include/ntsecapi.h: Add missing definitions. Signed-off-by: Mark Harmstone <mark@harmstone.com> Signed-off-by: Liu Hao <lh_mouse@126.com>
diff --git a/mingw-w64-headers/include/ntsecapi.h b/mingw-w64-headers/include/ntsecapi.h index 2d4f141..edef4d5 100644 --- a/mingw-w64-headers/include/ntsecapi.h +++ b/mingw-w64-headers/include/ntsecapi.h
@@ -3,6 +3,485 @@ * This file is part of the mingw-w64 runtime package. * No warranty is given; refer to the file DISCLAIMER.PD within this package. */ + +#ifdef DEFINE_GUID + +#if !defined(INITGUID) || !defined(Audit_System_SecurityStateChange_defined) +DEFINE_GUID(Audit_System_SecurityStateChange, 0x0cce9210, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_SecurityStateChange_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_System_SecuritySubsystemExtension_defined) +DEFINE_GUID(Audit_System_SecuritySubsystemExtension, 0x0cce9211, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_SecuritySubsystemExtension_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_System_Integrity_defined) +DEFINE_GUID(Audit_System_Integrity, 0x0cce9212, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_Integrity_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_System_IPSecDriverEvents_defined) +DEFINE_GUID(Audit_System_IPSecDriverEvents, 0x0cce9213, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_IPSecDriverEvents_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_System_Others_defined) +DEFINE_GUID(Audit_System_Others, 0x0cce9214, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_Logon_defined) +DEFINE_GUID(Audit_Logon_Logon, 0x0cce9215, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_Logon_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_Logoff_defined) +DEFINE_GUID(Audit_Logon_Logoff, 0x0cce9216, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_Logoff_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_AccountLockout_defined) +DEFINE_GUID(Audit_Logon_AccountLockout, 0x0cce9217, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_AccountLockout_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecMainMode_defined) +DEFINE_GUID(Audit_Logon_IPSecMainMode, 0x0cce9218, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_IPSecMainMode_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecQuickMode_defined) +DEFINE_GUID(Audit_Logon_IPSecQuickMode, 0x0cce9219, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_IPSecQuickMode_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_IPSecUserMode_defined) +DEFINE_GUID(Audit_Logon_IPSecUserMode, 0x0cce921a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_IPSecUserMode_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_SpecialLogon_defined) +DEFINE_GUID(Audit_Logon_SpecialLogon, 0x0cce921b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_SpecialLogon_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_Others_defined) +DEFINE_GUID(Audit_Logon_Others, 0x0cce921c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FileSystem_defined) +DEFINE_GUID(Audit_ObjectAccess_FileSystem, 0x0cce921d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_FileSystem_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Registry_defined) +DEFINE_GUID(Audit_ObjectAccess_Registry, 0x0cce921e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Registry_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Kernel_defined) +DEFINE_GUID(Audit_ObjectAccess_Kernel, 0x0cce921f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Kernel_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Sam_defined) +DEFINE_GUID(Audit_ObjectAccess_Sam, 0x0cce9220, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Sam_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_CertificationServices_defined) +DEFINE_GUID(Audit_ObjectAccess_CertificationServices, 0x0cce9221, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_CertificationServices_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_ApplicationGenerated_defined) +DEFINE_GUID(Audit_ObjectAccess_ApplicationGenerated, 0x0cce9222, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_ApplicationGenerated_defined +#endif +#endif +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Handle_defined) +DEFINE_GUID(Audit_ObjectAccess_Handle, 0x0cce9223, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Handle_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Share_defined) +DEFINE_GUID(Audit_ObjectAccess_Share, 0x0cce9224, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Share_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallPacketDrops_defined) +DEFINE_GUID(Audit_ObjectAccess_FirewallPacketDrops, 0x0cce9225, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_FirewallPacketDrops_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallConnection_defined) +DEFINE_GUID(Audit_ObjectAccess_FirewallConnection, 0x0cce9226, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_FirewallConnection_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_Other_defined) +DEFINE_GUID(Audit_ObjectAccess_Other, 0x0cce9227, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_Other_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Sensitive_defined) +DEFINE_GUID(Audit_PrivilegeUse_Sensitive, 0x0cce9228, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PrivilegeUse_Sensitive_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_NonSensitive_defined) +DEFINE_GUID(Audit_PrivilegeUse_NonSensitive, 0x0cce9229, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PrivilegeUse_NonSensitive_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Others_defined) +DEFINE_GUID(Audit_PrivilegeUse_Others, 0x0cce922a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PrivilegeUse_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessCreation_defined) +DEFINE_GUID(Audit_DetailedTracking_ProcessCreation, 0x0cce922b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_ProcessCreation_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessTermination_defined) +DEFINE_GUID(Audit_DetailedTracking_ProcessTermination, 0x0cce922c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_ProcessTermination_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_DpapiActivity_defined) +DEFINE_GUID(Audit_DetailedTracking_DpapiActivity, 0x0cce922d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_DpapiActivity_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_RpcCall_defined) +DEFINE_GUID(Audit_DetailedTracking_RpcCall, 0x0cce922e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_RpcCall_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuditPolicy_defined) +DEFINE_GUID(Audit_PolicyChange_AuditPolicy, 0x0cce922f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_AuditPolicy_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthenticationPolicy_defined) +DEFINE_GUID(Audit_PolicyChange_AuthenticationPolicy, 0x0cce9230, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_AuthenticationPolicy_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthorizationPolicy_defined) +DEFINE_GUID(Audit_PolicyChange_AuthorizationPolicy, 0x0cce9231, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_AuthorizationPolicy_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_MpsscvRulePolicy_defined) +DEFINE_GUID(Audit_PolicyChange_MpsscvRulePolicy, 0x0cce9232, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_MpsscvRulePolicy_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_WfpIPSecPolicy_defined) +DEFINE_GUID(Audit_PolicyChange_WfpIPSecPolicy, 0x0cce9233, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_WfpIPSecPolicy_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_Others_defined) +DEFINE_GUID(Audit_PolicyChange_Others, 0x0cce9234, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_UserAccount_defined) +DEFINE_GUID(Audit_AccountManagement_UserAccount, 0x0cce9235, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_UserAccount_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_ComputerAccount_defined) +DEFINE_GUID(Audit_AccountManagement_ComputerAccount, 0x0cce9236, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_ComputerAccount_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_SecurityGroup_defined) +DEFINE_GUID(Audit_AccountManagement_SecurityGroup, 0x0cce9237, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_SecurityGroup_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_DistributionGroup_defined) +DEFINE_GUID(Audit_AccountManagement_DistributionGroup, 0x0cce9238, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_DistributionGroup_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_ApplicationGroup_defined) +DEFINE_GUID(Audit_AccountManagement_ApplicationGroup, 0x0cce9239, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_ApplicationGroup_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_Others_defined) +DEFINE_GUID(Audit_AccountManagement_Others, 0x0cce923a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DSAccess_DSAccess_defined) +DEFINE_GUID(Audit_DSAccess_DSAccess, 0x0cce923b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DSAccess_DSAccess_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DsAccess_AdAuditChanges_defined) +DEFINE_GUID(Audit_DsAccess_AdAuditChanges, 0x0cce923c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DsAccess_AdAuditChanges_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Ds_Replication_defined) +DEFINE_GUID(Audit_Ds_Replication, 0x0cce923d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Ds_Replication_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Ds_DetailedReplication_defined) +DEFINE_GUID(Audit_Ds_DetailedReplication, 0x0cce923e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Ds_DetailedReplication_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountLogon_CredentialValidation_defined) +DEFINE_GUID(Audit_AccountLogon_CredentialValidation, 0x0cce923f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountLogon_CredentialValidation_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountLogon_Kerberos_defined) +DEFINE_GUID(Audit_AccountLogon_Kerberos, 0x0cce9240, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountLogon_Kerberos_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountLogon_Others_defined) +DEFINE_GUID(Audit_AccountLogon_Others, 0x0cce9241, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountLogon_Others_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountLogon_KerbCredentialValidation_defined) +DEFINE_GUID(Audit_AccountLogon_KerbCredentialValidation, 0x0cce9242, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountLogon_KerbCredentialValidation_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_NPS_defined) +DEFINE_GUID(Audit_Logon_NPS, 0x0cce9243, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_NPS_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_DetailedFileShare_defined) +DEFINE_GUID(Audit_ObjectAccess_DetailedFileShare, 0x0cce9244, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_DetailedFileShare_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_RemovableStorage_defined) +DEFINE_GUID(Audit_ObjectAccess_RemovableStorage, 0x0cce9245, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_RemovableStorage_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_CbacStaging_defined) +DEFINE_GUID(Audit_ObjectAccess_CbacStaging, 0x0cce9246, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_CbacStaging_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_Claims_defined) +DEFINE_GUID(Audit_Logon_Claims, 0x0cce9247, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_Claims_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_PnpActivity_defined) +DEFINE_GUID(Audit_DetailedTracking_PnpActivity, 0x0cce9248, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_PnpActivity_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_Groups_defined) +DEFINE_GUID(Audit_Logon_Groups, 0x0cce9249, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_Groups_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_TokenRightAdjusted_defined) +DEFINE_GUID(Audit_DetailedTracking_TokenRightAdjusted, 0x0cce924a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_TokenRightAdjusted_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_System_defined) +DEFINE_GUID(Audit_System, 0x69979848, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_System_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_Logon_defined) +DEFINE_GUID(Audit_Logon, 0x69979849, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_Logon_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_ObjectAccess_defined) +DEFINE_GUID(Audit_ObjectAccess, 0x6997984a, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_ObjectAccess_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PrivilegeUse_defined) +DEFINE_GUID(Audit_PrivilegeUse, 0x6997984b, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PrivilegeUse_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DetailedTracking_defined) +DEFINE_GUID(Audit_DetailedTracking, 0x6997984c, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DetailedTracking_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_PolicyChange_defined) +DEFINE_GUID(Audit_PolicyChange, 0x6997984d, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_PolicyChange_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountManagement_defined) +DEFINE_GUID(Audit_AccountManagement, 0x6997984e, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountManagement_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_DirectoryServiceAccess_defined) +DEFINE_GUID(Audit_DirectoryServiceAccess, 0x6997984f, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_DirectoryServiceAccess_defined +#endif +#endif + +#if !defined(INITGUID) || !defined(Audit_AccountLogon_defined) +DEFINE_GUID(Audit_AccountLogon, 0x69979850, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30); +#ifdef INITGUID +#define Audit_AccountLogon_defined +#endif +#endif +#endif + #ifndef _NTSECAPI_ #define _NTSECAPI_ @@ -414,9 +893,19 @@ typedef PVOID LSA_HANDLE,*PLSA_HANDLE; typedef enum _TRUSTED_INFORMATION_CLASS { - TrustedDomainNameInformation = 1,TrustedControllersInformation,TrustedPosixOffsetInformation,TrustedPasswordInformation, - TrustedDomainInformationBasic,TrustedDomainInformationEx,TrustedDomainAuthInformation,TrustedDomainFullInformation, - TrustedDomainAuthInformationInternal,TrustedDomainFullInformationInternal,TrustedDomainInformationEx2Internal,TrustedDomainFullInformation2Internal + TrustedDomainNameInformation = 1, + TrustedControllersInformation, + TrustedPosixOffsetInformation, + TrustedPasswordInformation, + TrustedDomainInformationBasic, + TrustedDomainInformationEx, + TrustedDomainAuthInformation, + TrustedDomainFullInformation, + TrustedDomainAuthInformationInternal, + TrustedDomainFullInformationInternal, + TrustedDomainInformationEx2Internal, + TrustedDomainFullInformation2Internal, + TrustedDomainSupportedEncryptionTypes } TRUSTED_INFORMATION_CLASS,*PTRUSTED_INFORMATION_CLASS; typedef struct _TRUSTED_DOMAIN_NAME_INFO { @@ -456,7 +945,20 @@ #define TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0x00000010 #define TRUST_ATTRIBUTE_WITHIN_FOREST 0x00000020 #define TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0x00000040 + +#if _WIN32_WINNT >= 0x0600 #define TRUST_ATTRIBUTE_TRUST_USES_RC4_ENCRYPTION 0x00000080 +#define TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS 0x00000100 +#endif + +#if _WIN32_WINNT >= 0x0602 +#define TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION 0x00000200 +#define TRUST_ATTRIBUTE_PIM_TRUST 0x00000400 +#endif + +#if _WIN32_WINNT >= 0x0603 +#define TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x00000800 +#endif #define TRUST_ATTRIBUTES_VALID 0xFF03FFFF #define TRUST_ATTRIBUTES_USER 0xFF000000 @@ -514,6 +1016,10 @@ TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation; } TRUSTED_DOMAIN_FULL_INFORMATION2,*PTRUSTED_DOMAIN_FULL_INFORMATION2; + typedef struct _TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES { + ULONG SupportedEncryptionTypes; + } TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,*PTRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES; + typedef enum { ForestTrustTopLevelName,ForestTrustTopLevelNameEx,ForestTrustDomainInfo,ForestTrustRecordTypeLast = ForestTrustDomainInfo } LSA_FOREST_TRUST_RECORD_TYPE; @@ -592,7 +1098,7 @@ ULONG FailedAttemptCountSinceLastSuccessfulLogon; } LSA_LAST_INTER_LOGON_INFO,*PLSA_LAST_INTER_LOGON_INFO; #endif - + typedef struct _SECURITY_LOGON_SESSION_DATA { ULONG Size; LUID LogonId; @@ -634,6 +1140,52 @@ NTSTATUS NTAPI LsaLookupNames(LSA_HANDLE PolicyHandle,ULONG Count,PLSA_UNICODE_STRING Names,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_SID *Sids); NTSTATUS NTAPI LsaLookupNames2(LSA_HANDLE PolicyHandle,ULONG Flags,ULONG Count,PLSA_UNICODE_STRING Names,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_SID2 *Sids); NTSTATUS NTAPI LsaLookupSids(LSA_HANDLE PolicyHandle,ULONG Count,PSID *Sids,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_NAME *Names); + NTSTATUS NTAPI LsaLookupSids2(LSA_HANDLE PolicyHandle,ULONG LookupOptions,ULONG Count,PSID *Sids,PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,PLSA_TRANSLATED_NAME *Names); + NTSTATUS NTAPI LsaSetCAPs(PLSA_UNICODE_STRING CAPDNs,ULONG CAPDNCount,ULONG Flags); + NTSTATUS NTAPI LsaGetAppliedCAPIDs(PLSA_UNICODE_STRING SystemName,PSID **CAPIDs,PULONG CAPIDCount); + + #define MAXIMUM_CAPES_PER_CAP 0x7f + + #define CENTRAL_ACCESS_POLICY_OWNER_RIGHTS_PRESENT_FLAG 0x00000001 + #define CENTRAL_ACCESS_POLICY_STAGED_OWNER_RIGHTS_PRESENT_FLAG 0x00000100 + #define CENTRAL_ACCESS_POLICY_STAGED_FLAG 0x00010000 + #define STAGING_FLAG(Effective) ((Effective & 0xf) << 8) + + #define CENTRAL_ACCESS_POLICY_VALID_FLAG_MASK (CENTRAL_ACCESS_POLICY_OWNER_RIGHTS_PRESENT_FLAG | \ + CENTRAL_ACCESS_POLICY_STAGED_OWNER_RIGHTS_PRESENT_FLAG | \ + CENTRAL_ACCESS_POLICY_STAGED_FLAG) + + #define LSASETCAPS_RELOAD_FLAG 0x00000001 + #define LSASETCAPS_VALID_FLAG_MASK LSASETCAPS_RELOAD_FLAG + + typedef struct _CENTRAL_ACCESS_POLICY_ENTRY { + LSA_UNICODE_STRING Name; + LSA_UNICODE_STRING Description; + LSA_UNICODE_STRING ChangeId; + ULONG LengthAppliesTo; + PUCHAR AppliesTo; + ULONG LengthSD; + PSECURITY_DESCRIPTOR SD; + ULONG LengthStagedSD; + PSECURITY_DESCRIPTOR StagedSD; + ULONG Flags; + } CENTRAL_ACCESS_POLICY_ENTRY, *PCENTRAL_ACCESS_POLICY_ENTRY; + + typedef const CENTRAL_ACCESS_POLICY_ENTRY *PCCENTRAL_ACCESS_POLICY_ENTRY; + + typedef struct _CENTRAL_ACCESS_POLICY { + PSID CAPID; + LSA_UNICODE_STRING Name; + LSA_UNICODE_STRING Description; + LSA_UNICODE_STRING ChangeId; + ULONG Flags; + ULONG CAPECount; + PCENTRAL_ACCESS_POLICY_ENTRY *CAPEs; + } CENTRAL_ACCESS_POLICY, *PCENTRAL_ACCESS_POLICY; + + typedef const CENTRAL_ACCESS_POLICY *PCCENTRAL_ACCESS_POLICY; + + NTSTATUS NTAPI LsaQueryCAPs(PSID *CAPIDs,ULONG CAPIDCount,PCENTRAL_ACCESS_POLICY *CAPs,PULONG CAPCount); #define SE_INTERACTIVE_LOGON_NAME TEXT("SeInteractiveLogonRight") #define SE_NETWORK_LOGON_NAME TEXT("SeNetworkLogonRight") @@ -674,7 +1226,11 @@ #endif enum NEGOTIATE_MESSAGES { - NegEnumPackagePrefixes = 0,NegGetCallerName = 1,NegCallPackageMax + NegEnumPackagePrefixes = 0, + NegGetCallerName = 1, + NegTransferCredentials = 2, + NegMsgReserved1 = 3, + NegCallPackageMax }; #define NEGOTIATE_MAX_PREFIX 32 @@ -733,6 +1289,10 @@ #define DOMAIN_PASSWORD_STORE_CLEARTEXT __MSABI_LONG(0x00000010) #define DOMAIN_REFUSE_PASSWORD_CHANGE __MSABI_LONG(0x00000020) +#if _WIN32_WINNT >= 0x0502 +#define DOMAIN_NO_LM_OWF_CHANGE __MSABI_LONG(0x00000040) +#endif + #ifndef _PASSWORD_NOTIFICATION_DEFINED #define _PASSWORD_NOTIFICATION_DEFINED typedef NTSTATUS (*PSAM_PASSWORD_NOTIFICATION_ROUTINE)(PUNICODE_STRING UserName,ULONG RelativeId,PUNICODE_STRING NewPassword); @@ -755,7 +1315,15 @@ #define MSV1_0_SUBAUTHENTICATION_VALUE "Auth" typedef enum _MSV1_0_LOGON_SUBMIT_TYPE { - MsV1_0InteractiveLogon = 2,MsV1_0Lm20Logon,MsV1_0NetworkLogon,MsV1_0SubAuthLogon,MsV1_0WorkstationUnlockLogon = 7 + MsV1_0InteractiveLogon = 2, + MsV1_0Lm20Logon, + MsV1_0NetworkLogon, + MsV1_0SubAuthLogon, + MsV1_0WorkstationUnlockLogon = 7, + MsV1_0S4ULogon = 12, + MsV1_0VirtualLogon = 82, + MsV1_0NoElevationLogon, + MsV1_0LuidLogon } MSV1_0_LOGON_SUBMIT_TYPE,*PMSV1_0_LOGON_SUBMIT_TYPE; typedef enum _MSV1_0_PROFILE_BUFFER_TYPE { @@ -811,6 +1379,15 @@ #define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000 #define MSV1_0_ALLOW_MSVCHAPV2 0x00010000 +#if _WIN32_WINNT >= 0x0600 +#define MSV1_0_S4U2SELF 0x00020000 +#define MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0x00040000 +#endif + +#if _WIN32_WINNT >= 0x0602 +#define MSV1_0_INTERNET_DOMAIN 0x00080000 +#endif + #define MSV1_0_SUBAUTHENTICATION_DLL 0xFF000000 #define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT 24 #define MSV1_0_MNS_LOGON 0x01000000 @@ -841,6 +1418,19 @@ ULONG SubAuthPackageId; } MSV1_0_SUBAUTH_LOGON,*PMSV1_0_SUBAUTH_LOGON; +#if _WIN32_WINNT >= 0x0600 + +#define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2 + + typedef struct _MSV1_0_S4U_LOGON { + MSV1_0_LOGON_SUBMIT_TYPE MessageType; + ULONG Flags; + UNICODE_STRING UserPrincipalName; + UNICODE_STRING DomainName; + } MSV1_0_S4U_LOGON, *PMSV1_0_S4U_LOGON; + +#endif + #define LOGON_GUEST 0x01 #define LOGON_NOENCRYPTION 0x02 #define LOGON_CACHED_ACCOUNT 0x04 @@ -851,6 +1441,21 @@ #define LOGON_NTLMV2_ENABLED 0x100 #define LOGON_RESOURCE_GROUPS 0x200 #define LOGON_PROFILE_PATH_RETURNED 0x400 +#define LOGON_NT_V2 0x800 +#define LOGON_LM_V2 0x1000 +#define LOGON_NTLM_V2 0x2000 + +#if _WIN32_WINNT >= 0x0600 +#define LOGON_OPTIMIZED 0x4000 +#define LOGON_WINLOGON 0x8000 +#define LOGON_PKINIT 0x10000 +#define LOGON_NO_OPTIMIZED 0x20000 +#endif + +#if _WIN32_WINNT >= 0x0602 +#define LOGON_NO_ELEVATION 0x40000 +#define LOGON_MANAGED_SERVICE 0x80000 +#endif #define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000 @@ -869,9 +1474,34 @@ } MSV1_0_LM20_LOGON_PROFILE,*PMSV1_0_LM20_LOGON_PROFILE; #define MSV1_0_OWF_PASSWORD_LENGTH 16 +#define MSV1_0_SHA_PASSWORD_LENGTH 20 +#define MSV1_0_CREDENTIAL_KEY_LENGTH 20 #define MSV1_0_CRED_LM_PRESENT 0x1 #define MSV1_0_CRED_NT_PRESENT 0x2 +#define MSV1_0_CRED_REMOVED 0x4 +#define MSV1_0_CRED_CREDKEY_PRESENT 0x8 +#define MSV1_0_CRED_SHA_PRESENT 0x10 + #define MSV1_0_CRED_VERSION 0 +#define MSV1_0_CRED_VERSION_V2 2 +#define MSV1_0_CRED_VERSION_V3 4 +#define MSV1_0_CRED_VERSION_IUM 0xffff0001 +#define MSV1_0_CRED_VERSION_REMOTE 0xffff0002 +#define MSV1_0_CRED_VERSION_ARSO 0xffff0003 +#define MSV1_0_CRED_VERSION_RESERVED_1 0xfffffffe +#define MSV1_0_CRED_VERSION_INVALID 0xffffffff + + typedef enum _MSV1_0_CREDENTIAL_KEY_TYPE { + InvalidCredKey, + DeprecatedIUMCredKey, + DomainUserCredKey, + LocalUserCredKey, + ExternallySuppliedCredKey + } MSV1_0_CREDENTIAL_KEY_TYPE; + + typedef struct _MSV1_0_CREDENTIAL_KEY { + UCHAR Data[MSV1_0_CREDENTIAL_KEY_LENGTH]; + } MSV1_0_CREDENTIAL_KEY, *PMSV1_0_CREDENTIAL_KEY; typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL { ULONG Version; @@ -880,6 +1510,40 @@ UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH]; } MSV1_0_SUPPLEMENTAL_CREDENTIAL,*PMSV1_0_SUPPLEMENTAL_CREDENTIAL; + typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL_V2 { + ULONG Version; + ULONG Flags; + UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH]; + MSV1_0_CREDENTIAL_KEY CredentialKey; + } MSV1_0_SUPPLEMENTAL_CREDENTIAL_V2, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL_V2; + + typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL_V3 { + ULONG Version; + ULONG Flags; + MSV1_0_CREDENTIAL_KEY_TYPE CredentialKeyType; + UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH]; + MSV1_0_CREDENTIAL_KEY CredentialKey; + UCHAR ShaPassword[MSV1_0_SHA_PASSWORD_LENGTH]; + } MSV1_0_SUPPLEMENTAL_CREDENTIAL_V3, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL_V3; + + typedef struct _MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL { + ULONG Version; + ULONG EncryptedCredsSize; + UCHAR EncryptedCreds[1]; + } MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL; + +#define MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL_SIZE(Creds) \ + (FIELD_OFFSET(MSV1_0_IUM_SUPPLEMENTAL_CREDENTIAL, EncryptedCreds) + (Creds)->EncryptedCredsSize) + + typedef struct _MSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL { + ULONG Version; + ULONG Flags; + MSV1_0_CREDENTIAL_KEY CredentialKey; + MSV1_0_CREDENTIAL_KEY_TYPE CredentialKeyType; + ULONG EncryptedCredsSize; + UCHAR EncryptedCreds[1]; + } MSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_REMOTE_SUPPLEMENTAL_CREDENTIAL; + #define MSV1_0_NTLM3_RESPONSE_LENGTH 16 #define MSV1_0_NTLM3_OWF_LENGTH 16 @@ -888,6 +1552,14 @@ #define MSV1_0_AV_FLAG_FORCE_GUEST 0x00000001 +#if _WIN32_WINNT >= 0x0600 +#define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES 0x00000002 +#endif + +#if _WIN32_WINNT >= 0x0601 +#define MSV1_0_AV_FLAG_UNVERIFIED_TARGET 0x00000004 +#endif + typedef struct _MSV1_0_NTLM3_RESPONSE { UCHAR Response[MSV1_0_NTLM3_RESPONSE_LENGTH]; UCHAR RespType; @@ -924,13 +1596,44 @@ typedef struct _MSV1_0_AV_PAIR { USHORT AvId; USHORT AvLen; - } MSV1_0_AV_PAIR,*PMSV1_0_AV_PAIR; typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE { - MsV1_0Lm20ChallengeRequest = 0,MsV1_0Lm20GetChallengeResponse,MsV1_0EnumerateUsers,MsV1_0GetUserInfo,MsV1_0ReLogonUsers,MsV1_0ChangePassword, - MsV1_0ChangeCachedPassword,MsV1_0GenericPassthrough,MsV1_0CacheLogon,MsV1_0SubAuth,MsV1_0DeriveCredential,MsV1_0CacheLookup, - MsV1_0SetProcessOption + MsV1_0Lm20ChallengeRequest = 0, + MsV1_0Lm20GetChallengeResponse, + MsV1_0EnumerateUsers, + MsV1_0GetUserInfo, + MsV1_0ReLogonUsers, + MsV1_0ChangePassword, + MsV1_0ChangeCachedPassword, + MsV1_0GenericPassthrough, + MsV1_0CacheLogon, + MsV1_0SubAuth, + MsV1_0DeriveCredential, + MsV1_0CacheLookup, +#if _WIN32_WINNT >= 0x0501 + MsV1_0SetProcessOption, +#endif +#if _WIN32_WINNT >= 0x0600 + MsV1_0ConfigLocalAliases, + MsV1_0ClearCachedCredentials, +#endif +#if _WIN32_WINNT >= 0x0601 + MsV1_0LookupToken, +#endif +#if _WIN32_WINNT >= 0x0602 + MsV1_0ValidateAuth, + MsV1_0CacheLookupEx, + MsV1_0GetCredentialKey, + MsV1_0SetThreadOption, +#endif +#if _WIN32_WINNT >= 0x0A00 + MsV1_0DecryptDpapiMasterKey, + MsV1_0GetStrongCredentialKey, + MsV1_0TransferCred, + MsV1_0ProvisionTbal, + MsV1_0DeleteTbalSecrets +#endif } MSV1_0_PROTOCOL_MESSAGE_TYPE,*PMSV1_0_PROTOCOL_MESSAGE_TYPE; typedef struct _MSV1_0_CHANGEPASSWORD_REQUEST { @@ -986,6 +1689,7 @@ #define RTL_ENCRYPT_MEMORY_SIZE 8 #define RTL_ENCRYPT_OPTION_CROSS_PROCESS 0x01 #define RTL_ENCRYPT_OPTION_SAME_LOGON 0x02 +#define RTL_ENCRYPT_OPTION_FOR_SYSTEM 0x04 NTSTATUS WINAPI RtlEncryptMemory(PVOID Memory,ULONG MemorySize,ULONG OptionFlags); NTSTATUS WINAPI RtlDecryptMemory(PVOID Memory,ULONG MemorySize,ULONG OptionFlags); @@ -997,6 +1701,8 @@ #define KERB_ETYPE_DES_CBC_CRC 1 #define KERB_ETYPE_DES_CBC_MD4 2 #define KERB_ETYPE_DES_CBC_MD5 3 +#define KERB_ETYPE_AES128_CTS_HMAC_SHA1_96 17 +#define KERB_ETYPE_AES256_CTS_HMAC_SHA1_96 18 #define KERB_ETYPE_RC4_MD4 -128 #define KERB_ETYPE_RC4_PLAIN2 -129 @@ -1009,6 +1715,8 @@ #define KERB_ETYPE_RC4_PLAIN_OLD_EXP -136 #define KERB_ETYPE_RC4_PLAIN -140 #define KERB_ETYPE_RC4_PLAIN_EXP -141 +#define KERB_ETYPE_AES128_CTS_HMAC_SHA1_96_PLAIN -148 +#define KERB_ETYPE_AES256_CTS_HMAC_SHA1_96_PLAIN -149 #define KERB_ETYPE_DSA_SHA1_CMS 9 #define KERB_ETYPE_RSA_MD5_CMS 10 @@ -1040,6 +1748,9 @@ #define KERB_CHECKSUM_KRB_DES_MAC_K 5 #define KERB_CHECKSUM_MD5 7 #define KERB_CHECKSUM_MD5_DES 8 +#define KERB_CHECKSUM_SHA1_NEW 14 +#define KERB_CHECKSUM_HMAC_SHA1_96_AES128 15 +#define KERB_CHECKSUM_HMAC_SHA1_96_AES256 16 #define KERB_CHECKSUM_LM -130 #define KERB_CHECKSUM_SHA1 -131 @@ -1050,6 +1761,8 @@ #define KERB_CHECKSUM_RC4_MD5 -136 #define KERB_CHECKSUM_MD5_HMAC -137 #define KERB_CHECKSUM_HMAC_MD5 -138 +#define KERB_CHECKSUM_HMAC_SHA1_96_AES128_Ki -150 +#define KERB_CHECKSUM_HMAC_SHA1_96_AES256_Ki -151 #define AUTH_REQ_ALLOW_FORWARDABLE 0x00000001 #define AUTH_REQ_ALLOW_PROXIABLE 0x00000002 @@ -1080,6 +1793,10 @@ #define KERB_TICKET_FLAGS_hw_authent 0x00100000 #define KERB_TICKET_FLAGS_ok_as_delegate 0x00040000 #define KERB_TICKET_FLAGS_name_canonicalize 0x00010000 +#if _WIN32_WINNT == 0x0501 +#define KERB_TICKET_FLAGS_cname_in_pa_data 0x00040000 +#endif +#define KERB_TICKET_FLAGS_enc_pa_rep 0x00010000 #define KERB_TICKET_FLAGS_reserved1 0x00000001 #define KRB_NT_UNKNOWN 0 @@ -1091,12 +1808,21 @@ #define KRB_NT_SRV_XHST 4 #define KRB_NT_UID 5 #define KRB_NT_ENTERPRISE_PRINCIPAL 10 +#define KRB_NT_WELLKNOWN 11 +#define KRB_NT_MS_BRANCH_ID -133 #define KRB_NT_ENT_PRINCIPAL_AND_ID -130 #define KRB_NT_MS_PRINCIPAL -128 #define KRB_NT_MS_PRINCIPAL_AND_ID -129 #define KERB_IS_MS_PRINCIPAL(_x_) (((_x_) <= KRB_NT_MS_PRINCIPAL) || ((_x_) >= KRB_NT_ENTERPRISE_PRINCIPAL)) +#if _WIN32_WINNT >= 0x0600 +#define KRB_NT_X500_PRINCIPAL 6 +#endif + +#define KRB_WELLKNOWN_STRING L"WELLKNOWN" +#define KRB_ANONYMOUS_STRING L"ANONYMOUS" + #ifndef MICROSOFT_KERBEROS_NAME_A #define MICROSOFT_KERBEROS_NAME_A "Kerberos" @@ -1111,12 +1837,22 @@ #define KERB_WRAP_NO_ENCRYPT 0x80000001 typedef enum _KERB_LOGON_SUBMIT_TYPE { - KerbInteractiveLogon = 2,KerbSmartCardLogon = 6,KerbWorkstationUnlockLogon = 7,KerbSmartCardUnlockLogon = 8,KerbProxyLogon = 9, - KerbTicketLogon = 10,KerbTicketUnlockLogon = 11,KerbS4ULogon = 12 + KerbInteractiveLogon = 2, + KerbSmartCardLogon = 6, + KerbWorkstationUnlockLogon = 7, + KerbSmartCardUnlockLogon = 8, + KerbProxyLogon = 9, + KerbTicketLogon = 10, + KerbTicketUnlockLogon = 11, + KerbS4ULogon = 12, #if (_WIN32_WINNT >= 0x0600) - ,KerbCertificateLogon = 13, - KerbCertificateS4ULogon = 14, - KerbCertificateUnlockLogon = 15 + KerbCertificateLogon = 13, + KerbCertificateS4ULogon = 14, + KerbCertificateUnlockLogon = 15, +#endif +#if (_WIN32_WINNT >= 0x0602) + KerbNoElevationLogon = 83, + KerbLuidLogon = 84 #endif } KERB_LOGON_SUBMIT_TYPE,*PKERB_LOGON_SUBMIT_TYPE; @@ -1154,12 +1890,18 @@ } KERB_TICKET_LOGON,*PKERB_TICKET_LOGON; #define KERB_LOGON_FLAG_ALLOW_EXPIRED_TICKET 0x1 +#define KERB_LOGON_FLAG_REDIRECTED 0x2 typedef struct _KERB_TICKET_UNLOCK_LOGON { KERB_TICKET_LOGON Logon; LUID LogonId; } KERB_TICKET_UNLOCK_LOGON,*PKERB_TICKET_UNLOCK_LOGON; +#if _WIN32_WINNT >= 0x0600 +#define KERB_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2 +#define KERB_S4U_LOGON_FLAG_IDENTIFY 0x8 +#endif + typedef struct _KERB_S4U_LOGON { KERB_LOGON_SUBMIT_TYPE MessageType; ULONG Flags; @@ -1202,17 +1944,63 @@ PUCHAR Value; } KERB_CRYPTO_KEY,*PKERB_CRYPTO_KEY; + typedef struct KERB_CRYPTO_KEY32 { + LONG KeyType; + ULONG Length; + ULONG Offset; + } KERB_CRYPTO_KEY32,*PKERB_CRYPTO_KEY32; + typedef struct _KERB_TICKET_PROFILE { KERB_INTERACTIVE_PROFILE Profile; KERB_CRYPTO_KEY SessionKey; } KERB_TICKET_PROFILE,*PKERB_TICKET_PROFILE; typedef enum _KERB_PROTOCOL_MESSAGE_TYPE { - KerbDebugRequestMessage = 0,KerbQueryTicketCacheMessage,KerbChangeMachinePasswordMessage,KerbVerifyPacMessage,KerbRetrieveTicketMessage, - KerbUpdateAddressesMessage,KerbPurgeTicketCacheMessage,KerbChangePasswordMessage,KerbRetrieveEncodedTicketMessage,KerbDecryptDataMessage, - KerbAddBindingCacheEntryMessage,KerbSetPasswordMessage,KerbSetPasswordExMessage,KerbVerifyCredentialsMessage,KerbQueryTicketCacheExMessage, - KerbPurgeTicketCacheExMessage,KerbRefreshSmartcardCredentialsMessage,KerbAddExtraCredentialsMessage,KerbQuerySupplementalCredentialsMessage, - KerbTransferCredentialsMessage,KerbQueryTicketCacheEx2Message + KerbDebugRequestMessage = 0, + KerbQueryTicketCacheMessage, + KerbChangeMachinePasswordMessage, + KerbVerifyPacMessage, + KerbRetrieveTicketMessage, + KerbUpdateAddressesMessage, + KerbPurgeTicketCacheMessage, + KerbChangePasswordMessage, + KerbRetrieveEncodedTicketMessage, + KerbDecryptDataMessage, + KerbAddBindingCacheEntryMessage, + KerbSetPasswordMessage, + KerbSetPasswordExMessage, +#if _WIN32_WINNT >= 0x0501 + KerbVerifyCredentialsMessage, + KerbQueryTicketCacheExMessage, + KerbPurgeTicketCacheExMessage, +#endif +#if _WIN32_WINNT >= 0x0502 + KerbRefreshSmartcardCredentialsMessage, + KerbAddExtraCredentialsMessage, + KerbQuerySupplementalCredentialsMessage, +#endif +#if _WIN32_WINNT >= 0x0600 + KerbTransferCredentialsMessage, + KerbQueryTicketCacheEx2Message, + KerbSubmitTicketMessage, + KerbAddExtraCredentialsExMessage, +#endif +#if _WIN32_WINNT >= 0x0602 + KerbQueryKdcProxyCacheMessage, + KerbPurgeKdcProxyCacheMessage, + KerbQueryTicketCacheEx3Message, + KerbCleanupMachinePkinitCredsMessage, + KerbAddBindingCacheEntryExMessage, + KerbQueryBindingCacheMessage, + KerbPurgeBindingCacheMessage, + KerbPinKdcMessage, + KerbUnpinAllKdcsMessage, + KerbQueryDomainExtendedPoliciesMessage, + KerbQueryS4U2ProxyCacheMessage, +#endif +#if _WIN32_WINNT >= 0x0A00 + KerbRetrieveKeyTabMessage +#endif } KERB_PROTOCOL_MESSAGE_TYPE,*PKERB_PROTOCOL_MESSAGE_TYPE; typedef struct _KERB_QUERY_TKT_CACHE_REQUEST { @@ -1255,6 +2043,24 @@ ULONG SessionKeyType; } KERB_TICKET_CACHE_INFO_EX2,*PKERB_TICKET_CACHE_INFO_EX2; +#if _WIN32_WINNT >= 0x0602 + typedef struct _KERB_TICKET_CACHE_INFO_EX3 { + UNICODE_STRING ClientName; + UNICODE_STRING ClientRealm; + UNICODE_STRING ServerName; + UNICODE_STRING ServerRealm; + LARGE_INTEGER StartTime; + LARGE_INTEGER EndTime; + LARGE_INTEGER RenewTime; + LONG EncryptionType; + ULONG TicketFlags; + ULONG SessionKeyType; + ULONG BranchId; + ULONG CacheFlags; + UNICODE_STRING KdcCalled; + } KERB_TICKET_CACHE_INFO_EX3, *PKERB_TICKET_CACHE_INFO_EX3; +#endif + typedef struct _KERB_QUERY_TKT_CACHE_RESPONSE { KERB_PROTOCOL_MESSAGE_TYPE MessageType; ULONG CountOfTickets; @@ -1273,6 +2079,14 @@ KERB_TICKET_CACHE_INFO_EX2 Tickets[ANYSIZE_ARRAY]; } KERB_QUERY_TKT_CACHE_EX2_RESPONSE,*PKERB_QUERY_TKT_CACHE_EX2_RESPONSE; +#if _WIN32_WINNT >= 0x0602 + typedef struct _KERB_QUERY_TKT_CACHE_EX3_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG CountOfTickets; + KERB_TICKET_CACHE_INFO_EX3 Tickets[ANYSIZE_ARRAY]; + } KERB_QUERY_TKT_CACHE_EX3_RESPONSE, *PKERB_QUERY_TKT_CACHE_EX3_RESPONSE; +#endif + #ifndef __SECHANDLE_DEFINED__ typedef struct _SecHandle { ULONG_PTR dwLower; @@ -1290,7 +2104,14 @@ #define KERB_RETRIEVE_TICKET_USE_CREDHANDLE 0x4 #define KERB_RETRIEVE_TICKET_AS_KERB_CRED 0x8 #define KERB_RETRIEVE_TICKET_WITH_SEC_CRED 0x10 + +#if _WIN32_WINNT >= 0x0600 #define KERB_RETRIEVE_TICKET_CACHE_TICKET 0x20 +#endif + +#if _WIN32_WINNT >= 0x0601 +#define KERB_RETRIEVE_TICKET_MAX_LIFETIME 0x40 +#endif #define KERB_ETYPE_DEFAULT 0x0 @@ -1366,6 +2187,105 @@ KERB_TICKET_CACHE_INFO_EX TicketTemplate; } KERB_PURGE_TKT_CACHE_EX_REQUEST,*PKERB_PURGE_TKT_CACHE_EX_REQUEST; + typedef struct _KERB_SUBMIT_TKT_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + LUID LogonId; + ULONG Flags; + KERB_CRYPTO_KEY32 Key; + ULONG KerbCredSize; + ULONG KerbCredOffset; + } KERB_SUBMIT_TKT_REQUEST, *PKERB_SUBMIT_TKT_REQUEST; + +#if _WIN32_WINNT >= 0x0602 + + typedef struct _KERB_QUERY_KDC_PROXY_CACHE_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + LUID LogonId; + } KERB_QUERY_KDC_PROXY_CACHE_REQUEST, *PKERB_QUERY_KDC_PROXY_CACHE_REQUEST; + + typedef struct _KDC_PROXY_CACHE_ENTRY_DATA { + ULONG64 SinceLastUsed; + UNICODE_STRING DomainName; + UNICODE_STRING ProxyServerName; + UNICODE_STRING ProxyServerVdir; + USHORT ProxyServerPort; + LUID LogonId; + UNICODE_STRING CredUserName; + UNICODE_STRING CredDomainName; + BOOLEAN GlobalCache; + } KDC_PROXY_CACHE_ENTRY_DATA, *PKDC_PROXY_CACHE_ENTRY_DATA; + + typedef struct _KERB_QUERY_KDC_PROXY_CACHE_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG CountOfEntries; + PKDC_PROXY_CACHE_ENTRY_DATA Entries; + } KERB_QUERY_KDC_PROXY_CACHE_RESPONSE, *PKERB_QUERY_KDC_PROXY_CACHE_RESPONSE; + + typedef struct _KERB_PURGE_KDC_PROXY_CACHE_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + LUID LogonId; + } KERB_PURGE_KDC_PROXY_CACHE_REQUEST, *PKERB_PURGE_KDC_PROXY_CACHE_REQUEST; + + typedef struct _KERB_PURGE_KDC_PROXY_CACHE_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG CountOfPurged; + } KERB_PURGE_KDC_PROXY_CACHE_RESPONSE, *PKERB_PURGE_KDC_PROXY_CACHE_RESPONSE; + +#define KERB_S4U2PROXY_CACHE_ENTRY_INFO_FLAG_NEGATIVE 0x1 + + typedef struct _KERB_S4U2PROXY_CACHE_ENTRY_INFO { + UNICODE_STRING ServerName; + ULONG Flags; + NTSTATUS LastStatus; + LARGE_INTEGER Expiry; + } KERB_S4U2PROXY_CACHE_ENTRY_INFO, *PKERB_S4U2PROXY_CACHE_ENTRY_INFO; + +#define KERB_S4U2PROXY_CRED_FLAG_NEGATIVE 0x1 + + typedef struct _KERB_S4U2PROXY_CRED { + UNICODE_STRING UserName; + UNICODE_STRING DomainName; + ULONG Flags; + NTSTATUS LastStatus; + LARGE_INTEGER Expiry; + ULONG CountOfEntries; + PKERB_S4U2PROXY_CACHE_ENTRY_INFO Entries; + } KERB_S4U2PROXY_CRED, *PKERB_S4U2PROXY_CRED; + + typedef struct _KERB_QUERY_S4U2PROXY_CACHE_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + LUID LogonId; + } KERB_QUERY_S4U2PROXY_CACHE_REQUEST, *PKERB_QUERY_S4U2PROXY_CACHE_REQUEST; + + typedef struct _KERB_QUERY_S4U2PROXY_CACHE_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG CountOfCreds; + PKERB_S4U2PROXY_CRED Creds; + } KERB_QUERY_S4U2PROXY_CACHE_RESPONSE, *PKERB_QUERY_S4U2PROXY_CACHE_RESPONSE; + +#endif + +#if _WIN32_WINNT >= 0x0A00 + + typedef struct _KERB_RETRIEVE_KEY_TAB_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + UNICODE_STRING UserName; + UNICODE_STRING DomainName; + UNICODE_STRING Password; + } KERB_RETRIEVE_KEY_TAB_REQUEST, *PKERB_RETRIEVE_KEY_TAB_REQUEST; + + typedef struct _KERB_RETRIEVE_KEY_TAB_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG KeyTabLength; + PUCHAR KeyTab; + } KERB_RETRIEVE_KEY_TAB_RESPONSE, *PKERB_RETRIEVE_KEY_TAB_RESPONSE; + +#endif + typedef struct _KERB_CHANGEPASSWORD_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; UNICODE_STRING DomainName; @@ -1453,6 +2373,16 @@ #define KERB_REQUEST_REPLACE_CREDENTIAL 2 #define KERB_REQUEST_REMOVE_CREDENTIAL 4 +#if _WIN32_WINNT >= 0x0600 + + typedef struct _KERB_ADD_CREDENTIALS_REQUEST_EX { + KERB_ADD_CREDENTIALS_REQUEST Credentials; + ULONG PrincipalNameCount; + UNICODE_STRING PrincipalNames[1]; + } KERB_ADD_CREDENTIALS_REQUEST_EX, *PKERB_ADD_CREDENTIALS_REQUEST_EX; + +#endif + typedef struct _KERB_TRANSFER_CRED_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; LUID OriginLogonId; @@ -1460,7 +2390,79 @@ ULONG Flags; } KERB_TRANSFER_CRED_REQUEST,*PKERB_TRANSFER_CRED_REQUEST; -#if (_WIN32_WINNT >= 0x0600) +#define KERB_TRANSFER_CRED_WITH_TICKETS 1 +#define KERB_TRANSFER_CRED_CLEANUP_CREDENTIALS 2 + +#if _WIN32_WINNT >= 0x0602 + + typedef struct _KERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + LUID LogonId; + } KERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST, *PKERB_CLEANUP_MACHINE_PKINIT_CREDS_REQUEST; + + typedef struct _KERB_BINDING_CACHE_ENTRY_DATA { + ULONG64 DiscoveryTime; + UNICODE_STRING RealmName; + UNICODE_STRING KdcAddress; + ULONG AddressType; + ULONG Flags; + ULONG DcFlags; + ULONG CacheFlags; + UNICODE_STRING KdcName; + } KERB_BINDING_CACHE_ENTRY_DATA, *PKERB_BINDING_CACHE_ENTRY_DATA; + + typedef struct _KERB_QUERY_BINDING_CACHE_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG CountOfEntries; + PKERB_BINDING_CACHE_ENTRY_DATA Entries; + } KERB_QUERY_BINDING_CACHE_RESPONSE, *PKERB_QUERY_BINDING_CACHE_RESPONSE; + + typedef struct _KERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + UNICODE_STRING RealmName; + UNICODE_STRING KdcAddress; + ULONG AddressType; + ULONG DcFlags; + } KERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST, *PKERB_ADD_BINDING_CACHE_ENTRY_EX_REQUEST; + + typedef struct _KERB_QUERY_BINDING_CACHE_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + } KERB_QUERY_BINDING_CACHE_REQUEST, *PKERB_QUERY_BINDING_CACHE_REQUEST; + + typedef struct _KERB_PURGE_BINDING_CACHE_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + } KERB_PURGE_BINDING_CACHE_REQUEST, *PKERB_PURGE_BINDING_CACHE_REQUEST; + + typedef struct _KERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + UNICODE_STRING DomainName; + } KERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST, *PKERB_QUERY_DOMAIN_EXTENDED_POLICIES_REQUEST; + +#define KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE_FLAG_DAC_DISABLED 1 + + typedef struct _KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE { + KERB_PROTOCOL_MESSAGE_TYPE MessageType; + ULONG Flags; + ULONG ExtendedPolicies; + ULONG DsFlags; + } KERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE, *PKERB_QUERY_DOMAIN_EXTENDED_POLICIES_RESPONSE; + + typedef enum _KERB_CERTIFICATE_INFO_TYPE { + CertHashInfo = 1, + } KERB_CERTIFICATE_INFO_TYPE, *PKERB_CERTIFICATE_INFO_TYPE; + + typedef struct _KERB_CERTIFICATE_HASHINFO { + USHORT StoreNameLength; + USHORT HashLength; + } KERB_CERTIFICATE_HASHINFO, *PKERB_CERTIFICATE_HASHINFO; + + typedef struct _KERB_CERTIFICATE_INFO { + ULONG CertInfoSize; + ULONG InfoType; + } KERB_CERTIFICATE_INFO, *PKERB_CERTIFICATE_INFO; + +#endif #define PER_USER_POLICY_UNCHANGED 0x00 #define PER_USER_AUDIT_SUCCESS_INCLUDE 0x01 @@ -1478,11 +2480,36 @@ } AUDIT_POLICY_INFORMATION, *PAUDIT_POLICY_INFORMATION; typedef const PAUDIT_POLICY_INFORMATION PCAUDIT_POLICY_INFORMATION, LPCAUDIT_POLICY_INFORMATION; +#define AUDIT_SET_SYSTEM_POLICY 0x0001 +#define AUDIT_QUERY_SYSTEM_POLICY 0x0002 +#define AUDIT_SET_USER_POLICY 0x0004 +#define AUDIT_QUERY_USER_POLICY 0x0008 +#define AUDIT_ENUMERATE_USERS 0x0010 +#define AUDIT_SET_MISC_POLICY 0x0020 +#define AUDIT_QUERY_MISC_POLICY 0x0040 + +#define AUDIT_GENERIC_ALL (STANDARD_RIGHTS_REQUIRED | AUDIT_SET_SYSTEM_POLICY | AUDIT_QUERY_SYSTEM_POLICY | \ + AUDIT_SET_USER_POLICY | AUDIT_QUERY_USER_POLICY | AUDIT_ENUMERATE_USERS | \ + AUDIT_SET_MISC_POLICY | AUDIT_QUERY_MISC_POLICY) + +#define AUDIT_GENERIC_READ (STANDARD_RIGHTS_READ | AUDIT_QUERY_SYSTEM_POLICY | AUDIT_QUERY_USER_POLICY | \ + AUDIT_ENUMERATE_USERS | AUDIT_QUERY_MISC_POLICY) + +#define AUDIT_GENERIC_WRITE (STANDARD_RIGHTS_WRITE | AUDIT_SET_USER_POLICY | AUDIT_SET_MISC_POLICY | \ + AUDIT_SET_SYSTEM_POLICY) + +#define AUDIT_GENERIC_EXECUTE STANDARD_RIGHTS_EXECUTE + typedef struct _POLICY_AUDIT_SID_ARRAY { ULONG UsersCount; PSID *UserSidArray; } POLICY_AUDIT_SID_ARRAY, *PPOLICY_AUDIT_SID_ARRAY; +#if _WIN32_WINNT >= 0x0600 + +#define KERB_CERTIFICATE_LOGON_FLAG_CHECK_DUPLICATES 0x1 +#define KERB_CERTIFICATE_LOGON_FLAG_USE_CERTIFICATE_INFO 0x2 + typedef struct _KERB_CERTIFICATE_LOGON { KERB_LOGON_SUBMIT_TYPE MessageType; UNICODE_STRING DomainName; @@ -1498,6 +2525,20 @@ LUID LogonId; } KERB_CERTIFICATE_UNLOCK_LOGON, *PKERB_CERTIFICATE_UNLOCK_LOGON; +#define KERB_CERTIFICATE_S4U_LOGON_FLAG_CHECK_DUPLICATES 0x1 +#define KERB_CERTIFICATE_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2 +#define KERB_CERTIFICATE_S4U_LOGON_FLAG_FAIL_IF_NT_AUTH_POLICY_REQUIRED 0x4 +#define KERB_CERTIFICATE_S4U_LOGON_FLAG_IDENTIFY 0x8 + + typedef struct _KERB_CERTIFICATE_S4U_LOGON { + KERB_LOGON_SUBMIT_TYPE MessageType; + ULONG Flags; + UNICODE_STRING UserPrincipalName; + UNICODE_STRING DomainName; + ULONG CertificateLength; + PUCHAR Certificate; + } KERB_CERTIFICATE_S4U_LOGON, *PKERB_CERTIFICATE_S4U_LOGON; + typedef struct _KERB_SMARTCARD_CSP_INFO { DWORD dwCspInfoLen; DWORD MessageType; @@ -1514,6 +2555,8 @@ TCHAR bBuffer; } KERB_SMARTCARD_CSP_INFO, *PKERB_SMARTCARD_CSP_INFO; +#endif + BOOLEAN WINAPI AuditComputeEffectivePolicyBySid( const PSID pSid, const GUID *pSubCategoryGuids, @@ -1615,7 +2658,65 @@ PSECURITY_DESCRIPTOR pSecurityDescriptor ); -#endif /*(_WIN32_WINNT >= 0x0600)*/ + BOOLEAN NTAPI AuditSetGlobalSaclW( + PCWSTR ObjectTypeName, + PACL Acl + ); + + BOOLEAN NTAPI AuditSetGlobalSaclA( + PCSTR ObjectTypeName, + PACL Acl + ); + +#define AuditSetGlobalSacl __MINGW_NAME_AW(AuditSetGlobalSacl) + + BOOLEAN NTAPI AuditQueryGlobalSaclW( + PCWSTR ObjectTypeName, + PACL *Acl + ); + + BOOLEAN NTAPI AuditQueryGlobalSaclA( + PCSTR ObjectTypeName, + PACL *Acl + ); + +#define AuditQueryGlobalSacl __MINGW_NAME_AW(AuditQueryGlobalSacl) + +#if _WIN32_WINNT >= 0x0601 + +#define PKU2U_PACKAGE_NAME_A "pku2u" +#define PKU2U_PACKAGE_NAME L"pku2u" +#define PKU2U_PACKAGE_NAME_W PKU2U_PACKAGE_NAME + + typedef struct _PKU2U_CERT_BLOB { + ULONG CertOffset; + USHORT CertLength; + } PKU2U_CERT_BLOB, *PPKU2U_CERT_BLOB; + +#define PKU2U_CREDUI_CONTEXT_VERSION 0x4154414454524543 + + typedef struct _PKU2U_CREDUI_CONTEXT { + ULONG64 Version; + USHORT cbHeaderLength; + ULONG cbStructureLength; + USHORT CertArrayCount; + ULONG CertArrayOffset; + } PKU2U_CREDUI_CONTEXT, *PPKU2U_CREDUI_CONTEXT; + + typedef enum _PKU2U_LOGON_SUBMIT_TYPE { + Pku2uCertificateS4ULogon = 14, + } PKU2U_LOGON_SUBMIT_TYPE, *PPKU2U_LOGON_SUBMIT_TYPE; + + typedef struct _PKU2U_CERTIFICATE_S4U_LOGON { + PKU2U_LOGON_SUBMIT_TYPE MessageType; + ULONG Flags; + UNICODE_STRING UserPrincipalName; + UNICODE_STRING DomainName; + ULONG CertificateLength; + PUCHAR Certificate; + } PKU2U_CERTIFICATE_S4U_LOGON, *PPKU2U_CERTIFICATE_S4U_LOGON; + +#endif #ifdef __cplusplus }