Security Management Functions

This section contains topics for the following groups of functions:

• Attachment Callback Functions
• Attachment Engine Functions
• LSA Policy Functions
  • Policy Functions
  • Account Functions
  • Trusted Domain Functions
  • Private Data Functions
  • Miscellaneous Functions
• Managed Service Account Functions
• Password Filter Functions
• Safer Functions

Attachment Callback Functions

The following support functions are provided by the Security Configuration tool set and may be used by attachment engines and extension snap-ins to read and write configuration data.

Callback function	Description
PFSCE_FREE_INFO	Used to free memory allocated by these support functions.
PFSCE_LOG_INFO	Used to log message to the configuration log file or analysis log file.
PFSCE_QUERY_INFO	Used to query the configuration and analysis information for a specific service.
PFSCE_SET_INFO	Used to set configuration and analysis information for a specific service.

Attachment Engine Functions

Function	Description
SceSvcAttachmentAnalyze	Implemented by the attachment engine DLL. The Security Configuration Engine calls this function when the system is analyzed.
SceSvcAttachmentConfig	Implemented by the attachment engine DLL. The Security Configuration Engine calls this function when the system is configured.
SceSvcAttachmentUpdate	Implemented by the attachment engine DLL. The Security Configuration Engine calls this function when it receives a configuration update request from the attachment snap-in extension.

LSA Policy Functions

The following topics provide reference information for the Local Security Authority (LSA) Policy functions.

Topic	Description
Policy Functions	Details functions used to open the local Policy object and to set or retrieve global policy information.
Account Functions	Details functions used to manage account permissions and to create and delete user accounts.
Trusted Domain Functions	Details functions used to create and delete trusted domain relationships and to set and retrieve information about those trusted domains.
Private Data Functions	Do not use the LSA private data functions. Instead, use the CryptProtectData and CryptUnprotectData functions.
Miscellaneous Functions	Details functions not described elsewhere.

Policy Functions

The following functions enumerate user accounts and trusted domains, receive policy change notifications, and lookup account names and SIDs.

Function	Description
LsaEnumerateAccountsWithUserRight	Enumerates all the accounts that have a specified user permission.
LsaEnumerateTrustedDomainsEx	Enumerates the trusted domains.
LsaLookupNames	Maps the specified names to their SIDs. Returns the SID as an RID/Domain SID pair.
LsaLookupNames2	Maps the specified names to their SIDs. Returns the SID as a single element.
LsaLookupPrivilegeValue	Retrieves the locally unique identifier (LUID) used by the Local Security Authority (LSA) to represent the specified privilege name.
LsaLookupSids	Maps the specified account names to their SIDs.
LsaRegisterPolicyChangeNotification	Registers an event object to receive notifications when the local policy information changes.
LsaUnregisterPolicyChangeNotification	Unregisters an event object that is receiving policy change notifications.

Account Functions

The following functions add, enumerate, and delete permissions for an account.

Function	Description
LsaAddAccountRights	Add permissions to an account. If the account does not already exist, it is created.
LsaEnumerateAccountRights	Enumerate the permissions granted to an account.
LsaRemoveAccountRights	Remove permissions from an account. When all the permissions are removed, the account is deleted.

Trusted Domain Functions

The following functions create, enumerate, and delete trusted domains and set and retrieve trusted domain information.

Function	Description
LsaCreateTrustedDomainEx	Creates a new TrustedDomain object.
LsaDeleteTrustedDomain	Removes a TrustedDomain object.
LsaEnumerateTrustedDomains LsaEnumerateTrustedDomainsEx	Enumerates the domains currently trusted by the local system.
LsaOpenTrustedDomainByName	Opens a handle to a TrustedDomain object.
LsaQueryTrustedDomainInfo	Retrieves information about a trusted domain. The domain is specified by SID.
LsaQueryTrustedDomainInfoByName	Retrieves information about a trusted domain. The domain is specified by name.
LsaSetTrustedDomainInfoByName	Sets information for a trusted domain. The domain is specified by name.
LsaSetTrustedDomainInformation	Sets information for a trusted domain. The domain is specified by SID.

Private Data Functions

Do not use the LSA private data functions. Instead, use the CryptProtectData and CryptUnprotectData functions.

Function	Description
LsaRetrievePrivateData	Retrieves and decrypts a string.
LsaStorePrivateData	Encrypts and stores a string.

Miscellaneous Functions

The LSA Policy API has the following three functions that do not fit into any of the other LSA Policy function categories.

Function	Description
LsaClose	Closes a handle to a Policy object or a TrustedDomain object.
LsaFreeMemory	Frees a buffer allocated by an LSA function.
LsaNtStatusToWinError	Converts an NTSTATUS value to a Windows error code.

Managed Service Account Functions

The following functions are used to create, enumerate, find, and delete managed service accounts.

Function	Description
NetAddServiceAccount	Creates a managed service account.
NetEnumerateServiceAccounts	Enumerates the server accounts on the specified server.
NetIsServiceAccount	Tests whether the specified service account exists in the Netlogon store on the specified server.
NetRemoveServiceAccount	Deletes the specified service account from the Active Directory database.

Password Filter Functions

The following password filter functions are implemented by custom password filter DLLs to provide password filtering and password change notification.

Function	Description
InitializeChangeNotify	Indicates that a password filter DLL is initialized.
PasswordChangeNotify	Indicates that a password has been changed.
PasswordFilter	Validates a new password based on password policy.

Safer Functions

The following Safer functions can be used to check the safer level of any executable and to log events.

Function	Description
SaferCloseLevel	Closes a SAFER_LEVEL_HANDLE opened by using the SaferIdentifyLevel function or the SaferCreateLevel function.
SaferComputeTokenFromLevel	Restricts a token using restrictions specified by a SAFER_LEVEL_HANDLE.
SaferCreateLevel	Opens a SAFER_LEVEL_HANDLE.
SaferGetLevelInformation	Retrieves information about a policy level.
SaferGetPolicyInformation	Retrieves information about a policy.
SaferIdentifyLevel	Retrieves information about a level.
SaferiIsExecutableFileType	Determines whether a specified file is an executable file.
SaferRecordEventLogEntry	Sends a message to the event log.
SaferSetLevelInformation	Sets the information about a policy level.
SaferSetPolicyInformation	Sets the global policy controls.