Share via

3.1.5.1.5 SamrOpenDomain (Opnum 7)

  • Article

The SamrOpenDomain method obtains a handle to a domain object, given a SID.

 long SamrOpenDomain(
   [in] SAMPR_HANDLE ServerHandle,
   [in] unsigned long DesiredAccess,
   [in] PRPC_SID DomainId,
   [out] SAMPR_HANDLE* DomainHandle
 );

ServerHandle: An RPC context handle, as specified in section 2.2.7.2, representing a server object.

DesiredAccess: An ACCESS_MASK. See section 2.2.1.4 for a list of domain access values.

DomainId: A SID value of a domain hosted by the server side of this protocol.

DomainHandle: An RPC context handle, as specified in section 2.2.7.2.

This protocol asks the RPC runtime, via the strict_context_handle attribute, to reject the use of context handles created by a method of a different RPC interface than this one, as specified in [MS-RPCE] section 3.

Upon receiving this message, the server MUST process the data from the message subject to the following constraints in no particular order:

  1. The server MUST return an error if ServerHandle.HandleType is not equal to "Server".

  2. ServerHandle.GrantedAccess MUST have the required access specified in section 3.1.2.2. Otherwise, the server MUST return STATUS_ACCESS_DENIED.

  3. The server MUST translate the following bits in DesiredAccess according to the following table. Translate means to remove the "Incoming bit" and replace with the "Translated bits", as follows.

    Incoming bit

    Translated bits

    GENERIC_READ

    DOMAIN_READ

    GENERIC_WRITE

    DOMAIN_WRITE

    GENERIC_EXECUTE

    DOMAIN_EXECUTE

    GENERIC_ALL

    DOMAIN_ALL_ACCESS

  4. Let D be the domain object whose objectSid is DomainId. If no such object exists, the server MUST return an error code.

  5. Let GrantedAccess be the union of all bits in the "DesiredAccess" column in the following table where the client has the specified access (shown in the "Access mask" column) on the ntSecurityDescriptor on D. A missing value in the "Object ACE type" column means that the access mask applies to the entire object. [MS-ADTS] section 5.1.3.3.3 specifies how to determine the client's access.

    DesiredAccess

    Access mask

    Object ACE type

    DOMAIN_READ_PASSWORD_PARAMETERS

    ACTRL_DS_READ_PROP

    c7407360-20bf-11d0-a768-00aa006e0529

    DOMAIN_WRITE_PASSWORD_PARAMS

    ACTRL_DS_WRITE_PROP

    c7407360-20bf-11d0-a768-00aa006e0529

    DOMAIN_READ_OTHER_PARAMETERS

    ACTRL_DS_READ_PROP

    b8119fd0-04f6-4762-ab7a-4986c76b3f9a

    DOMAIN_WRITE_OTHER_PARAMETERS

    ACTRL_DS_WRITE_PROP

    b8119fd0-04f6-4762-ab7a-4986c76b3f9a

    DOMAIN_CREATE_USER

    Always grant, if DOMAIN_CREATE_USER is requested or if MAXIMUM_ALLOWED is present.

    DOMAIN_CREATE_GROUP

    Always grant, if DOMAIN_CREATE_GROUP is requested or if MAXIMUM_ALLOWED is present. The default security descriptor for a non-DC configuration's domain object does not grant DOMAIN_CREATE_GROUP to any security context.

    DOMAIN_CREATE_ALIAS

    Always grant, if DOMAIN_CREATE_ALIAS is requested or if MAXIMUM_ALLOWED is present.

    DOMAIN_LIST_ACCOUNTS

    ACTRL_DS_LIST

    DOMAIN_LOOKUP

    ACTRL_DS_LIST

    DOMAIN_ADMINISTER_SERVER

    ACTRL_DS_CONTROL_ACCESS

    ab721a52-1e2f-11d0-9819-00aa0040529b

    ACCESS_SYSTEM_SECURITY

    ACCESS_SYSTEM_SECURITY

    WRITE_OWNER

    WRITE_OWNER

    WRITE_DAC

    WRITE_DAC

    DELETE

    DELETE

  6. If GrantedAccess is 0, the server MUST return STATUS_ACCESS_DENIED.

  7. If DesiredAccess contains the MAXIMUM_ALLOWED bit, the server MUST create and return a SamContextHandle (section 3.1.1.10) via DomainHandle with its fields initialized as follows:

    • SamContextHandle.HandleType = "Domain"

    • SamContextHandle.Object = D

    • SamContextHandle.GrantedAccess = GrantedAccess

  8. If DesiredAccess does not contain the MAXIMUM_ALLOWED bit, the following constraint MUST be satisfied:

    1. If DesiredAccess contains bits not in GrantedAccess, the server MUST return STATUS_ACCESS_DENIED. Otherwise, the server MUST create and return a SamContextHandle (section 3.1.1.10) via DomainHandle with its fields initialized as follows:

      • SamContextHandle.HandleType = "Domain"

      • SamContextHandle.Object = D

      • SamContextHandle.GrantedAccess = DesiredAccess

  9. If any processing error occurred, the server MUST return that error. Otherwise, the server MUST return STATUS_SUCCESS to the client.