Interactive SID */
    pInteractiveSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, RtlLengthRequiredSid(1));
    if (pInteractiveSid == NULL)
    {
        ERR("Failed to allocate the Interactive SID\n");
        bResult = FALSE;
        goto done;
    }

    RtlInitializeSid(pInteractiveSid, &SecurityNtAuthority, 1);
    *(RtlSubAuthoritySid(pInteractiveSid, 0)) = SECURITY_INTERACTIVE_RID;

    /* Create and initialize the Authenticated User SID */
    pAuthenticatedUserSid = RtlAllocateHeap(RtlGetProcessHeap(), 0, RtlLengthRequiredSid(1));
    if (pAuthenticatedUserSid == NULL)
    {
        ERR("Failed to allocate the Authenticated User SID\n");
        bResult = FALSE;
        goto done;
    }

    RtlInitializeSid(pAuthenticatedUserSid, &SecurityNtAuthority, 1);
    *(RtlSubAuthoritySid(pAuthenticatedUserSid, 0)) = SECURITY_AUTHENTICATED_USER_RID;

    /* Get account domain information */
    Status = SampGetAccountDomainInfo(&AccountDomainInfo);
    if (!NT_SUCCESS(Status))
    {
        ERR("SampGetAccountDomainInfo failed (Status %08lx)\n", Status);
        bResult = FALSE;
        goto done;
    }

    SampLoadString(hInstance, IDS_DOMAIN_BUILTIN_NAME, szName, 80);

    /* Create the Builtin domain */
    Status = SampSetupCreateDomain(hServerKey,
                                   L"Builtin",
                                   szName,
                                   pBuiltinSid,
                                   TRUE,
                                   &hBuiltinDomainKey);
    if (!NT_SUCCESS(Status))
    {
        bResult = FALSE;
        goto done;
    }

    SampLoadString(hInstance, IDS_ALIAS_ADMINISTRATORS_NAME, szName, 80);
    SampLoadString(hInstance, IDS_ALIAS_ADMINISTRATORS_COMMENT, szComment, 256);

        SampSetupCreateAliasAccount(hBuiltinDomainKey,
                                    szName,
                                    szComment,
                                    DOMAIN_ALIAS_RID_ADMINS);

        SampLoadString(hInstance, IDS_ALIAS_USERS_NAME, szName, 80);
        SampLoadString(hInstance, IDS_ALIAS_USERS_COMMENT, szComment, 256);

        SampSetupCreateAliasAccount(hBuiltinDomainKey,
                                    szName,
                                    szComment,
                                    DOMAIN_ALIAS_RID_USERS);

        SampLoadString(hInstance, IDS_ALIAS_GUESTS_NAME, szName, 80);
        SampLoadString(hInstance, IDS_ALIAS_GUESTS_COMMENT, szComment, 256);

        SampSetupCreateAliasAccount(hBuiltinDomainKey,
                                    szName,
                                    szComment,
                                    DOMAIN_ALIAS_RID_GUESTS);

        SampLoadString(hInstance, IDS_ALIAS_POWER_USERS_NAME, szName, 80);
        SampLoadString(hInstance, IDS_ALIAS_POWER_USERS_COMMENT, szComment, 256);

        SampSetupCreateAliasAccount(hBuiltinDomainKey,
                                    szName,
                                    szComment,
                                    DOMAIN_ALIAS_RID_POWER_USERS);

        /* Add the Administrator user to the Administrators alias */
        pSid = AppendRidToSid(AccountDomainInfo->DomainSid,
                              DOMAIN_USER_RID_ADMIN);
        if (pSid != NULL)
        {
            SampSetupAddMemberToAlias(hBuiltinDomainKey,
                                      DOMAIN_ALIAS_RID_ADMINS,
                                      pSid);

            RtlFreeHeap(RtlGetProcessHeap(), 0, pSid);
        }

        /* Add the Guest user to the Guests alias */
        pSid = AppendRidToSid(AccountDomainInfo->DomainSid,
                              DOMAIN_USER_RID_GUEST);
        if (pSid != NULL)
        {
            SampSetupAddMemberToAlias(hBuiltinDomainKey,
                                      DOMAIN_ALIAS_RID_GUESTS,
                                      pSid);

            RtlFreeHeap(RtlGetProcessHeap(), 0, pSid);
        }

    /* Add the Interactive SID to the Users alias */
    SampSetupAddMemberToAlias(hBuiltinDomainKey,
                              DOMAIN_ALIAS_RID_USERS,
                              pInteractiveSid);

    /* Add the Authenticated User SID to the Users alias */
    SampSetupAddMemberToAlias(hBuiltinDomainKey,
                              DOMAIN_ALIAS_RID_USERS,
                              pAuthenticatedUserSid);

    /* Create the Account domain */
    Status = SampSetupCreateDomain(hServerKey,
                                   L"Account",
                                   L"",
                                   AccountDomainInfo->DomainSid,
                                   FALSE,
                                   &hAccountDomainKey);
    if (!NT_SUCCESS(Status))
    {
        bResult = FALSE;
        goto done;
    }

        SampLoadString(hInstance, IDS_GROUP_NONE_NAME, szName, 80);
        SampLoadString(hInstance, IDS_GROUP_NONE_COMMENT, szComment, 256);

        SampSetupCreateGroupAccount(hAccountDomainKey,
                                    szName,
                                    szComment,
                                    DOMAIN_GROUP_RID_USERS);

        SampLoadString(hInstance, IDS_USER_ADMINISTRATOR_NAME, szName, 80);
        SampLoadString(hInstance, IDS_USER_ADMINISTRATOR_COMMENT, szComment, 256);

        SampSetupCreateUserAccount(hAccountDomainKey,
                                   szName,
                                   szComment,
                                   AccountDomainInfo->DomainSid,
                                   DOMAIN_USER_RID_ADMIN,
                                   USER_DONT_EXPIRE_PASSWORD | USER_NORMAL_ACCOUNT);

        SampSetupAddMemberToGroup(hAccountDomainKey,
                                  DOMAIN_GROUP_RID_USERS,
                                  DOMAIN_USER_RID_ADMIN);

        SampLoadString(hInstance, IDS_USER_GUEST_NAME, szName, 80);
        SampLoadString(hInstance, IDS_USER_GUEST_COMMENT, szComment, 256);

        SampSetupCreateUserAccount(hAccountDomainKey,
                                   szName,
                                   szComment,
                                   AccountDomainInfo->DomainSid,
                                   DOMAIN_USER_RID_GUEST,
                                   USER_ACCOUNT_DISABLED | USER_DONT_EXPIRE_PASSWORD | USER_NORMAL_ACCOUNT);

        SampSetupAddMemberToGroup(hAccountDomainKey,
                                  DOMAIN_GROUP_RID_USERS,
                                  DOMAIN_USER_RID_GUEST);

done:
    if (AccountDomainInfo)
        LsaFreeMemory(AccountDomainInfo);

    if (pAuthenticatedUserSid)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pAuthenticatedUserSid);

    if (pInteractiveSid)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pInteractiveSid);

    if (pBuiltinSid)
        RtlFreeHeap(RtlGetProcessHeap(), 0, pBuiltinSid);

    SampRegCloseKey(&hAccountDomainKey);
    SampRegCloseKey(&hBuiltinDomainKey);
    SampRegCloseKey(&hServerKey);
    SampRegCloseKey(&hSamKey);

    TRACE("SampInitializeSAM() done\n");

    return bResult;
}