设置备份和还原权限
若要成功调用证书服务备份和还原 API,调用方令牌必须包含备份和还原 权限。 可以通过编程方式设置这些权限,以下示例可用于设置或删除这些特权。 所有备份和还原应用程序都需要备份和还原权限,而不仅仅是证书服务备份和还原。 有关修改权限的安全影响的信息,请参阅 使用特殊特权运行。
// The following example can be used to enable or disable the
// backup privilege. By making the indicated substitutions, you can
// also use this example to enable or disable the restore privilege
// Use the following statement to enable the privilege:
// hr = ModifyPrivilege(SE_BACKUP_NAME, TRUE);
// Use the following statement to disable the privilege:
// hr = ModifyPrivilege(SE_BACKUP_NAME, FALSE);
// Use SE_RESTORE_NAME for the restore privilege.
// The main function in this example enables the backup privilege.
#pragma comment(lib, "crypt32.lib")
#include <windows.h>
#include <stdio.h>
HRESULT ModifyPrivilege(
IN LPCTSTR szPrivilege,
IN BOOL fEnable)
{
HRESULT hr = S_OK;
TOKEN_PRIVILEGES NewState;
LUID luid;
HANDLE hToken = NULL;
// Open the process token for this process.
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
&hToken ))
{
printf("Failed OpenProcessToken\n");
return ERROR_FUNCTION_FAILED;
}
// Get the local unique ID for the privilege.
if ( !LookupPrivilegeValue( NULL,
szPrivilege,
&luid ))
{
CloseHandle( hToken );
printf("Failed LookupPrivilegeValue\n");
return ERROR_FUNCTION_FAILED;
}
// Assign values to the TOKEN_PRIVILEGE structure.
NewState.PrivilegeCount = 1;
NewState.Privileges[0].Luid = luid;
NewState.Privileges[0].Attributes =
(fEnable ? SE_PRIVILEGE_ENABLED : 0);
// Adjust the token privilege.
if (!AdjustTokenPrivileges(hToken,
FALSE,
&NewState,
0,
NULL,
NULL))
{
printf("Failed AdjustTokenPrivileges\n");
hr = ERROR_FUNCTION_FAILED;
}
// Close the handle.
CloseHandle(hToken);
return hr;
}
void main(void)
{
HRESULT hr;
hr = ModifyPrivilege(SE_BACKUP_NAME, TRUE);
if (!SUCCEEDED(hr))
printf("\nFailed to modify privilege.\n");
else
printf("\nSuccessfully modified privilege.\n");
}