3.1.5 Message Processing Events and Sequencing Rules

This section specifies the methods of the protocol along with their processing.

The return value space of all methods is the NTSTATUS type, specified in [MS-ERREF] section 2.3. Unless specifically called out, error codes are returned to the client of the protocol and are not handled by any special processing at the client; therefore, the exact error code is implementation-specific. Cases in which the client might handle a specific error code are called out. The set of such error codes are found in section 2.2.1.15.

Methods in RPC Opnum Order

Method	Description
SamrConnect	Returns a handle to a server object. Opnum: 0
SamrCloseHandle	Closes any context handle obtained from this RPC interface. Opnum: 1
SamrSetSecurityObject	Sets the access control on a server, domain, user, group, or alias object. Opnum: 2
SamrQuerySecurityObject	Queries the access control on a server, domain, user, group, or alias object. Opnum: 3
Opnum4NotUsedOnWire	Reserved for local use. Opnum: 4
SamrLookupDomainInSamServer	Obtains the SID of a domain object. Opnum: 5
SamrEnumerateDomainsInSamServer	Obtains a listing of all domains hosted by the server side. Opnum: 6
SamrOpenDomain	Obtains a handle to a domain object. Opnum: 7
SamrQueryInformationDomain	Obtains attributes from a domain object. Opnum: 8
SamrSetInformationDomain	Updates attributes on a domain object. Opnum: 9
SamrCreateGroupInDomain	Creates a group object within a domain. Opnum: 10
SamrEnumerateGroupsInDomain	Enumerates all groups. Opnum: 11
SamrCreateUserInDomain	Creates a user. Opnum: 12
SamrEnumerateUsersInDomain	Enumerates all users. Opnum: 13
SamrCreateAliasInDomain	Creates an alias. Opnum: 14
SamrEnumerateAliasesInDomain	Enumerates all aliases. Opnum: 15
SamrGetAliasMembership	Obtains the union of all aliases of which a given set of SIDs is a member. Opnum: 16
SamrLookupNamesInDomain	Translates a set of account names into a set of RIDs. Opnum: 17
SamrLookupIdsInDomain	Translates a set of RIDs into account names. Opnum: 18
SamrOpenGroup	Obtains a handle to a group. Opnum: 19
SamrQueryInformationGroup	Obtains attributes from a group object. Opnum: 20
SamrSetInformationGroup	Updates attributes on a group object. Opnum: 21
SamrAddMemberToGroup	Adds a member to a group. Opnum: 22
SamrDeleteGroup	Removes a group object. Opnum: 23
SamrRemoveMemberFromGroup	Removes a member from a group. Opnum: 24
SamrGetMembersInGroup	Reads the members of a group. Opnum: 25
SamrSetMemberAttributesOfGroup	Sets the attributes of a member relationship. Opnum: 26
SamrOpenAlias	Obtains a handle to an alias. Opnum: 27
SamrQueryInformationAlias	Obtains attributes from an alias object. Opnum: 28
SamrSetInformationAlias	Updates attributes on an alias object. Opnum: 29
SamrDeleteAlias	Removes an alias object. Opnum: 30
SamrAddMemberToAlias	Adds a member to an alias. Opnum: 31
SamrRemoveMemberFromAlias	Removes a member from an alias. Opnum: 32
SamrGetMembersInAlias	Obtains the membership list of an alias. Opnum: 33
SamrOpenUser	Obtains a handle to a user. Opnum: 34
SamrDeleteUser	Removes a user object. Opnum: 35
SamrQueryInformationUser	Obtains attributes from a user object. Opnum: 36
SamrSetInformationUser	Updates attributes on a user object. Opnum: 37
SamrChangePasswordUser	Changes the password of a user object. Opnum: 38
SamrGetGroupsForUser	Obtains a list of groups of which a user is a member. Opnum: 39
SamrQueryDisplayInformation	Obtains a list of accounts in name-sorted order. Opnum: 40
SamrGetDisplayEnumerationIndex	Obtains an index into an account-name–sorted list of accounts. Opnum: 41
Opnum42NotUsedOnWire	Reserved for local use. Opnum: 42
Opnum43NotUsedOnWire	Reserved for local use. Opnum: 43
SamrGetUserDomainPasswordInformation	Obtains select password policy information. Opnum: 44
SamrRemoveMemberFromForeignDomain	Removes a member from all aliases. Opnum: 45
SamrQueryInformationDomain2	Obtains attributes from a domain object. Opnum: 46
SamrQueryInformationUser2	Obtains attributes from a user object. Opnum: 47
SamrQueryDisplayInformation2	Obtains a list of accounts in name-sorted order. Opnum: 48
SamrGetDisplayEnumerationIndex2	Obtains an index into an account-name–sorted list of accounts. Opnum: 49
SamrCreateUser2InDomain	Creates a user. Opnum: 50
SamrQueryDisplayInformation3	Obtains a list of accounts in name-sorted order. Opnum: 51
SamrAddMultipleMembersToAlias	Adds multiple members to an alias. Opnum: 52
SamrRemoveMultipleMembersFromAlias	Removes multiple members from an alias. Opnum: 53
SamrOemChangePasswordUser2	Changes a user's password. Opnum: 54
SamrUnicodeChangePasswordUser2	Changes a user account's password. Opnum: 55
SamrGetDomainPasswordInformation	Obtains select password policy information. Opnum: 56
SamrConnect2	Obtains a handle to a server object (3). Opnum: 57
SamrSetInformationUser2	Updates attributes on a user object. Opnum: 58
Opnum59NotUsedOnWire	Reserved for local use. Opnum: 59
Opnum60NotUsedOnWire	Reserved for local use. Opnum: 60
Opnum61NotUsedOnWire	Reserved for local use. Opnum: 61
SamrConnect4	Obtains a handle to a server object. Opnum: 62
Opnum63NotUsedOnWire	Reserved for local use. Opnum: 63
SamrConnect5	Obtains a handle to a server object. Opnum: 64
SamrRidToSid	Obtains the SID of an account. Opnum: 65
SamrSetDSRMPassword	Sets a local recovery password. Opnum: 66
SamrValidatePassword	Validates an application password against the locally stored policy. Opnum: 67
Opnum68NotUsedOnWire	Reserved for local use. Opnum: 68
Opnum69NotUsedOnWire	Reserved for local use. Opnum: 69
Opnum70NotUsedOnWire	Reserved for local use. Opnum 70
Opnum71NotUsedOnWire	Reserved for local use. Opnum 71
Opnum72NotUsedOnWire	Reserved for local use. Opnum 72
SamrUnicodeChangePasswordUser4	Changes a user account password. Opnum 73
SamrValidateComputerAccountReuseAttempt	Validates whether clients can re-use a computer account. Opnum 74
Opnum75NotUsedOnWire	Reserved for local use. Opnum 75
Opnum76NotUsedOnWire	Reserved for local use. Opnum 76
SamrAccountIsDelegatedManagedServiceAccount	Verifies whether a specified account is a Delegated Managed Service Account and whether the calling context is authorized to retrieve the managed password of the account. Opnum 77

In the preceding table, the phrase "Reserved for local use" means that the client MUST NOT send the opnum, and the server behavior is undefined<43> because it does not affect interoperability.

All methods MUST NOT throw exceptions.

The SAM Remote Protocol (Client-to-Server) recognizes five types of handles: Server, Domain, Group, Alias, and User. A handle of each type can be obtained only by calling one of a well-defined set of methods. These handles are listed in the following table.

Handle type	Methods that return this type of handle
Server	SamrConnect SamrConnect2 SamrConnect4 SamrConnect5
Domain	SamrOpenDomain
Group	SamrOpenGroup
Alias	SamrOpenAlias
User	SamrOpenUser

For example, to obtain any context handle to the server, one of the following methods MUST be called: SamrConnect, SamrConnect2, SamrConnect4, or SamrConnect5. With the ServerHandle parameter returned from these methods, it is possible to obtain other context handles and call any associated methods on the handle. See section 4.1 for an example.

The server MUST keep track of all handles of each type that every caller opens, from the moment of creation until the handle has been closed (by calling SamrCloseHandle, SamrDeleteGroup, SamrDeleteAlias, or SamrDeleteUser) or until the client disconnects. The object referenced by a handle can be edited, queried, deleted, or closed for as long as the handle is open, but not before or after this state.

The RPC protocol provides a mechanism to clean up any resources related to a context handle if a client that is holding the context handle exits, dies, disconnects, or reboots. An implementation of this protocol SHOULD use this functionality, as specified in [C706] section 5.1.6, Context Handle Rundown.

Note Except for the methods listed in the preceding table, all other methods listed in this section can be called in any sequence to perform operations on the referenced object as long as its handle is open.

Note The following methods do not require a context handle and can be called directly; they also do not return any context handle:

• SamrGetDomainPasswordInformation

• SamrSetDSRMPassword

• SamrValidatePassword

• SamrOemChangePasswordUser2

• SamrUnicodeChangePasswordUser2

• SamrUnicodeChangePasswordUser4

Note A user account MUST be enabled by clearing the UF_ACCOUNTDISABLE bit from the userAccountControl attribute before that account will be able to authenticate, as specified in [MS-KILE] section 3.3.5.7.1.