LsarOpenAccount (Opnum 17)

The LsarOpenAccount method is invoked to obtain a handle to an account object.

 NTSTATUS LsarOpenAccount(
   [in] LSAPR_HANDLE PolicyHandle,
   [in] PRPC_SID AccountSid,
   [in] ACCESS_MASK DesiredAccess,
   [out] LSAPR_HANDLE* AccountHandle

PolicyHandle: An RPC context handle obtained from either LsarOpenPolicy or LsarOpenPolicy2.

AccountSid: A SID of the account to be opened.

DesiredAccess: A bitmask specifying accesses to be granted to the opened account at this time.

AccountHandle: Used to return a handle to the opened account object.

Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows.

Return value/code




The request was successfully completed.



The caller does not have the permissions to perform this operation.



Some of the parameters supplied are incorrect.  For instance, this can happen when AccountSid is NULL.



An account with this SID does not exist in the server's database.



PolicyHandle is not a valid handle.


This message takes four arguments:

PolicyHandle: An open handle to the policy object. If the handle is not a valid context handle to the policy object or PolicyHandle.HandleType does not equal "Policy", the server MUST return STATUS_INVALID_HANDLE. PolicyHandle.GrantedAccess MUST NOT be considered for this call, because the access check MUST happen on the account object.

AccountSid: The SID of the account to be opened. The server MUST verify that the SID is valid and fail the request with STATUS_INVALID_PARAMETER otherwise. The server MUST verify that the account object with this SID exists in its policy database and fail the request with STATUS_OBJECT_NAME_NOT_FOUND otherwise.

DesiredAccess: A bitmask specifying the type of access the caller attempts to obtain from the account object, which is access-checked according to section The method-specific portion of the check is the following.

 IF (IsRequestorAnonymous() and LsaRestrictAnonymous is set to TRUE) THEN

The valid account rights bits are specified in section, and the security descriptor is specified in section The IsRequestorAnonymous procedure is specified in section

AccountHandle: If the request is successful, this parameter is used to return a handle (section to the opened account object with its fields initialized as follows:

  • LsaContextHandle.HandleType = "Account"

  • LsaContextHandle.Object = the account object

  • LsaContextHandle.GrantedAccess = as specified in section