LsarGetSystemAccessAccount (Opnum 23)

The LsarGetSystemAccessAccount method is invoked to retrieve system access account flags for an account object. System access account flags are described as part of the account object data model, as specified in section

 NTSTATUS LsarGetSystemAccessAccount(
   [in] LSAPR_HANDLE AccountHandle,
   [out] unsigned long* SystemAccess

AccountHandle: An open account object handle obtained from either LsarCreateAccount (section or LsarOpenAccount (section

SystemAccess: Used to return a bitmask of access flags associated with the account.

Return Values: The following is a summary of the return values that an implementation MUST return, as specified by the message processing that follows.

Return value/code




The request was successfully completed.



The caller does not have the permissions to perform this operation.



AccountHandle is not a valid handle.


This message takes two arguments:

AccountHandle: An open handle to an account object. If the handle is not a valid context handle to an account object or AccountHandle.HandleType does not equal "Account", the server MUST return STATUS_INVALID_HANDLE. The server MUST verify that AccountHandle grants access as specified in section with RequiredAccess set to ACCOUNT_VIEW.

SystemAccess: Used to return a bitmask of system access bits.