126.96.36.199.3 LsarOpenAccount (Opnum 17)
The LsarOpenAccount method is invoked to obtain a handle to an account object.
NTSTATUS LsarOpenAccount( [in] LSAPR_HANDLE PolicyHandle, [in] PRPC_SID AccountSid, [in] ACCESS_MASK DesiredAccess, [out] LSAPR_HANDLE* AccountHandle );
AccountSid: A SID of the account to be opened.
DesiredAccess: A bitmask specifying accesses to be granted to the opened account at this time.
AccountHandle: Used to return a handle to the opened account object.
Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows.
The request was successfully completed.
The caller does not have the permissions to perform this operation.
Some of the parameters supplied are incorrect. For instance, this can happen when AccountSid is NULL.
An account with this SID does not exist in the server's database.
PolicyHandle is not a valid handle.
This message takes four arguments:
PolicyHandle: An open handle to the policy object. If the handle is not a valid context handle to the policy object or PolicyHandle.HandleType does not equal "Policy", the server MUST return STATUS_INVALID_HANDLE. PolicyHandle.GrantedAccess MUST NOT be considered for this call, because the access check MUST happen on the account object.
AccountSid: The SID of the account to be opened. The server MUST verify that the SID is valid and fail the request with STATUS_INVALID_PARAMETER otherwise. The server MUST verify that the account object with this SID exists in its policy database and fail the request with STATUS_OBJECT_NAME_NOT_FOUND otherwise.
DesiredAccess: A bitmask specifying the type of access the caller attempts to obtain from the account object, which is access-checked according to section 188.8.131.52.1. The method-specific portion of the check is the following.
IF (IsRequestorAnonymous() and LsaRestrictAnonymous is set to TRUE) THEN Return STATUS_OBJECT_NAME_NOT_FOUND END IF
AccountHandle: If the request is successful, this parameter is used to return a handle (section 184.108.40.206) to the opened account object with its fields initialized as follows:
LsaContextHandle.HandleType = "Account"
LsaContextHandle.Object = the account object
LsaContextHandle.GrantedAccess = as specified in section 220.127.116.11.1