Tuesday, March 26, 2013
USER AUTH IUPnU Device Host
http://msdn.microsoft.com/en-us/library/aa381805(v=vs.85).aspx
IUPnPRegistrar interface
0 out of 1 rated this helpful - Rate this topicThe IUPnPRegistrar interface registers the devices that run in the context of the device host.
When to implement
Do not implement this interface. The Microsoft standard implementation provides complete functionality.
When to use
Use this interface to register a device on a UPnP network.The GUID used to unregister is not the UDN. You must use the ID returned to you by IUPnPRegistrar::RegisterDevice orIUPnPRegistrar::RegisterRunningDevice.Note Do not call any method from within an IUPnPRegistrarmethod, except IUPnPRegistrar::GetUniqueDeviceName.
Members
The IUPnPRegistrar interface inherits from the IUnknowninterface. IUPnPRegistrar also has these types of members:Methods
Methods
The IUPnPRegistrar interface has these methods.MethodDescriptionGetUniqueDeviceNameMethod that retrieves the UDN of a device. This method is re-entrant.RegisterDeviceMethod that registers a non-running device with the device host. The device persists across system boots.RegisterDeviceProviderMethod that registers a device provider with the device host.RegisterRunningDeviceMethod that registers a running device with the device host.UnregisterDeviceMethod that unregisters the device.UnregisterDeviceProviderMethod that unregisters a device provider.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverNone supported [desktop apps only]HeaderUpnphost.hDLLUpnphost.dll
Syntax
C++ HRESULT UnregisterDeviceProvider( [in] BSTR bstrProviderName );
IUPnPRegistrar::GetUniqueDeviceName method
This topic has not yet been rated - Rate this topicThe GetUniqueDeviceName method retrieves the UDN for the specified device. The UDN has been generated by the device host for each embedded device. The template UDN in the device description is replaced by this generated UDN for each embedded device when the device is registered. This method is re-entrant.
Syntax
C++ HRESULT GetUniqueDeviceName( [in] BSTR bstrDeviceIdentifier, [in] BSTR bstrTemplateUDN, [out] BSTR *pbstrUDN );
Parameters
bstrDeviceIdentifier [in]Specifies the identifier returned by RegisterDevice orRegisterRunningDevice.bstrTemplateUDN [in]Specifies the UDN from the device description template.pbstrUDN [out]Receives the device's UDN that was generated by the device host.
Return value
If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.
Remarks
Each UDN specified for a device in the device description template is replaced during registration. The device host replaces each UDN with a globally unique one.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverNone supported [desktop apps only]HeaderUpnphost.hDLLUpnphost.dll
See also
IUPnPRegistrar
IUPnPRegistrar::UnregisterDeviceProvider method
This topic has not yet been rated - Rate this topicThe UnregisterDeviceProvider method permanently unregisters and unloads the device provider from the device host. The IUPnPDeviceProvider::Stop method is invoked.
Syntax
C++ HRESULT UnregisterDeviceProvider( [in] BSTR bstrProviderName );
Parameters
bstrProviderName [in]Specifies the provider name. Use the same name that was used in the call to RegisterDeviceProvider.
Return value
If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverNone supported [desktop apps only]HeaderUpnphost.hDLLUpnphost.dll
See also
IUPnPRegistrar Send com
Syntax
C++ HRESULT GetUniqueDeviceName( [in] BSTR bstrDeviceIdentifier, [in] BSTR bstrTemplateUDN, [out] BSTR *pbstrUDN );
USER AUTH Device Host
About the Device Host API
This topic has not yet been rated - Rate this topicThe Device Host API with UPnP technology is a framework for implementing UPnP-based device functionality on the Windows platform. Developers who are creating devices by using the Device Host API with UPnP technology (referred to as hosted devices) need only implement the device's core functionality. Developers can rely on the device host to handle the UPnP-specific details of discovery, description, control, eventing, and presentation. The device host validates incoming data from UPnP-based clients and formats all outgoing data from hosted devices according to the UPnP device architecture.The following sections explain, in general, how the UPnP device host works:Implementing a Hosted DeviceRegistering a Hosted Device with the Device HostDevice ProvidersEventingPresentation
Device Providers
This topic has not yet been rated - Rate this topicDevice providers are registered objects that the computer starts on every system startup. Device providers register and unregister running devices with the device host in response to some event. These devices are devices that have been automatically started at system startup time. For security reasons, a device provider should generally run as LocalService, rather than LocalSystem.Device providers can be used for transient devices. Device providers can also be used to bridge devices to polled media. For example, a peripheral device such as a digital music player is connected to a computer via a serial port. To expose the music player as a UPnP-based device, a device control object and a set of service objects are required. These objects implement the UPnP-based music player actions as serial commands. However, the music player must be plugged into the serial port and available for control before these objects are registered.Because the serial port does not offer an explicit notification mechanism when devices are connected, polling code is required. This code can be implemented in a device provider object, a service, or in a standalone application. When the computer is started, the device host instantiates the device provider object, and then invokes itsStart method. When the device provider detects the presence of a music player device, it instantiates the appropriate device control object and registers it by callingIUPnPRegistrar::RegisterRunningDevice. This method publishes the device and announces it to the UPnP-based network.The same functionality can also be achieved by implementing a service that polls the serial port. However, device providers simplify things by requiring only the core functionality—the polling—to be implemented because device providers rely on the device host to start and stop them. Using device providers is simpler than implementing a service.At registration time, and on every subsequent system startup, the computer instantiates the device provider object, and then invokes its IUPnPDeviceProvider::Startmethod, passing it the initialization string specified during registration.Once the Start method is called, the device provider performs any necessary processing, and when necessary, the device provider registers devices by callingIUPnPRegistrar::RegisterRunningDevice, as described in the section Registering a Hosted Device with the Device Host.When the computer is shut down, the device host invokes the IUPnPDeviceProvider::Stop method to indicate that the device provider terminate its operations.
Eventing
0 out of 1 rated this helpful - Rate this topicA hosted service must implement the IUPnPEventSourceinterface if it has evented state variables. This interface has two methods: Advise and Unadvise. This interface provides a mechanism for the device host to subscribe to event notifications generated by the hosted service. There will be no more than one event sink registered at a time.A hosted service must implement the Advise method by holding a reference to the IUPnPEventSink interface, which was passed as a parameter. If the interface is found, theAdvise method holds a reference to that interface untilUnadvise is invoked, or until the hosted service object is removed. Advise is called only once.To remove the subscription, the device host invokesUnadvise and passes in the object pointer used when it called Advise. The hosted service removes the subscription if the pointer is the same as the one passed to Advise.When a state variable's value changes, the hosted service must signal that an event has occurred. The services does this by invoking the IUPnPEventSink::OnStateChangedmethod.When the device host no longer needs to receive notifications from the hosted service, it invokesIUPnPEventSource::Unadvise, passing in the same object pointer that it received from Advise. The device host invokes this method when the device is no longer going to be on the network.
Presentation
3 out of 4 rated this helpful - Rate this topicPresentation is the final step in the UPnP process. If a device has a URL for presentation, a control point can retrieve a page from this URL and load the page into a browser. Depending on the capabilities of the presentation page and the device, the control point can control the device and view the status of the device.The resource path, which is passed to IUPnPRegistrarduring registration, is where all the files relevant to the presentation of the device are located. Device developers can provide separate pages for each embedded device. The presentation URL in the device description template can either be an absolute URL or a relative URL. For relative URLs, which are relative to the resource path, the device description template should contain a file name.IUPnPRegistrar converts this to a URL with the actual location. For absolute URLs, the location is not modified.To support client side scripts within a presentation page, extra information is normally appended to the URL in the form of a "query string". The extra information that is appended is the URL to the device description document, and the UDN of the device or embedded device. The device description URL can be used to load a description document in the script, and then control the device through its services. The UDN is used to select an embedded device from the root device.The format of the modified presentation URL is: the actual presentation URL, a question mark ("?"), the device description URL, a plus sign ("+"), the device UDN. The question mark denotes the start of the query string.If the presentation URL in the device description template was an absolute URL and it already contained a question mark ("?"), then the extra information is not added to the presentation URL.
DescriptionURLIn the device description templatepresentationURLMyDevice.html/presentationURLGenerated by the device hostpresentationURLhttp://machinename/deviceID/MyDevice.html/?http://machine/upnphost/udhisapi.dll?content=uuid:487394… + UDN/presentationURL
A client-side script may have to extract the device description URL from the presentation URL to load theIUPnPDescriptionDocument object. This is done by taking the query string, and terminating it at the plus sign ("+").
VBDim QueryString QueryString = window.location.search Dim DescURLString DescURLString = Trim(Mid(QueryString,2,Instr(QueryString,"+")-2))& vbCrLf Dim LightDesc Set LightDesc = CreateObject("UPnP.DescriptionDocument.1") LightDesc.Load(DescURLString)
In the case of a presentation page for an embedded device, some additional work is required. After loading the UPnPDescriptionDocument, the script must obtain the collection of embedded devices, then select the device that matches the UDN in the query string. The following script shows how to select the embedded device for the current presentation page. It assumes LightDesc is already loaded.
VBDim LightDevice Set LightDevice = LightDesc.RootDevice Dim EmbeddedDevices set EmbeddedDevices = LightDevice.Children Dim DeviceUdnString DeviceUdnString = Trim(Mid(QueryString,Instr(QueryString,"+")+1,Len(QueryString))) Dim Item set Item = EmbeddedDevices.Item(DeviceUdnString)
http://msdn.microsoft.com/en-us/library/aa382263(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/aa382303(v=vs.85).aspx
Monday, March 25, 2013
USER AUTH Enviromental Variables
Environment Variables
7 out of 17 rated this helpful - Rate this topicEvery process has an environment block that contains a set of environment variables and their values. There are two types of environment variables: user environment variables (set for each user) and system environment variables (set for everyone).By default, a child process inherits the environment variables of its parent process. Programs started by the command processor inherit the command processor's environment variables. To specify a different environment for a child process, create a new environment block and pass a pointer to it as a parameter to the CreateProcessfunction.The command processor provides the set command to display its environment block or to create new environment variables. You can also view or modify the environment variables by selecting System from the Control Panel, selecting Advanced system settings, and clicking Environment Variables.Each environment block contains the environment variables in the following format:Var1=Value1\0Var2=Value2\0Var3=Value3\0...VarN=ValueN\0\0The name of an environment variable cannot include an equal sign (=).The GetEnvironmentStrings function returns a pointer to the environment block of the calling process. This should be treated as a read-only block; do not modify it directly. Instead, use the SetEnvironmentVariable function to change an environment variable. When you are finished with the environment block obtained from GetEnvironmentStrings, call the FreeEnvironmentStrings function to free the block.Calling SetEnvironmentVariable has no effect on the system environment variables. To programmatically add or modify system environment variables, add them to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment registry key, then broadcast a WM_SETTINGCHANGE message with lParamset to the string "Environment". This allows applications, such as the shell, to pick up your updates.The maximum size of a user-defined environment variable is 32,767 characters. There is no technical limitation on the size of the environment block. However, there are practical limits depending on the mechanism used to access the block. For example, a batch file cannot set a variable that is longer than the maximum command line length.Windows Server 2003 and Windows XP: The maximum size of the environment block for the process is 32,767 characters. Starting with Windows Vista and Windows Server 2008, there is no technical limitation on the size of the environment block.The GetEnvironmentVariable function determines whether a specified variable is defined in the environment of the calling process, and, if so, what its value is.To retrieve a copy of the environment block for a given user, use the CreateEnvironmentBlock function.To expand environment-variable strings, use the ExpandEnvironmentStrings function.
Related topics
Changing Environment VariablesUser Environment Variables
PowerShell has a standard provider for environment variables named "env:".The environment variables can be listed byGet-ChildItem env:The value of a given environment variable can be achieved by$env:<variable name>Example:$env:TEMPA userdefined environment variable can be created with the assignment operator "=":$env:<variable name>=<value>Example:$env:myvar=42
http://msdn.microsoft.com/en-us/library/ms682653(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/aa379198(v=vs.85).aspx
Changing Environment Variables
6 out of 20 rated this helpful - Rate this topicEach process has an environment block associated with it. The environment block consists of a null-terminated block of null-terminated strings (meaning there are two null bytes at the end of the block), where each string is in the form:name=valueAll strings in the environment block must be sorted alphabetically by name. The sort is case-insensitive, Unicode order, without regard to locale. Because the equal sign is a separator, it must not be used in the name of an environment variable.
--------------
Example 1
By default, a child process inherits a copy of the environment block of the parent process. The following example demonstrates how to create a new environment block to pass to a child process using CreateProcess.This example uses the code in example three as the child process, Ex3.exe.
C++ #include <windows.h> #include <tchar.h> #include <stdio.h> #include <strsafe.h> #define BUFSIZE 4096 int _tmain() { TCHAR chNewEnv[BUFSIZE]; LPTSTR lpszCurrentVariable; DWORD dwFlags=0; TCHAR szAppName[]=TEXT("ex3.exe"); STARTUPINFO si; PROCESS_INFORMATION pi; BOOL fSuccess; // Copy environment strings into an environment block. lpszCurrentVariable = (LPTSTR) chNewEnv; if (FAILED(StringCchCopy(lpszCurrentVariable, BUFSIZE, TEXT("MySetting=A")))) { printf("String copy failed\n"); return FALSE; } lpszCurrentVariable += lstrlen(lpszCurrentVariable) + 1; if (FAILED(StringCchCopy(lpszCurrentVariable, BUFSIZE, TEXT("MyVersion=2")))) { printf("String copy failed\n"); return FALSE; } // Terminate the block with a NULL byte. lpszCurrentVariable += lstrlen(lpszCurrentVariable) + 1; *lpszCurrentVariable = (TCHAR)0; // Create the child process, specifying a new environment block. SecureZeroMemory(&si, sizeof(STARTUPINFO)); si.cb = sizeof(STARTUPINFO); #ifdef UNICODE dwFlags = CREATE_UNICODE_ENVIRONMENT;
7 out of 17 rated this helpful - Rate this topicEvery process has an environment block that contains a set of environment variables and their values. There are two types of environment variables: user environment variables (set for each user) and system environment variables (set for everyone).By default, a child process inherits the environment variables of its parent process. Programs started by the command processor inherit the command processor's environment variables. To specify a different environment for a child process, create a new environment block and pass a pointer to it as a parameter to the CreateProcessfunction.The command processor provides the set command to display its environment block or to create new environment variables. You can also view or modify the environment variables by selecting System from the Control Panel, selecting Advanced system settings, and clicking Environment Variables.Each environment block contains the environment variables in the following format:Var1=Value1\0Var2=Value2\0Var3=Value3\0...VarN=ValueN\0\0The name of an environment variable cannot include an equal sign (=).The GetEnvironmentStrings function returns a pointer to the environment block of the calling process. This should be treated as a read-only block; do not modify it directly. Instead, use the SetEnvironmentVariable function to change an environment variable. When you are finished with the environment block obtained from GetEnvironmentStrings, call the FreeEnvironmentStrings function to free the block.Calling SetEnvironmentVariable has no effect on the system environment variables. To programmatically add or modify system environment variables, add them to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment registry key, then broadcast a WM_SETTINGCHANGE message with lParamset to the string "Environment". This allows applications, such as the shell, to pick up your updates.The maximum size of a user-defined environment variable is 32,767 characters. There is no technical limitation on the size of the environment block. However, there are practical limits depending on the mechanism used to access the block. For example, a batch file cannot set a variable that is longer than the maximum command line length.Windows Server 2003 and Windows XP: The maximum size of the environment block for the process is 32,767 characters. Starting with Windows Vista and Windows Server 2008, there is no technical limitation on the size of the environment block.The GetEnvironmentVariable function determines whether a specified variable is defined in the environment of the calling process, and, if so, what its value is.To retrieve a copy of the environment block for a given user, use the CreateEnvironmentBlock function.To expand environment-variable strings, use the ExpandEnvironmentStrings function.
Related topics
Changing Environment VariablesUser Environment Variables
PowerShell has a standard provider for environment variables named "env:".The environment variables can be listed byGet-ChildItem env:The value of a given environment variable can be achieved by$env:<variable name>Example:$env:TEMPA userdefined environment variable can be created with the assignment operator "=":$env:<variable name>=<value>Example:$env:myvar=42
http://msdn.microsoft.com/en-us/library/ms682653(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/aa379198(v=vs.85).aspx
Changing Environment Variables
6 out of 20 rated this helpful - Rate this topicEach process has an environment block associated with it. The environment block consists of a null-terminated block of null-terminated strings (meaning there are two null bytes at the end of the block), where each string is in the form:name=valueAll strings in the environment block must be sorted alphabetically by name. The sort is case-insensitive, Unicode order, without regard to locale. Because the equal sign is a separator, it must not be used in the name of an environment variable.
--------------
Example 1
By default, a child process inherits a copy of the environment block of the parent process. The following example demonstrates how to create a new environment block to pass to a child process using CreateProcess.This example uses the code in example three as the child process, Ex3.exe.
C++ #include <windows.h> #include <tchar.h> #include <stdio.h> #include <strsafe.h> #define BUFSIZE 4096 int _tmain() { TCHAR chNewEnv[BUFSIZE]; LPTSTR lpszCurrentVariable; DWORD dwFlags=0; TCHAR szAppName[]=TEXT("ex3.exe"); STARTUPINFO si; PROCESS_INFORMATION pi; BOOL fSuccess; // Copy environment strings into an environment block. lpszCurrentVariable = (LPTSTR) chNewEnv; if (FAILED(StringCchCopy(lpszCurrentVariable, BUFSIZE, TEXT("MySetting=A")))) { printf("String copy failed\n"); return FALSE; } lpszCurrentVariable += lstrlen(lpszCurrentVariable) + 1; if (FAILED(StringCchCopy(lpszCurrentVariable, BUFSIZE, TEXT("MyVersion=2")))) { printf("String copy failed\n"); return FALSE; } // Terminate the block with a NULL byte. lpszCurrentVariable += lstrlen(lpszCurrentVariable) + 1; *lpszCurrentVariable = (TCHAR)0; // Create the child process, specifying a new environment block. SecureZeroMemory(&si, sizeof(STARTUPINFO)); si.cb = sizeof(STARTUPINFO); #ifdef UNICODE dwFlags = CREATE_UNICODE_ENVIRONMENT;
USER AUTH LowLevel
Low-level Access Control
1 out of 1 rated this helpful - Rate this topicLow-level security functions help you work with security descriptors, access control lists (ACLs), and access control entries (ACEs).For a description of the model, see Access Control Model.TopicDescriptionLow-level Security Descriptor FunctionsFunctions for setting and retrieving an object's security descriptor.Low-level Security Descriptor CreationFunctions for creating a security descriptor and getting and setting the components of a security descriptor.Absolute and Self-Relative Security DescriptorsFunctions for checking or converting between absolute or self-relativeformat.Low-level ACL and ACE FunctionsFunctions for managing ACLs and ACEs.
Absolute and Self-Relative Security Descriptors
This topic has not yet been rated - Rate this topicA security descriptor can be in either absolute or self-relative format. In absolute format, a security descriptor contains pointers to its information, not the information itself. In self-relative format, a security descriptor stores aSECURITY_DESCRIPTOR structure and associated security information in a contiguous block of memory. To determine whether a security descriptor is self-relative or absolute, call the GetSecurityDescriptorControl function and check the SE_SELF_RELATIVE flag of theSECURITY_DESCRIPTOR_CONTROL parameter. You can use the MakeSelfRelativeSD and MakeAbsoluteSDfunctions for converting between these two formats.The absolute format is useful when you are building a security descriptor and have pointers to all of the components, for example, when default settings for the owner, group, and discretionary ACL are available. In this case, you can call the InitializeSecurityDescriptor function to initialize a SECURITY_DESCRIPTOR structure, and then call functions such as SetSecurityDescriptorDacl to assign ACL and SID pointers to the security descriptor.In self-relative format, a security descriptor always begins with a SECURITY_DESCRIPTOR structure, but the other components of the security descriptor can follow the structure in any order. Instead of using memory addresses, the security descriptor's components are identified by offsets from the beginning of the descriptor. This format is useful when a security descriptor must be stored on disk, transmitted by means of a communications protocol, or copied in memory.Except for MakeAbsoluteSD, all functions that return a security descriptor do so using the self-relative format. Security descriptors passed as arguments to a function can be either self-relative or absolute form. For more information, refer to the documentation for the function. Send comments about this topic to Microsoft
Low-level Security Descriptor Creation
This topic has not yet been rated - Rate this topicLow-level access control provides a set of functions for creating a security descriptor and getting and setting the components of a security descriptor. The low-level functions for initializing and setting the components of a security descriptor work only with absolute-format security descriptors. The low-level functions for getting the components of a security descriptor work with bothabsolute and self-relative security descriptors.The InitializeSecurityDescriptor function initializes aSECURITY_DESCRIPTOR buffer. The initialized security descriptor is in absolute format and has no owner, primary group, discretionary access control list (DACL), or system access control list (SACL). You can use the following low-level functions to get or set specific components of a specified security descriptor.FunctionDescriptionGetSecurityDescriptorControlRetrieves revision and control information from a security descriptor.GetSecurityDescriptorDaclRetrieves the DACL from a security descriptor.GetSecurityDescriptorGroupRetrieves the primary group security identifier(SID) from a security descriptor.GetSecurityDescriptorLengthReturns the length of a security descriptor.GetSecurityDescriptorOwnerRetrieves the owner SID from a security descriptor.GetSecurityDescriptorSaclRetrieves the SACL from a security descriptor.SetSecurityDescriptorDaclPuts a DACL into a security descriptor, superseding any existing DACL.SetSecurityDescriptorGroupSets the primary group SID of a security descriptor.SetSecurityDescriptorOwnerSets the owner SID of a security descriptor.SetSecurityDescriptorSaclPuts a SACL into a security descriptor, superseding any existing SACL. To check the revision level and structural integrity of a security descriptor, call the IsValidSecurityDescriptorfunction. Send comments about this topic to MicrosoftBuild date: 10/26/2012
http://msdn.microsoft.com/en-us/library/aa379306(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/aa374807(v=vs.85).aspx
USER AUTHORIZE Privileges
http://msdn.microsoft.com/en-us/library/bb530716(v=vs.85).aspx
Privilege Constants
10 out of 15 rated this helpful - Rate this topicPrivileges determine the type of system operations that a user account can perform. An administrator assigns privileges to user and group accounts. Each user's privileges include those granted to the user and to the groups to which the user belongs.The functions that get and adjust the privileges in an access token use the locally unique identifier (LUID) type to identify privileges. Use the LookupPrivilegeValue function to determine the LUID on the local system that corresponds to a privilege constant. Use the LookupPrivilegeNamefunction to convert a LUID to its corresponding string constant.The operating system represents a privilege by using the string that follows "User Right" in the Description column of the following table. The operating system displays the user right strings in the Policy column of the User Rights Assignment node of the Local Security Settings Microsoft Management Console (MMC) snap-in.Constant/valueDescriptionSE_ASSIGNPRIMARYTOKEN_NAMETEXT("SeAssignPrimaryTokenPrivilege")Required to assign the primary token of a process.User Right: Replace a process-level token.SE_AUDIT_NAMETEXT("SeAuditPrivilege")Required to generate audit-log entries. Give this privilege to secure servers.User Right: Generate security audits.SE_BACKUP_NAMETEXT("SeBackupPrivilege")Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of theaccess control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyExfunctions. The following access rights are granted if this privilege is held:READ_CONTROLACCESS_SYSTEM_SECURITYFILE_GENERIC_READFILE_TRAVERSEUser Right: Back up files and directories.SE_CHANGE_NOTIFY_NAMETEXT("SeChangeNotifyPrivilege")Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks. It is enabled by default for all users.User Right: Bypass traverse checking.SE_CREATE_GLOBAL_NAMETEXT("SeCreateGlobalPrivilege")Required to create named file mapping objects in the global namespace during Terminal Services sessions. This privilege is enabled by default for administrators, services, and the local system account.User Right: Create global objects.SE_CREATE_PAGEFILE_NAMETEXT("SeCreatePagefilePrivilege")Required to create a paging file.User Right: Create a pagefile.SE_CREATE_PERMANENT_NAMETEXT("SeCreatePermanentPrivilege")Required to create a permanent object.User Right: Create permanent shared objects.SE_CREATE_SYMBOLIC_LINK_NAMETEXT("SeCreateSymbolicLinkPrivilege")Required to create a symbolic link.User Right: Create symbolic links.SE_CREATE_TOKEN_NAMETEXT("SeCreateTokenPrivilege")Required to create a primary token.User Right: Create a token object.You cannot add this privilege to a user account with the "Create a token object" policy. Additionally, you cannot add this privilege to an owned process using Windows APIs.Windows Server 2003 and Windows XP with SP1 and earlier: Windows APIs can add this privilege to an owned process.SE_DEBUG_NAMETEXT("SeDebugPrivilege")Required to debug and adjust the memory of a process owned by another account.User Right: Debug programs.SE_ENABLE_DELEGATION_NAMETEXT("SeEnableDelegationPrivilege")Required to mark user and computer accounts as trusted for delegation.User Right: Enable computer and user accounts to be trusted for delegation.SE_IMPERSONATE_NAMETEXT("SeImpersonatePrivilege")Required to impersonate.User Right: Impersonate a client after authentication.SE_INC_BASE_PRIORITY_NAMETEXT("SeIncreaseBasePriorityPrivilege")Required to increase the base priority of a process.User Right: Increase scheduling priority.SE_INCREASE_QUOTA_NAMETEXT("SeIncreaseQuotaPrivilege")Required to increase the quota assigned to a process.User Right: Adjust memory quotas for a process.SE_INC_WORKING_SET_NAMETEXT("SeIncreaseWorkingSetPrivilege")Required to allocate more memory for applications that run in the context of users.User Right: Increase a process working set.SE_LOAD_DRIVER_NAMETEXT("SeLoadDriverPrivilege")Required to load or unload a device driver.User Right: Load and unload device drivers.SE_LOCK_MEMORY_NAMETEXT("SeLockMemoryPrivilege")Required to lock physical pages in memory.User Right: Lock pages in memory.SE_MACHINE_ACCOUNT_NAMETEXT("SeMachineAccountPrivilege")Required to create a computer account.User Right: Add workstations to domain.SE_MANAGE_VOLUME_NAMETEXT("SeManageVolumePrivilege")Required to enable volume management privileges.User Right: Manage the files on a volume.SE_PROF_SINGLE_PROCESS_NAMETEXT("SeProfileSingleProcessPrivilege")Required to gather profiling information for a single process.User Right: Profile single process.SE_RELABEL_NAMETEXT("SeRelabelPrivilege")Required to modify the mandatory integrity level of an object.User Right: Modify an object label.SE_REMOTE_SHUTDOWN_NAMETEXT("SeRemoteShutdownPrivilege")Required to shut down a system using a network request.User Right: Force shutdown from a remote system.SE_RESTORE_NAMETEXT("SeRestorePrivilege")Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. This privilege is required by the RegLoadKey function. The following access rights are granted if this privilege is held:WRITE_DACWRITE_OWNERACCESS_SYSTEM_SECURITYFILE_GENERIC_WRITEFILE_ADD_FILEFILE_ADD_SUBDIRECTORYDELETEUser Right: Restore files and directories.SE_SECURITY_NAMETEXT("SeSecurityPrivilege")Required to perform a number of security-related functions, such as controlling and viewing audit messages. This privilege identifies its holder as a security operator.User Right: Manage auditing and security log.SE_SHUTDOWN_NAMETEXT("SeShutdownPrivilege")Required to shut down a local system.User Right: Shut down the system.SE_SYNC_AGENT_NAMETEXT("SeSyncAgentPrivilege")Required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services. This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.User Right: Synchronize directory service data.SE_SYSTEM_ENVIRONMENT_NAMETEXT("SeSystemEnvironmentPrivilege")Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information.User Right: Modify firmware environment values.SE_SYSTEM_PROFILE_NAMETEXT("SeSystemProfilePrivilege")Required to gather profiling information for the entire system.User Right: Profile system performance.SE_SYSTEMTIME_NAMETEXT("SeSystemtimePrivilege")Required to modify the system time.User Right: Change the system time.SE_TAKE_OWNERSHIP_NAMETEXT("SeTakeOwnershipPrivilege")Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.User Right: Take ownership of files or other objects.SE_TCB_NAMETEXT("SeTcbPrivilege")This privilege identifies its holder as part of the trusted computer base. Some trusted protected subsystems are granted this privilege.User Right: Act as part of the operating system.SE_TIME_ZONE_NAMETEXT("SeTimeZonePrivilege")Required to adjust the time zone associated with the computer's internal clock.User Right: Change the time zone.SE_TRUSTED_CREDMAN_ACCESS_NAMETEXT("SeTrustedCredManAccessPrivilege")Required to access Credential Manager as a trusted caller.User Right: Access Credential Manager as a trusted caller.SE_UNDOCK_NAMETEXT("SeUndockPrivilege")Required to undock a laptop.User Right: Remove computer from docking station.SE_UNSOLICITED_INPUT_NAMETEXT("SeUnsolicitedInputPrivilege")Required to read unsolicited input from a terminal device.User Right: Not applicable.
Remarks
Privilege constants are defined as strings in Winnt.h. For example, the SE_AUDIT_NAME constant is defined as "SeAuditPrivilege".
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderWinnt.h
See also
Privileges Send comments about this t
Privileges
8 out of 15 rated this helpful - Rate this topicA privilege is the right of an account, such as a user or group account, to perform various system-related operations on the local computer, such as shutting down the system, loading device drivers, or changing the system time. Privileges differ from access rights in two ways:Privileges control access to system resources and system-related tasks, whereas access rights control access to securable objects.A system administrator assigns privileges to user and group accounts, whereas the system grants or denies access to a securable object based on the access rights granted in the ACEs in the object's DACL.Each system has an account database that stores the privileges held by user and group accounts. When a user logs on, the system produces an access token that contains a list of the user's privileges, including those granted to the user or to groups to which the user belongs. Note that the privileges apply only to the local computer; a domain account can have different privileges on different computers.When the user tries to perform a privileged operation, the system checks the user's access token to determine whether the user holds the necessary privileges, and if so, it checks whether the privileges are enabled. If the user fails these tests, the system does not perform the operation.To determine the privileges held in an access token, call theGetTokenInformation function, which also indicates which privileges are enabled. Most privileges are disabled by default.The Windows API defines a set of string constants, such as SE_ASSIGNPRIMARYTOKEN_NAME, to identify the various privileges. These constants are the same on all systems and are defined in Winnt.h. For a table of the privileges defined by Windows, see Privilege Constants. However, the functions that get and adjust the privileges in an access token use the LUID type to identify privileges. The LUIDvalues for a privilege can differ from one computer to another, and from one boot to another on the same computer. To get the current LUID that corresponds to one of the string constants, use the LookupPrivilegeValuefunction. Use the LookupPrivilegeName function to convert a LUID to its corresponding string constant.The system provides a set of display names that describe each of the privileges. These are useful when you need to display a description of a privilege to the user. Use theLookupPrivilegeDisplayName function to retrieve a description string that corresponds to the string constant for a privilege. For example, on systems that use U.S. English, the display name for the SE_SYSTEMTIME_NAME privilege is "Change the system time".You can use the PrivilegeCheck function to determine whether an access token holds a specified set of privileges. This is useful primarily to server applications that are impersonating a client.A system administrator can use administrative tools, such as User Manager, to add or remove privileges for user and group accounts. Administrators can programmatically use the Local Security Authority (LSA) functions to work with privileges. The LsaAddAccountRights andLsaRemoveAccountRights functions add or remove privileges from an account. TheLsaEnumerateAccountRights function enumerates the privileges held by a specified account. TheLsaEnumerateAccountsWithUserRight function enumerates the accounts that hold a specified privilege.
Related topics
Authorization ConstantsEnabling and Disabling Privileges in C++ Send comments about this topic to Microsoft
USER AUTH pt 3
http://msdn.microsoft.com/en-us/library/bb545671(v=vs.85).aspx
Account Rights Constants
4 out of 8 rated this helpful - Rate this topicAccount rights determine the type of logon that a user account can perform. An administrator assigns account rights to user and group accounts. Each user's account rights include those granted to the user and to the groups to which the user belongs.A system administrator can use the Local Security Authority(LSA) functions to work with account rights. The LsaAddAccountRights and LsaRemoveAccountRightsfunctions add or remove account rights from an account. The LsaEnumerateAccountRights function enumerates the account rights held by a specified account. The LsaEnumerateAccountsWithUserRight function enumerates the accounts that hold a specified account right.The following account right constants are used to control the logon ability of an account. The LogonUser or LsaLogonUser functions fail if the account being logged on does not have the account rights required for the type of logon being performed.Constant/valueDescriptionSE_BATCH_LOGON_NAMETEXT("SeBatchLogonRight")Required for an account to log on using the batch logon type.SE_DENY_BATCH_LOGON_NAMETEXT("SeDenyBatchLogonRight")Explicitly denies an account the right to log on using the batch logon type.SE_DENY_INTERACTIVE_LOGON_NAMETEXT("SeDenyInteractiveLogonRight")Explicitly denies an account the right to log on using the interactive logon type.SE_DENY_NETWORK_LOGON_NAMETEXT("SeDenyNetworkLogonRight")Explicitly denies an account the right to log on using the network logon type.SE_DENY_REMOTE_INTERACTIVE_LOGON_NAMETEXT("SeDenyRemoteInteractiveLogonRight")Explicitly denies an account the right to log on remotely using the interactive logon type.SE_DENY_SERVICE_LOGON_NAMETEXT("SeDenyServiceLogonRight")Explicitly denies an account the right to log on using the service logon type.SE_INTERACTIVE_LOGON_NAMETEXT("SeInteractiveLogonRight")Required for an account to log on using the interactive logon type.SE_NETWORK_LOGON_NAMETEXT("SeNetworkLogonRight")Required for an account to log on using the network logon type.SE_REMOTE_INTERACTIVE_LOGON_NAMETEXT("SeRemoteInteractiveLogonRight")Required for an account to log on remotely using the interactive logon type.SE_SERVICE_LOGON_NAMETEXT("SeServiceLogonRight")Required for an account to log on using the service logon type.
Remarks
The SE_DENY rights override the corresponding account rights. An administrator can assign an SE_DENY right to an account to override any logon rights that an account might have as a result of a group membership. For example, you could assign the SE_NETWORK_LOGON_NAME right to Everyone but assign the SE_DENY_NETWORK_LOGON_NAME right to Administrators to prevent remote administration of computers.All of the LSA functions mentioned in the introduction above support both account rights and privileges. Unlike privileges, however, account rights are not supported by theLookupPrivilegeValue and LookupPrivilegeName functions. The GetTokenInformation function will obtain information on account rights if TokenGroups, and not TokenPrivileges, is specified as the value of the TokenInformationClassparameter.The preceding account right constants are defined as strings in Ntsecapi.h. For example, the SE_INTERACTIVE_LOGON_NAME constant is defined as "SeInteractiveLogonRight".
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderNtsecapi.h
http://msdn.microsoft.com/en-us/library/aa446671(v=vs.85).aspx
GetTokenInformation function
3 out of 4 rated this helpful - Rate this topicThe GetTokenInformation function retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.To determine if a user is a member of a specific group, use the CheckTokenMembership function. To determine group membership for app container tokens, use the CheckTokenMembershipEx function.
Syntax
C++ BOOL WINAPI GetTokenInformation( _In_ HANDLE TokenHandle, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, _Out_opt_ LPVOID TokenInformation, _In_ DWORD TokenInformationLength, _Out_ PDWORD ReturnLength );
Parameters
TokenHandle [in]A handle to an access token from which information is retrieved. If TokenInformationClass specifies TokenSource, the handle must have TOKEN_QUERY_SOURCE access. For all other TokenInformationClass values, the handle must have TOKEN_QUERY access.TokenInformationClass [in]Specifies a value from theTOKEN_INFORMATION_CLASS enumerated type to identify the type of information the function retrieves. Any callers who check the TokenIsAppContainer and have it return 0 should also verify that the caller token is not an identify level impersonation token. If the current token is not an app container but is an identity level token, you should return AccessDenied.TokenInformation [out, optional]A pointer to a buffer the function fills with the requested information. The structure put into this buffer depends upon the type of information specified by the TokenInformationClass parameter.TokenInformationLength [in]Specifies the size, in bytes, of the buffer pointed to by the TokenInformation parameter. If TokenInformationis NULL, this parameter must be zero.ReturnLength [out]A pointer to a variable that receives the number of bytes needed for the buffer pointed to by the TokenInformation parameter. If this value is larger than the value specified in the TokenInformationLength parameter, the function fails and stores no data in the buffer.If the value of the TokenInformationClass parameter is TokenDefaultDacl and the token has no default DACL, the function sets the variable pointed to by ReturnLength to sizeof(TOKEN_DEFAULT_DACL)and sets the DefaultDacl member of the TOKEN_DEFAULT_DACL structure to NULL.
Return value
If the function succeeds, the return value is nonzero.If the function fails, the return value is zero. To get extended error information, call GetLastError.
Examples
For an example that uses this function, see Getting the Logon SID or Searching for a SID in an Access Token.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderWinbase.h (include Windows.h)LibraryAdvapi32.libDLLAdvapi32.dll
See also
Access Control OverviewBasic Access Control FunctionsAdjustTokenGroupsAdjustTokenPrivilegesCheckTokenMembershipOpenProcessTokenOpenThreadTokenSECURITY_IMPERSONATION_LEVELSetTokenInformationTOKEN_DEFAULT_DACLTOKEN_GROUPSTOKEN_GROUPS_AND_PRIVILEGESTOKEN_INFORMATION_CLASSTOKEN_OWNERTOKEN_PRIMARY_GROUPTOKEN_PRIVILEGESTOKEN_SOURCETOKEN_STATISTICSTOKEN_TYPETOKEN_USER
http://msdn.microsoft.com/en-us/library/aa446671(v=vs.85).aspx
DuplicateToken function
0 out of 1 rated this helpful - Rate this topicThe DuplicateToken function creates a new access tokenthat duplicates one already in existence.
Syntax
C++ BOOL WINAPI DuplicateToken( _In_ HANDLE ExistingTokenHandle, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _Out_ PHANDLE DuplicateTokenHandle );
Parameters
ExistingTokenHandle [in]A handle to an access token opened with TOKEN_DUPLICATE access.ImpersonationLevel [in]Specifies a SECURITY_IMPERSONATION_LEVELenumerated type that supplies the impersonation level of the new token.DuplicateTokenHandle [out]A pointer to a variable that receives a handle to the duplicate token. This handle has TOKEN_IMPERSONATE and TOKEN_QUERY access to the new token.When you have finished using the new token, call the CloseHandle function to close the token handle.
Return value
If the function succeeds, the return value is nonzero.If the function fails, the return value is zero. To get extended error information, call GetLastError.
Remarks
The DuplicateToken function creates an impersonation token, which you can use in functions such as SetThreadToken and ImpersonateLoggedOnUser. The token created by DuplicateToken cannot be used in the CreateProcessAsUser function, which requires a primary token. To create a token that you can pass to CreateProcessAsUser, use the DuplicateTokenEx function.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderWinbase.h (include Windows.h)LibraryAdvapi32.libDLLAdvapi32.dll
See also
http://msdn.microsoft.com/en-us/library/aa446616(v=vs.85).aspx
DuplicateTokenEx function
1 out of 3 rated this helpful - Rate this topicThe DuplicateTokenEx function creates a new access tokenthat duplicates an existing token. This function can create either a primary token or an impersonation token.
Syntax
C++ BOOL WINAPI DuplicateTokenEx( _In_ HANDLE hExistingToken, _In_ DWORD dwDesiredAccess, _In_opt_ LPSECURITY_ATTRIBUTES lpTokenAttributes, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ TOKEN_TYPE TokenType, _Out_ PHANDLE phNewToken );
Parameters
hExistingToken [in]A handle to an access token opened with TOKEN_DUPLICATE access.dwDesiredAccess [in]Specifies the requested access rights for the new token. The DuplicateTokenEx function compares the requested access rights with the existing token's discretionary access control list (DACL) to determine which rights are granted or denied. To request the same access rights as the existing token, specify zero. To request all access rights that are valid for the caller, specify MAXIMUM_ALLOWED.For a list of access rights for access tokens, seeAccess Rights for Access-Token Objects.lpTokenAttributes [in, optional]A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new token and determines whether child processes can inherit the token. If lpTokenAttributes is NULL, the token gets a default security descriptor and the handle cannot be inherited. If the security descriptor contains a system access control list (SACL), the token gets ACCESS_SYSTEM_SECURITY access right, even if it was not requested in dwDesiredAccess.To set the owner in the security descriptor for the new token, the caller's process token must have the SE_RESTORE_NAME privilege set.ImpersonationLevel [in]Specifies a value from theSECURITY_IMPERSONATION_LEVEL enumeration that indicates the impersonation level of the new token.TokenType [in]Specifies one of the following values from the TOKEN_TYPE enumeration.ValueMeaningTokenPrimaryThe new token is a primary token that you can use in the CreateProcessAsUserfunction.TokenImpersonationThe new token is an impersonation token. phNewToken [out]A pointer to a HANDLE variable that receives the new token.When you have finished using the new token, call the CloseHandle function to close the token handle.
Return value
If the function succeeds, the function returns a nonzero value.If the function fails, it returns zero. To get extended error information, call GetLastError.
Remarks
The DuplicateTokenEx function allows you to create a primary token that you can use in the CreateProcessAsUserfunction. This allows a server application that is impersonating a client to create a process that has the security context of the client. Note that the DuplicateTokenfunction can create only impersonation tokens, which are not valid for CreateProcessAsUser.The following is a typical scenario for using DuplicateTokenEx to create a primary token. A server application creates a thread that calls one of the impersonation functions, such asImpersonateNamedPipeClient, to impersonate a client. The impersonating thread then calls the OpenThreadTokenfunction to get its own token, which is an impersonation token that has the security context of the client. The thread specifies this impersonation token in a call to DuplicateTokenEx, specifying the TokenPrimary flag. The DuplicateTokenEx function creates a primary token that has the security context of the client.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderWinbase.h (include Windows.h)LibraryAdvapi32.libDLLAdvapi32.dll
See also
Access Control
Syntax
C++ BOOL WINAPI DuplicateTokenEx( _In_ HANDLE hExistingToken, _In_ DWORD dwDesiredAccess, _In_opt_ LPSECURITY_ATTRIBUTES lpTokenAttributes, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _In_ TOKEN_TYPE TokenType, _Out_ PHANDLE phNewToken );
CreateProcessAsUser function
14 out of 34 rated this helpful - Rate this topicCreates a new process and its primary thread. The new process runs in the security context of the user represented by the specified token.Typically, the process that calls the CreateProcessAsUserfunction must have the SE_INCREASE_QUOTA_NAMEprivilege and may require the SE_ASSIGNPRIMARYTOKEN_NAME privilege if the token is not assignable. If this function fails with ERROR_PRIVILEGE_NOT_HELD (1314), use the CreateProcessWithLogonW function instead. CreateProcessWithLogonW requires no special privileges, but the specified user account must be allowed to log on interactively. Generally, it is best to use CreateProcessWithLogonW to create a process with alternate credentials.
Syntax
C++ BOOL WINAPI CreateProcessAsUser( _In_opt_ HANDLE hToken, _In_opt_ LPCTSTR lpApplicationName, _Inout_opt_ LPTSTR lpCommandLine, _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, _In_ BOOL bInheritHandles, _In_ DWORD dwCreationFlags, _In_opt_ LPVOID lpEnvironment, _In_opt_ LPCTSTR lpCurrentDirectory, _In_ LPSTARTUPINFO lpStartupInfo, _Out_ LPPROCESS_INFORMATION lpProcessInformation );
Parameters
hToken [in, optional]A handle to the primary token that represents a user. The handle must have the TOKEN_QUERY, TOKEN_DUPLICATE, and TOKEN_ASSIGN_PRIMARYaccess rights. For more information, see Access Rights for Access-Token Objects. The user represented by the token must have read and execute access to the application specified by the lpApplicationName or the lpCommandLineparameter.To get a primary token that represents the specified user, call the LogonUser function. Alternatively, you can call the DuplicateTokenEx function to convert an impersonation token into a primary token. This allows a server application that is impersonating a client to create a process that has the security context of the client.If hToken is a restricted version of the caller's primary token, the SE_ASSIGNPRIMARYTOKEN_NAME privilege is not required. If the necessary privileges are not already enabled, CreateProcessAsUser enables them for the duration of the call. For more information, seeRunning with Special Privileges.Terminal Services: The process is run in the session specified in the token. By default, this is the same session that called LogonUser. To change the session, use the SetTokenInformationfunction.lpApplicationName [in, optional]The name of the module to be executed. This module can be a Windows-based application. It can be some other type of module (for example, MS-DOS or OS/2) if the appropriate subsystem is available on the local computer.The string can specify the full path and file name of the module to execute or it can specify a partial name. In the case of a partial name, the function uses the current drive and current directory to complete the specification. The function will not use the search path. This parameter must include the file name extension; no default extension is assumed.The lpApplicationName parameter can be NULL. In that case, the module name must be the first white space–delimited token in the lpCommandLine string. If you are using a long file name that contains a space, use quoted strings to indicate where the file name ends and the arguments begin; otherwise, the file name is ambiguous. For example, consider the string "c:\program files\sub dir\program name". This string can be interpreted in a number of ways. The system tries to interpret the possibilities in the following order:c:\program.exe files\sub dir\program namec:\program files\sub.exe dir\program namec:\program files\sub dir\program.exe namec:\program files\sub dir\program name.exeIf the executable module is a 16-bit application, lpApplicationName should be NULL, and the string pointed to by lpCommandLine should specify the executable module as well as its arguments. By default, all 16-bit Windows-based applications created by CreateProcessAsUser are run in a separate VDM (equivalent to CREATE_SEPARATE_WOW_VDM in CreateProcess).lpCommandLine [in, out, optional]The command line to be executed. The maximum length of this string is 32K characters. If lpApplicationName is NULL, the module name portion of lpCommandLine is limited to MAX_PATHcharacters.The Unicode version of this function, CreateProcessAsUserW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a constvariable or a literal string). If this parameter is a constant string, the function may cause an access violation.The lpCommandLine parameter can be NULL. In that case, the function uses the string pointed to by lpApplicationName as the command line.If both lpApplicationName and lpCommandLine are non-NULL, *lpApplicationName specifies the module to execute, and *lpCommandLine specifies the command line. The new process can useGetCommandLine to retrieve the entire command line. Console processes written in C can use the argcand argv arguments to parse the command line. Because argv[0] is the module name, C programmers generally repeat the module name as the first token in the command line.If lpApplicationName is NULL, the first white space–delimited token of the command line specifies the module name. If you are using a long file name that contains a space, use quoted strings to indicate where the file name ends and the arguments begin (see the explanation for the lpApplicationNameparameter). If the file name does not contain an extension, .exe is appended. Therefore, if the file name extension is .com, this parameter must include the .com extension. If the file name ends in a period (.) with no extension, or if the file name contains a path, .exe is not appended. If the file name does not contain a directory path, the system searches for the executable file in the following sequence:The directory from which the application loaded.The current directory for the parent process.The 32-bit Windows system directory. Use the GetSystemDirectory function to get the path of this directory.The 16-bit Windows system directory. There is no function that obtains the path of this directory, but it is searched.The Windows directory. Use theGetWindowsDirectory function to get the path of this directory.The directories that are listed in the PATH environment variable. Note that this function does not search the per-application path specified by the App Paths registry key. To include this per-application path in the search sequence, use the ShellExecute function.The system adds a null character to the command line string to separate the file name from the arguments. This divides the original string into two strings for internal processing.lpProcessAttributes [in, optional]A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new process object and determines whether child processes can inherit the returned handle to the process. If lpProcessAttributes is NULL or lpSecurityDescriptoris NULL, the process gets a default security descriptor and the handle cannot be inherited. The default security descriptor is that of the user referenced in the hToken parameter. This security descriptor may not allow access for the caller, in which case the process may not be opened again after it is run. The process handle is valid and will continue to have full access rights.lpThreadAttributes [in, optional]A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread object and determines whether child processes can inherit the returned handle to the thread. If lpThreadAttributes is NULL or lpSecurityDescriptor isNULL, the thread gets a default security descriptor and the handle cannot be inherited. The default security descriptor is that of the user referenced in the hToken parameter. This security descriptor may not allow access for the caller.bInheritHandles [in]If this parameter is TRUE, each inheritable handle in the calling process is inherited by the new process. If the parameter is FALSE, the handles are not inherited. Note that inherited handles have the same value and access rights as the original handles.Terminal Services: You cannot inherit handles across sessions. Additionally, if this parameter is TRUE, you must create the process in the same session as the caller.dwCreationFlags [in]The flags that control the priority class and the creation of the process. For a list of values, seeProcess Creation Flags.This parameter also controls the new process's priority class, which is used to determine the scheduling priorities of the process's threads. For a list of values, see GetPriorityClass. If none of the priority class flags is specified, the priority class defaults to NORMAL_PRIORITY_CLASS unless the priority class of the creating process is IDLE_PRIORITY_CLASS or BELOW_NORMAL_PRIORITY_CLASS. In this case, the child process receives the default priority class of the calling process.lpEnvironment [in, optional]A pointer to an environment block for the new process. If this parameter is NULL, the new process uses the environment of the calling process.An environment block consists of a null-terminated block of null-terminated strings. Each string is in the following form:name=value\0Because the equal sign is used as a separator, it must not be used in the name of an environment variable.An environment block can contain either Unicode or ANSI characters. If the environment block pointed to by lpEnvironment contains Unicode characters, be sure that dwCreationFlags includes CREATE_UNICODE_ENVIRONMENT. If this parameter is NULL and the environment block of the parent process contains Unicode characters, you must also ensure that dwCreationFlags includes CREATE_UNICODE_ENVIRONMENT.The ANSI version of this function, CreateProcessAsUserA fails if the total size of the environment block for the process exceeds 32,767 characters.Note that an ANSI environment block is terminated by two zero bytes: one for the last string, one more to terminate the block. A Unicode environment block is terminated by four zero bytes: two for the last string, two more to terminate the block.Windows Server 2003 and Windows XP: If the size of the combined user and system environment variable exceeds 8192 bytes, the process created by CreateProcessAsUser no longer runs with the environment block passed to the function by the parent process. Instead, the child process runs with the environment block returned by the CreateEnvironmentBlock function.To retrieve a copy of the environment block for a given user, use the CreateEnvironmentBlock function.lpCurrentDirectory [in, optional]The full path to the current directory for the process. The string can also specify a UNC path.If this parameter is NULL, the new process will have the same current drive and directory as the calling process. (This feature is provided primarily for shells that need to start an application and specify its initial drive and working directory.)lpStartupInfo [in]A pointer to a STARTUPINFO or STARTUPINFOEXstructure.The user must have full access to both the specified window station and desktop. If you want the process to be interactive, specify winsta0\default. If the lpDesktop member is NULL, the new process inherits the desktop and window station of its parent process. If this member is an empty string, "", the new process connects to a window station using the rules described in Process Connection to a Window Station.To set extended attributes, use a STARTUPINFOEXstructure and specify EXTENDED_STARTUPINFO_PRESENT in the dwCreationFlags parameter.Handles in STARTUPINFO or STARTUPINFOEX must be closed with CloseHandle when they are no longer needed.Important The caller is responsible for ensuring that the standard handle fields in STARTUPINFO contain valid handle values. These fields are copied unchanged to the child process without validation, even when the dwFlags member specifies STARTF_USESTDHANDLES. Incorrect values can cause the child process to misbehave or crash. Use the Application Verifier runtime verification tool to detect invalid handles.lpProcessInformation [out]A pointer to a PROCESS_INFORMATION structure that receives identification information about the new process.Handles in PROCESS_INFORMATION must be closed with CloseHandle when they are no longer needed.
Return value
If the function succeeds, the return value is nonzero.If the function fails, the return value is zero. To get extended error information, call GetLastError.Note that the function returns before the process has finished initialization. If a required DLL cannot be located or fails to initialize, the process is terminated. To get the termination status of a process, call GetExitCodeProcess.
Remarks
CreateProcessAsUser must be able to open the primary token of the calling process with the TOKEN_DUPLICATEand TOKEN_IMPERSONATE access rights.By default, CreateProcessAsUser creates the new process on a noninteractive window station with a desktop that is not visible and cannot receive user input. To enable user interaction with the new process, you must specify the name of the default interactive window station and desktop, "winsta0\default", in the lpDesktop member of theSTARTUPINFO structure. In addition, before callingCreateProcessAsUser, you must change the discretionary access control list (DACL) of both the default interactive window station and the default desktop. The DACLs for the window station and desktop must grant access to the user or the logon session represented by the hToken parameter.CreateProcessAsUser does not load the specified user's profile into the HKEY_USERS registry key. Therefore, to access the information in the HKEY_CURRENT_USERregistry key, you must load the user's profile information into HKEY_USERS with the LoadUserProfile function before calling CreateProcessAsUser. Be sure to call UnloadUserProfile after the new process exits.If the lpEnvironment parameter is NULL, the new process inherits the environment of the calling process.CreateProcessAsUser does not automatically modify the environment block to include environment variables specific to the user represented by hToken. For example, the USERNAME and USERDOMAIN variables are inherited from the calling process if lpEnvironment is NULL. It is your responsibility to prepare the environment block for the new process and specify it in lpEnvironment.The CreateProcessWithLogonW and CreateProcessWithTokenW functions are similar toCreateProcessAsUser, except that the caller does not need to call the LogonUser function to authenticate the user and get a token.CreateProcessAsUser allows you to access the specified directory and executable image in the security context of the caller or the target user. By default,CreateProcessAsUser accesses the directory and executable image in the security context of the caller. In this case, if the caller does not have access to the directory and executable image, the function fails. To access the directory and executable image using the security context of the target user, specify hToken in a call to theImpersonateLoggedOnUser function before callingCreateProcessAsUser.The process is assigned a process identifier. The identifier is valid until the process terminates. It can be used to identify the process, or specified in the OpenProcessfunction to open a handle to the process. The initial thread in the process is also assigned a thread identifier. It can be specified in the OpenThread function to open a handle to the thread. The identifier is valid until the thread terminates and can be used to uniquely identify the thread within the system. These identifiers are returned in thePROCESS_INFORMATION structure.The calling thread can use the WaitForInputIdle function to wait until the new process has finished its initialization and is waiting for user input with no input pending. This can be useful for synchronization between parent and child processes, because CreateProcessAsUser returns without waiting for the new process to finish its initialization. For example, the creating process would use WaitForInputIdlebefore trying to find a window associated with the new process.The preferred way to shut down a process is by using theExitProcess function, because this function sends notification of approaching termination to all DLLs attached to the process. Other means of shutting down a process do not notify the attached DLLs. Note that when a thread callsExitProcess, other threads of the process are terminated without an opportunity to execute any additional code (including the thread termination code of attached DLLs). For more information, see Terminating a Process.
Security Remarks
The lpApplicationName parameter can be NULL, in which case the executable name must be the first white space–delimited string in lpCommandLine. If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces. The following example is dangerous because the function will attempt to run "Program.exe", if it exists, instead of "MyApp.exe". LPTSTR szCmdline[] = _tcsdup(TEXT("C:\\Program Files\\MyApp")); CreateProcessAsUser(hToken, NULL, szCmdline, /*...*/ ); If a malicious user were to create an application called "Program.exe" on a system, any program that incorrectly calls CreateProcessAsUser using the Program Files directory will run this application instead of the intended application.To avoid this problem, do not pass NULL for lpApplicationName. If you do pass NULL for lpApplicationName, use quotation marks around the executable path in lpCommandLine, as shown in the example below. LPTSTR szCmdline[] = _tcsdup(TEXT("\"C:\\Program Files\\MyApp\"")); CreateProcessAsUser(hToken, NULL, szCmdline, /*...*/); PowerShell: When the CreateProcessAsUserfunction is used to implement a cmdlet in PowerShell version 2.0, the cmdlet operates correctly for both fan-in and fan-out remote sessions. Because of certain security scenarios, however, a cmdlet implemented with CreateProcessAsUser only operates correctly in PowerShell version 3.0 for fan-in remote sessions; fan-out remote sessions will fail because of insufficient client security privileges. To implement a cmdlet that works for both fan-in and fan-out remote sessions in PowerShell version 3.0, use the CreateProcessfunction.
Examples
For an example, see Starting an Interactive Client Process.
Requirements
Minimum supported clientWindows XP [desktop apps only]Minimum supported serverWindows Server 2003 [desktop apps only]HeaderWinBase.h (include Windows.h)LibraryAdvapi32.libDLLAdvapi32.dllUnicode and ANSI namesCreateProcessAsUserW (Unicode) and CreateProcessAsUserA (ANSI)
See also
Syntax
C++ BOOL WINAPI CreateProcessAsUser( _In_opt_ HANDLE hToken, _In_opt_ LPCTSTR lpApplicationName, _Inout_opt_ LPTSTR lpCommandLine, _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, _In_ BOOL bInheritHandles, _In_ DWORD dwCreationFlags, _In_opt_ LPVOID lpEnvironment, _In_opt_ LPCTSTR lpCurrentDirectory, _In_ LPSTARTUPINFO lpStartupInfo, _Out_ LPPROCESS_INFORMATION lpProcessInformation );
-----
AuthorizationAuthorization ReferenceAuthorization FunctionsAccessCheckAccessCheckAndAuditAlarmAccessCheckByTypeAccessCheckByTypeAndAuditAlarmAccessCheckByTypeResultListAccessCheckByTypeResultListAndAuditAlarmAccessCheckByTypeResultListAndAuditAlarmByHandleAddAccessAllowedAceAddAccessAllowedAceExAddAccessAllowedObjectAceAddAccessDeniedAceAddAccessDeniedAceExAddAccessDeniedObjectAceAddAceAddAuditAccessAceAddAuditAccessAceExAddAuditAccessObjectAceAddConditionalAceAddMandatoryAceAddResourceAttributeAceAddScopedPolicyIDAceAdjustTokenGroupsAdjustTokenPrivilegesAllocateAndInitializeSidAllocateLocallyUniqueIdAreAllAccessesGrantedAreAnyAccessesGrantedAuditComputeEffectivePolicyBySidAuditComputeEffectivePolicyByTokenAuditEnumerateCategoriesAuditEnumeratePerUserPolicyAuditEnumerateSubCategoriesAuditFreeAuditLookupCategoryGuidFromCategoryIdAuditLookupCategoryIdFromCategoryGuidAuditLookupCategoryNameAuditLookupSubCategoryNameAuditQueryGlobalSaclAuditQueryPerUserPolicyAuditQuerySecurityAuditQuerySystemPolicyAuditSetGlobalSaclAuditSetPerUserPolicyAuditSetSecurityAuditSetSystemPolicyAuthzAccessCheckAuthzAccessCheckCallbackAuthzAddSidsToContextAuthzCachedAccessCheckAuthzComputeGroupsCallbackAuthzEnumerateSecurityEventSourcesAuthzFreeAuditEventAuthzFreeCentralAccessPolicyCacheAuthzFreeCentralAccessPolicyCallbackAuthzFreeContextAuthzFreeGroupsCallbackAuthzFreeHandleAuthzFreeResourceManagerAuthzGetCentralAccessPolicyCallbackAuthzGetInformationFromContextAuthzInitializeCompoundContextAuthzInitializeContextFromAuthzContextAuthzInitializeContextFromSidAuthzInitializeContextFromTokenAuthzInitializeObjectAccessAuditEventAuthzInitializeObjectAccessAuditEvent2AuthzInitializeRemoteResourceManagerAuthzInitializeResourceManagerAuthzInitializeResourceManagerExAuthzInstallSecurityEventSourceAuthzModifyClaimsAuthzModifySecurityAttributesAuthzModifySidsAuthzOpenObjectAuditAuthzRegisterCapChangeNotificationAuthzRegisterSecurityEventSourceAuthzReportSecurityEventAuthzReportSecurityEventFromParamsAuthzSetAppContainerInformationAuthzUninstallSecurityEventSourceAuthzUnregisterCapChangeNotificationAuthzUnregisterSecurityEventSourceBuildExplicitAccessWithNameBuildImpersonateExplicitAccessWithNameBuildImpersonateTrusteeBuildSecurityDescriptorBuildTrusteeWithNameBuildTrusteeWithObjectsAndNameBuildTrusteeWithObjectsAndSidBuildTrusteeWithSidCheckTokenCapabilityCheckTokenMembershipCheckTokenMembershipExConvertSecurityDescriptorToStringSecurityDescriptorConvertSidToStringSidConvertStringSecurityDescriptorToSecurityDescriptorConvertStringSidToSidConvertToAutoInheritPrivateObjectSecurityCopySidCreatePrivateObjectSecurityCreatePrivateObjectSecurityExCreatePrivateObjectSecurityWithMultipleInheritanceCreateRestrictedTokenCreateSecurityPageCreateWellKnownSidDeleteAceDestroyPrivateObjectSecurityDSCreateSecurityPageDSCreateISecurityInfoObjectDSCreateISecurityInfoObjectExDSEditSecurityDuplicateTokenDuplicateTokenExEditSecurityEditSecurityAdvancedEqualDomainSidEqualPrefixSidEqualSidFindFirstFreeAceFreeInheritedFromArrayFreeSidGetAceGetAclInformationGetAppContainerNamedObjectPathGetAuditedPermissionsFromAclGetEffectiveRightsFromAclGetExplicitEntriesFromAclGetFileSecurityGetInheritanceSourceGetKernelObjectSecurityGetLengthSidGetMultipleTrusteeGetMultipleTrusteeOperationGetNamedSecurityInfoGetPrivateObjectSecurityGetSecurityDescriptorControlGetSecurityDescriptorDaclGetSecurityDescriptorGroupGetSecurityDescriptorLengthGetSecurityDescriptorOwnerGetSecurityDescriptorRMControlGetSecurityDescriptorSaclGetSecurityInfoGetSidIdentifierAuthorityGetSidLengthRequiredGetSidSubAuthorityGetSidSubAuthorityCountGetTokenInformationGetTrusteeFormGetTrusteeNameGetTrusteeTypeGetUserObjectSecurityGetWindowsAccountDomainSidImpersonateAnonymousTokenImpersonateLoggedOnUserImpersonateNamedPipeClientImpersonateSelfInitializeAclInitializeSecurityDescriptorInitializeSidIsTokenRestrictedIsValidAclIsValidSecurityDescriptorIsValidSidIsWellKnownSidLookupAccountNameLookupAccountSidLookupPrivilegeDisplayNameLookupPrivilegeNameLookupPrivilegeValueLookupSecurityDescriptorPartsMakeAbsoluteSDMakeSelfRelativeSDMapGenericMaskNtCompareTokensObjectCloseAuditAlarmObjectDeleteAuditAlarmObjectOpenAuditAlarmObjectPrivilegeAuditAlarmOpenProcessTokenOpenThreadTokenPrivilegeCheckPrivilegedServiceAuditAlarmQuerySecurityAccessMaskQueryServiceObjectSecurityRegGetKeySecurityRegSetKeySecurityRevertToSelfRtlConvertSidToUnicodeStringSetAclInformationSetEntriesInAclSetFileSecuritySetKernelObjectSecuritySetNamedSecurityInfoSetPrivateObjectSecuritySetPrivateObjectSecurityExSetSecurityAccessMaskSetSecurityDescriptorControlSetSecurityDescriptorDaclSetSecurityDescriptorGroupSetSecurityDescriptorOwnerSetSecurityDescriptorRMControlSetSecurityDescriptorSaclSetSecurityInfoSetServiceObjectSecuritySetThreadTokenSetTokenInformationSetUserObjectSecurityTreeResetNamedSecurityInfoTreeSetNamedSecurityInfo
GetTokenInformatio
http://msdn.microsoft.com/en-us/library/aa446671(v=vs.85).aspx
USER AUTHORIZATION 2 create process as a user
If the executable module is a 16-bit application, lpApplicationName should be NULL, and the string pointed to by lpCommandLine should specify the executable module as well as its arguments. By default, all 16-bit Windows-based applications created by CreateProcessAsUser are run in a separate VDM (equivalent to CREATE_SEPARATE_WOW_VDM in CreateProcess).
Windows Server 2003 and Windows XP: If the size of the combined user and system environment variable exceeds 8192 bytes, the process created by CreateProcessAsUser no longer runs with the environment block passed to the function by the parent process. Instead, the child process runs with the environment block returned by the CreateEnvironmentBlock function.To retrieve a copy of the environment block for a given user, use the CreateEnvironmentBlock function.
Syntax
C++ BOOL WINAPI CreateEnvironmentBlock( _Out_ LPVOID *lpEnvironment, _In_opt_ HANDLE hToken, _In_ BOOL bInherit );
CreateEnvironmentBlock function
4 out of 6 rated this helpful - Rate this topicRetrieves the environment variables for the specified user. This block can then be passed to the CreateProcessAsUserfunction.
Syntax
C++ BOOL WINAPI CreateEnvironmentBlock( _Out_ LPVOID *lpEnvironment, _In_opt_ HANDLE hToken, _In_ BOOL bInherit );
Parameters
lpEnvironment [out]Type: LPVOID*When this function returns, receives a pointer to the new environment block. The environment block is an array of null-terminated Unicode strings. The list ends with two nulls (\0\0).hToken [in, optional]Type: HANDLEToken for the user, returned from the LogonUserfunction. If this is a primary token, the token must have TOKEN_QUERY and TOKEN_DUPLICATE access. If the token is an impersonation token, it must have TOKEN_QUERY access. For more information, seeAccess Rights for Access-Token Objects.If this parameter is NULL, the returned environment block contains system variables only.bInherit [in]Type: BOOLSpecifies whether to inherit from the current process' environment. If this value is TRUE, the process inherits the current process' environment. If this value is FALSE, the process does not inherit the current process' environment.
Return value
Type: BOOLTRUE if successful; otherwise, FALSE. To get extended error information, call GetLastError.
Remarks
To free the buffer when you have finished with the environment block, call the DestroyEnvironmentBlockfunction.If the environment block is passed to CreateProcessAsUser, you must also specify the CREATE_UNICODE_ENVIRONMENT flag. After CreateProcessAsUser has returned, the new process has a copy of the environment block, and DestroyEnvironmentBlock can be safely called.User-specific environment variables such as %USERPROFILE% are set only when the user's profile is loaded. To load a user's profile, call the LoadUserProfilefunction.
Requirements
Minimum supported clientWindows 2000 Professional [desktop apps only]Minimum supported serverWindows 2000 Server [desktop apps only]HeaderUserenv.hLibraryUserenv.libDLLUserenv.dll
See also
User Profiles OverviewUser Profiles ReferenceCreateProcessAsUserDestroyEnvironmentBlockLogonUser
USER AUTHORIZATION Pt 1
http://blogs.msdn.com/b/distributedservices/archive/2009/03/13/troubleshooting-msdtc-permission-issues-when-a-distributed-transaction-starts.aspx
1. Grant the client application identity the Full Control permission to the cluster serverThe user account associated with the client application must be a member of the local Administrators group, or have the Full Control to the cluster server. Otherwise the RPC call made from the client application to the cluster server will fail and an error message that resembles the following will be logged in the application event log:Event Type: Error Event Source: MSDTC Client Event Category: MSDTC Proxy Event ID: 4376 Date: 11/12/2008 Time: 1:25:31 PM User: N/A Computer: ComputerName Description: The application could not connect to MSDTC because of insufficient permissions. Please make sure that the identity under which the application is running has permission to access the cluster. Please refer to MSCS documentation on how to grant permissions. Error Specifics: d:\srvrtm\com\complus\dtc\dtc\msdtcprx\src\dtcinit.cpp:652, Pid: 4544 For more information for granting the permission, see You cannot start transactions from a COM+ component on a clustered SQL Server server.2. Grant the user access rights to Service Control Manager on the cluster server In addition to the full control cluster permissions, the user account must also have the GENERIC_READ access right to the Service Control Manager (SCM) on the cluster, else it cannot begin the distributed transaction.If the user doesn't have the access right to the SCM, the following error is logged in the security event log. Note this error is only logged if "Audit object access" is enabled in the Local Policies. For more info for enabling "Audit object access", see How to enable and apply security auditing in Windows 2000Event Type: Failure Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 11/24/2008 Time: 12:46:33 PM User: Domain\User Computer: ComputerName Description: Object Open: Object Server: SC Manager Object Type: SC_MANAGER OBJECT Object Name: ServicesActive Handle ID: - Operation ID: {0,55865185} Process ID: 1340 Image File Name: C:\WINDOWS\system32\services.exe Primary User Name: ComputerName$ Primary Domain: Domain Primary Logon ID: (0x0,0x3E7) Client User Name: User Client Domain: Domain Client Logon ID: (0x0,0x353882A) Accesses: READ_CONTROL Connect to service controller Enumerate services Query service database lock state Privileges: - Restricted Sid Count: 0 Access Mask: 0x20015To display the discretionary access control list (DACL) on the Service Control Manager (SCM), run the following SC command at a command prompt:sc sdshow SCMANAGERHere is a sample output:D:(A;;CC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)In the output above, there is (A;;CC;;;AU). The first 'A" means allow access. The 'CC" means the SC_MANAGER_CONNECT right and the 'AU' represents the "Authenticated Users" group. This means the "Authenticated Users" have the SC_MANAGER_CONNECT access right to SCM.To add the GENERIC_READ (GR) access right for "Authenticated Users" to the SCM to the existing DACL, run the following SC command at a command prompt:sc sdset SCMANAGER D:(A;;CCGR;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)Run "sc sdshow SCMANAGER" again to display the new DACL on the SCM:D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)You can see in the new output that 'GR' is replaced with 'LCRPRC'. This is because:GENERIC_READ for SCMANAGER is:READ_CONTROL (RC)SC_MANAGER_ENUMERATE_SERVICE or Enumerate services (LC)SC_MANAGER_QUERY_LOCK_STATUS or Query service database lock state (RP)This will ensure the user has the GENERIC_READ access right to the SCM.3. Grant the user access rights to the cluster service on the clusterThe user account must also have the GENERIC_READ access right to the cluster service (ClusSvc) on the cluster. If the user doesn't have the access right to ClusSvc, an error message that resembles the following will be logged in the security event log. Note this error is only logged if "Audit object access" is enabled in the Local Policies.Event Type: Failure Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 2/24/2009 Time: 5:28:31 PM User: Domain\User Computer: ComputerName Description: Object Open: Object Server: SC Manager Object Type: SERVICE OBJECT Object Name: ClusSvc Handle ID: - Operation ID: {4,1888529168} Process ID: 1208 Image File Name: C:\WINDOWS\system32\services.exe Primary User Name: ComputerName$ Primary Domain: Domain Primary Logon ID: (0x0,0x3E7) Client User Name: User Client Domain: Domain Client Logon ID: (0x4,0x7085A6C0) Accesses: READ_CONTROL Query service configuration information Query status of service Enumerate dependencies of service Query information from service Privileges: - Restricted Sid Count: 0 Access Mask: 0x2008DTo display the DACL on Cluster Service (ClusSvc), run the following SC command:sc sdshow clussvcHere is a sample output:D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)To add the GENERIC_READ (GR) access right for "Authenticated Users" to ClusSvc to the existing DACL, run the following SC command:sc sdset clussvc D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CRGR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)Run "sc sdshow clussvc" again to display the new DACL on ClusSvc:D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)You can see in the new output that 'GR' is replaced with 'CCLCSWLORC'. This is because GENERIC_READ for a service is:READ_CONTROL (RC)SERVICE_QUERY_CONFIG or Query service configuration information (CC)SERVICE_QUERY_STATUS or Query status of service (LC)SERVICE_INTERROGATE or Query information from service (LO)SERVICE_ENUMERATE_DEPENDENTS or Enumerate dependencies of service (SW)This will ensure the user has the GENERIC_READ access right to ClusSvc.4. Grant the user access rights to Service Control Manager (SCM) on the non-clustered serverThere is a DWORD registry value named HKLM\Software\Microsoft\Windows NT\CurrentVersion\Cluster Server\ClusterInstallationState on both clustered and non-clustered servers. On clustered Windows Server 2003, the value is 2 or 3. On non-clustered Windows Server 2003, the value is 1, meaning "Files Copied but Cluster Service not configured."The GENERIC_READ access right to SCM is not enforced on standalone servers so the event ID 560 for SCM can be ignored on non-clustered servers. The exception is Windows Server 2003 Web Edition where the subkey is absent by default. To be able to ignore this error as on Standard Edition, add the following cluster registry information:C:\>reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Cluster Server" C:\>reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Cluster Server" /v ClusterInstallationState /d 1 /t REG_DWORD5. Grant the user access rights to MSDTC on both the clustered and non-clustered serversThe desired access right to the MSDTC service is SERVICE_QUERY_CONFIG (CC). The event ID 560 for the MSDTC service will be logged in the security event log if the DACL is (A;;CR;;;AU).To display the DACL on MSDTC, run the following SC command:sc sdshow msdtcHere is a sample outputD:(A;;CCLCSWRPLOCRRC;;;S-1-2-0)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPRC;;;WD)(A;;CCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)If you see the error 560 for MSDTC in the event log, you need add CC to (A;;CR;;;AU) with the following SC command:sc sdset msdtc D:(A;;CCLCSWRPLOCRRC;;;S-1-2-0)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCCR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPRC;;;WD)(A;;CCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)The SC command is used throughout this article. Subinacl is another utility that is commonly used to display and grant user rights to any services. Note Subinacl cannot be used for SCM. The article below has examples of using the utility:Grant Users Rights to Manage Services in Windows Server 2003For more information about Service Security and Access Rights, ACE Strings and Service DACLs, see the following articles:Service Security and Access Rights ACE Strings Best practices and guidance for writers of service discretionary access control listsDTCComments
http://support.microsoft.com/kb/324802/EN-US
How To Configure Group Policies to Set Security for System Services in Windows Server 2003
Article ID: 324802 - View products that this article applies to.This article was previously published under Q324802Expand all | Collapse all
On This Page
SUMMARY
This article describes how to use Group Policy to set security for system services for an organizational unit in Windows Server 2003.When you implement security on system services, you can control who can manage services on a workstation, member server, or domain controller. Currently, the only way to change a system service is through a Group Policy computer setting. If you implement Group Policy as the Default Domain Policy, the policy is applied to all computers in the domain. If you implement Group Policy as the Default Domain Controllers policy, the policy applies only to the servers in the domain controller's organizational unit. You can create organizational units that contain workstation computers to which policies can be applied. This article describes the steps to implementing a Group Policy on an organizational unit to change permissions on system services.
How to Assign System Service Permissions
Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.Right-click the domain to which you want to add the organizational unit, point to New, and then click Organizational Unit.Type a name for the organizational unit in the Name box, and then click OK.The new organizational unit is listed in the console tree.Right-click the new organizational unit that you created, and then click Properties.Click the Group Policy tab, and then click New. Type a name for the new Group Policy object (for example, use the name of the organizational unit for which it is implemented), and then press ENTER.Click the new Group Policy object in the Group Policy Objects Linkslist (if it is not already selected), and then click Edit.Expand Computer Configuration, expand Windows Settings, expand Security Settings, and then click System Services.In the right pane, double-click the service to which you want to apply permissions.The security policy setting for that specific service is displayed.Click to select the Define this policy setting check box.Click Edit Security.Grant the appropriate permissions to the user accounts and groups that you want, and then click OK.Under Select service startup mode, click the startup mode option that you want, and then click OK.Close the Group Policy Object Editor, click OK, and then close the Active Directory Users and Computers tool.NOTE: You must move the computer accounts that you want to manage into the organizational unit. After the computer accounts are contained in the organizational unit, the authorized user or groups can manage the service. Back to the top | Give Feed
http://msdn.microsoft.com/en-us/library/aa374928.aspx
The following example shows an ACE string for an access-allowed ACE. It is not an object-specific ACE, so it has no information in the object_guid and inherit_object_guidfields. The ace_flags field is also empty, which indicates that none of the ACE flags are set.C++ (A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0) The ACE string shown above describes the following ACE information.C++ AceType: 0x00 (ACCESS_ALLOWED_ACE_TYPE) AceFlags: 0x00 Access Mask: 0x100e003f READ_CONTROL WRITE_DAC WRITE_OWNER GENERIC_ALL Other access rights(0x0000003f) Ace Sid : (S-1-0-0) The following example shows a file classified with resource claims for Windows and Structured Query Language (SQL) with Secrecy set to High Business Impact.C++ (RA;CI;;;;S-1-0-0; ("Project",TS,0,"Windows","SQL")) (RA;CI;;;;S-1-0-0; ("Secrecy",TU,0,3)) The ACE string shown above describes the following ACE information.C++ AceType: 0x12 (SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE) AceFlags: 0x1 (SDDL_CONTAINER_INHERIT) Access Mask: 0x0 Ace Sid : (S-1-0-0) Resource Attributes: Project has the strings Windows and SQL, Secrecy has the unsigned int value of 3 For more information, see Security Descriptor String Formatand SID Strings. For conditional ACEs, see Security Descriptor Definition Language for Conditional ACEs.
Related topics
[MS-DTYP]: Security Descriptor Description Language
http://msdn.microsoft.com/en-us/library/aa375774(v=vs.85).aspx
Authorization Reference
2 out of 4 rated this helpful - Rate this topicAuthorization reference pages contain detailed descriptions of the Microsoft authorization functions, interfaces, objects, structures, and other programming elements. These pages include reference descriptions of the API for working with access controls including the access control editors.Reference pages are divided into the following groups.SectionDescriptionMicrosoft.Interop.Security.AzRoles AssemblyLinks to documentation for the AzRoles assembly interfaces.Authorization ConstantsConstants used by authorization programming elements.Authorization Data TypesData types used by authorization programming elements.Authorization EnumerationsEnumerations used by authorization programming elements.Authorization FunctionsFunctions used with authorization.Authorization InterfacesInterfaces used with authorization.Authorization ObjectsObjects used with authorization.Authorization StructuresStructures used with authorization functions, interfaces, and objects.
Authorization Constants
1 out of 21 rated this helpful - Rate this topicAuthorization constants are categorized according to usage as follows.
In this section
TopicDescriptionAccount Rights ConstantsAccount rights determine the type of logon that a user account can perform. An administrator assigns account rights to user and group accounts. Each user's account rights include those granted to the user and to the groups to which the user belongs.App Container SID ConstantsDictate the application package authority.Auditing ConstantsRepresent categories and subcategories of audit-policy events.Capability SID ConstantsDefine for applications well-known capabilities by using the AllocateAndInitializeSid function.Privilege ConstantsPrivileges determine the type of system operations that a user account can perform. An administrator assigns privileges to user and group accounts. Each user's privileges include those granted to the user and to the groups to which the user belongs.
SSDP Hack doesn't need wireless
wireless card removed and still hacked
I saw a UPN CONNECTION VIA NETSTAT, everything transferred over.
http://msdn.microsoft.com/en-us/library/bb870632(VS.85).aspx
SSDP Provider
This topic has not yet been rated - Rate this topic[Function Discovery is available for use in the following versions of Windows: Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista. It may be altered or unavailable in subsequent versions.]The Simple Search and Discovery Protocol (SSDP) provider is an asynchronous Function Discovery provider that enumerates UPnP devices that use SSDP for discovery. Any UPnP device that supports SSDP for discovery and is compatible with the Microsoft SSDP media stack is discoverable by the SSDP provider. Once a device is discovered, the SSDP provider gets the device description document from the device, processes it, and returns a function instance that represents the root device.
Query Results
The SSDP provider supports collection queries and instance queries. This means that the provider supports both the IFunctionInstanceCollectionQuery::Execute and IFunctionInstanceQuery::Execute methods. Because the SSDP provider is asynchronous, Execute always returns E_PENDING for a successful query.When a query is executed, the provider sends a SSDP M-SEARCH request. This request is used to search for devices or device types that match the parameters specified in the Function Discovery query. The SSDP provider gets the description documents from devices that respond to the M-SEARCH request. After processing the description documents, the SSDP provider returns the function instances corresponding to the root devices. Although the description documents describe both services and devices, the services are ignored and only the devices are enumerated.Function instances are returned using theIFunctionDiscoveryNotification::OnUpdate method. Also, after the SSDP provider has finished enumerating resources, the provider sends a FD_EVENTID_SEARCHCOMPLETE notification using IFunctionDiscoveryNotification::OnEvent.After the initial query results have been returned, the SSDP provider continues to listen for messages from devices on the network. When a device sends a ssdp:alive message, the SSDP provider sends a QUA_ADD notification to the Function Discovery client. When a device sends a ssdp:byebye message, the SSDP provider sends a QUA_REMOVE notification to the Function Discovery client. This means that the client application is notified whenever a device comes online or goes offline until the client releases the query object by calling Release on the IFunctionInstanceCollectionQuery or on the IFunctionInstanceQuery object.Function Discovery applications can query the SSDP provider for different types of UPnP devices by specifying the PROVIDERSSDP_QUERYCONSTRAINT_TYPE query constraint. For more information, see the Query Constraints section below.If the SSDP provider finds a multi-function device in response to a query, the returned function instance corresponds to the root device. Applications can then call IFunctionInstance::QueryService on the returned function instance to get the collection of function instances corresponding to each child device. For multi-function devices, each child device corresponds to a function on the multi-function device.
Query Constraints
Query constraint can be added by calling IFunctionInstanceCollectionQuery::AddQueryConstraint on an IFunctionInstanceCollectionQuery object before executing the query.The following table shows the query constraints supported by the SSDP provider. The table also shows possible values to pass to the pszConstraintValue parameter of the AddQueryConstraint method.Note The SSDP provider always returns function instances that correspond to the matching root devices. If a multi-function device has at least one child device that matches the specified query constraints, the function instance representing the root device is returned. An application must call IFunctionInstance::QueryService and pass the appropriate service identifier to get the function instances associated with the child devices. All child devices of the root device are returned, not just child devices that match the original query constraints.Constraint namePossible valuesRemarksFD_QUERYCONSTRAINT_PROVIDERINSTANCEIDA device UUID.This constraint limits query results to a single device. The SSDP provider returns a function instance representing the device matching the specified UUID, if there is such a device.This constraint takes precedence over all other query constraints. If this constraint is specified, all other query constraints are ignored.PROVIDERSSDP_QUERYCONSTRAINT_TYPEAny string corresponding to a device type supported by a SSDP device.This constraint limits query results to the specified UPnP device type. If this constraint is not specified, the SSDP provider searches for devices of type SSDP_CONSTRAINTVALUE_TYPE_ROOT.Some supported device type strings are predefined in FunctionDiscoveryConstraints.h. For a list of predefined types, see the SSDP_CONSTRAINTVALUE_TYPE_* constants in the topic Constraint Definitions. For more information about a named constraint, see Constraint Definitions. For general information about query constraints, see Constraints.
Notifications
Because the SSDP provider is asynchronous, a non-NULL IFunctionDiscoveryNotification pointer must be passed to the query creation method (either IFunctionDiscovery::CreateInstanceCollectionQuery or IFunctionDiscovery::CreateInstanceQuery). The SSDP provider will listen for ssdp:alive and ssdp:byebye messages and send QUA_ADD and QUA_REMOVE notifications to the IFunctionDiscoveryNotification interface as appropriate. An implementation of the IFunctionDiscoveryNotification::OnUpdate method should handle these two notifications. The QUA_CHANGE notification is not used.
Events
The FD_EVENTID_SEARCHCOMPLETE event is dispatched by the SSDP provider. This event notifies the application that the initial search for devices has been completed and that the application will receive function instances for added or removed devices that match the query constraints. The semantics are similar to IUPnPDeviceFinderCallback::SearchComplete. Applications that must return results synchronously can wait for this event to return the result set to their callers. For more information about FD_EVENTID_SEARCHCOMPLETE, see IFunctionDiscoveryNotification::OnEvent.
Services
The SSDP provider implements the SID_PNPXServiceCollection and SID_UPnPActivator services. The SSDP provider creates function instances that are returned by the SID_PNPXAssociation service.
SID_PNPXAssociation Service
Although the SSDP provider does not implement the SID_PNPXAssociation service, function instances created by the SSDP provider are returned when an application callsIFunctionInstance::QueryService on a function instance with the guidService parameter set to SID_PNPXAssociation and the riid parameter set to _uuidof(IPNPXAssociation).
SID_PNPXServiceCollection Service
The SSDP provider implements the SID_PNPXServiceCollection service.An application can use the SID_PNPXServiceCollection service to get the collection of child function instances (representing child devices) from a given function instance. To do this, the application calls IFunctionInstance::QueryService on a returned function instance with the guidService parameter set to SID_PNPXServiceCollection and the riid parameter set to _uuidof(IFunctionInstanceCollection). If a function instance does not have any child function instances, then an empty collection is returned.Although the UPnP device description document supports an arbitrary number of nested devices, the SSDP provider supports only one level of device nesting. That means that the collection of child devices returned by the SSDP provider is never nested. That means that direct children of the root device and children of these direct children appear in the same flat collection.
SID_UPnPActivator Service
The SSDP provider implements the SID_UPnPActivator service.An application can use the SID_UPnPActivator service to get the IUPnPDevice interface associated with a given function instance. To do this, the application calls IFunctionInstance::QueryService on a returned function instance with the guidService parameter set to SID_PNPXServiceCollection and the riid parameter set to _uuidof(IUPnPDevice).
Property Store
The SSDP provider implements read-only property stores.The IFunctionInstance::OpenPropertyStore method can be used to access the property keys (PKEYs) associated with a function instance. The methods of the IPropertyStoreinterface can be used to get the PKEYs associated with the function instance.
Supported PKEYs
The following PnP-X PKEYs are supported by the SSDP provider.PKEY_Device_CompatibleIdsPKEY_Device_DeviceDescPKEY_Device_FriendlyNamePKEY_Device_HardwareIdsPKEY_Device_LocationInfoPKEY_Device_ManufacturerPKEY_Device_ModelPKEY_DriverPackage_VendorWebSitePKEY_PNPX_CompatibleIdsPKEY_PNPX_CompatibleTypesPKEY_PNPX_DeviceCategoryPKEY_PNPX_FriendlyNamePKEY_PNPX_GlobalIdentityPKEY_PNPX_HardwareIdsPKEY_PNPX_IDPKEY_PNPX_InstallablePKEY_PNPX_IpAddressPKEY_PNPX_ManufacturerPKEY_PNPX_ManufacturerUrlPKEY_PNPX_ModelNamePKEY_PNPX_ModelNumberPKEY_PNPX_ModelUrlPKEY_PNPX_NetworkInterfaceGuidPKEY_PNPX_PhysicalAddressPKEY_PNPX_PresentationUrlPKEY_PNPX_SerialNumberPKEY_PNPX_TypesPKEY_PNPX_UpcPKEY_PNPX_XAddrsFor more information about these PKEYs, see PnP-X Provider PKEYs. For information about SSDP device metadata requirements in general, and also for information about the relationship between UPnP device elements and PKEYs, see PnP-X: Plug and Play Extensions for Windows Specification.
Related topics
Built-in Providers Send comments about this topic to MicrosoftBuild date: 10/26/2012Did you find this helpful? Yes No
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/244d8984-be66-46ac-a732-d155dd16b38e/
Subscribe to:
Posts (Atom)