ZwDuplicateToken function
The ZwDuplicateToken function creates a handle to a new access token that duplicates an existing token. This function can create either a primary token or an impersonation token.
Syntax
NTSTATUS ZwDuplicateToken(
_In_ HANDLE ExistingTokenHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ BOOLEAN EffectiveOnly,
_In_ TOKEN_TYPE TokenType,
_Out_ PHANDLE NewTokenHandle
);
Parameters
ExistingTokenHandle [in]
A handle to an existing access token that was opened with the TOKEN_DUPLICATE access right. This parameter is required and cannot be NULL.DesiredAccess [in]
Bitmask that specifies the requested access rights for the new token. ZwDuplicateToken compares the requested access rights with the existing token's discretionary access control list (DACL) to determine which rights are granted or denied to the new token. To request the same access rights as the existing token, specify zero. To request all access rights that are valid for the caller, specify MAXIMUM_ALLOWED. This parameter is optional and can either be zero, MAXIMUM_ALLOWED, or a bitwise OR combination of one or more of the following values:Value Meaning DELETE
Required to delete the object.
READ_CONTROL
Required to read the DACL and ownership information for the object. For access to the system access control list (SACL), see ACCESS_SYSTEM_SECURITY later in this table.
WRITE_DAC
Required to change the DACL information for the object.
WRITE_OWNER
Required to change the ownership information in the object's security descriptor (SECURITY_DESCRIPTOR).
ACCESS_SYSTEM_SECURITY
Required to get or set the SACL in an object's ACL. The operating system grants this right to the new token only if the SE_SECURITY_NAME privilege is enabled in the access token of the calling thread.
STANDARD_RIGHTS_READ
Currently defined to equal READ_CONTROL.
STANDARD_RIGHTS_WRITE
Currently defined to equal READ_CONTROL.
STANDARD_RIGHTS_EXECUTE
Currently defined to equal READ_CONTROL.
STANDARD_RIGHTS_REQUIRED
Combines DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER access.
STANDARD_RIGHTS_ALL
Combines DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, and SYNCHRONIZE access. However, the SYNCHRONIZE value is not applicable to token objects. Thus, STANDARD_RIGHTS_ALL has a functionally equivalent to STANDARD_RIGHTS_REQUIRED.
TOKEN_ADJUST_DEFAULT
Required to change the default owner, primary group, or DACL of an access token.
TOKEN_ADJUST_GROUPS
Required to adjust the attributes of the groups in an access token.
TOKEN_ADJUST_PRIVILEGES
Required to enable or disable the privileges in an access token.
TOKEN_ADJUST_SESSIONID
Required to adjust the session ID (SID) of an access token. The operating system grants this right to the new token only if the SE_TCB_NAME privilege is enabled in the access token of the calling thread.
TOKEN_ASSIGN_PRIMARY
Required to attach a primary token to a process. The operating system grants this right to the new token only if the SE_ASSIGNPRIMARYTOKEN_NAME privilege is enabled in the access token of the calling thread.
TOKEN_DUPLICATE
Required to duplicate an access token. Note that the given ExistingTokenHandle token must contain this right in order to successfully use this routine.
TOKEN_EXECUTE
Combines STANDARD_RIGHTS_EXECUTE and TOKEN_IMPERSONATE.
TOKEN_IMPERSONATE
Required to attach an impersonation access token to a process.
TOKEN_QUERY
Required to query an access token.
TOKEN_QUERY_SOURCE
Required to query the source of an access token.
TOKEN_READ
Combines STANDARD_RIGHTS_READ and TOKEN_QUERY.
TOKEN_WRITE
Combines STANDARD_RIGHTS_WRITE, TOKEN_ADJUST_PRIVILEGES, TOKEN_ADJUST_GROUPS, and TOKEN_ADJUST_DEFAULT.
TOKEN_ALL_ACCESS
Combines all possible token access permissions for a token.
For additional information, see Access Rights for Access-Token Objects in the Microsoft Windows SDK. Note that access tokens do not support the SYNCHRONIZE right.
ObjectAttributes [in]
Pointer to an OBJECT_ATTRIBUTES structure that describes the requested properties for the new token. The ObjectAttributes parameter is optional and can be NULL. If the ObjectAttributes parameter is NULL or if the SecurityDescriptor member of the structure pointed to by the ObjectAttributes parameter is NULL, the new token receives a default security descriptor and the new token handle cannot be inherited. In that case, this default security descriptor is created from the user group, primary group, and DACL information that is stored in the caller's token.When the TokenType parameter is set to TokenImpersonation:
The ObjectAttributes parameter may be used to specify the impersonation level of the new token. This can be accomplished by setting ObjectAttributes->SecurityQualityOfService.ImpersonationLevel to an appropriate SECURITY_IMPERSONATION_LEVEL enumeration value. For more information, see SECURITY_QUALITY_OF_SERVICE in the Microsoft Windows SDK documentation.
If the existing token is an impersonation token and the ObjectAttributes parameter provides no impersonation information, the new token's impersonation level is set to the existing token's impersonation level.
If the existing token is a primary token and no impersonation level information is provided, the new impersonation token will have a SECURITY_IMPERSONATION_LEVEL impersonation level.
EffectiveOnly [in]
A Boolean value that indicates whether the entire existing token should be duplicated into the new token or just the effective (currently enabled) part of the token. If set to TRUE, only the currently enabled parts of the source token will be duplicated. If set to FALSE, the entire existing token will be duplicated. This provides a means for a caller of a protected subsystem to limit which optional groups and privileges are made available to the protected subsystem. For example, if EffectiveOnly is TRUE, the caller could duplicate a token but remove the Administrators group and the SeTcbPrivilege right. The resulting token could then be passed to a child process (CreateProcessAsUser), which would restrict what the child process can do. This parameter is required.TokenType [in]
Specifies one of the following values from the TOKEN_TYPE enumeration.Value Meaning TokenPrimary
The new token is a primary token. If the existing token is an impersonation token, the existing impersonation token must have an impersonation level (as provided by the ObjectAttributes parameter) of SecurityImpersonation or SecurityDelegation. Otherwise, ZwDuplicateToken returns STATUS_BAD_IMPERSONATION_LEVEL is returned.
TokenImpersonation
The new token is an impersonation token. If the existing token is an impersonation token, the requested impersonation level (as provided by the ObjectAttributes parameter) of the new token must not be greater than the impersonation level of the existing token. Otherwise, ZwDuplicateToken returns STATUS_BAD_IMPERSONATION_LEVEL.
The TokenType parameter is required and cannot be NULL.
NewTokenHandle [out]
A pointer to a caller-allocated variable, of type HANDLE, that receives a handle to the new token. This parameter is required and cannot be NULL.
Return value
ZwDuplicateToken returns STATUS_SUCCESS if the call is successfull. Possible error return codes include the following:
| Return code | Description |
|---|---|
| STATUS_ACCESS_VIOLATION | A memory access violation occurred. For example, if the previous mode was user-mode and invalid user-mode memory was provided, ZwDuplicateToken returns STATUS_ACCESS_VIOLATION. |
| STATUS_INSUFFICIENT_RESOURCES | Sufficient memory could not be allocated to duplicate the new token. |
| STATUS_INVALID_PARAMETER | An invalid parameter was detected. |
| STATUS_BAD_IMPERSONATION_LEVEL | The requested impersonation level for the new token is greater than the impersonation level of the existing token. |
| STATUS_ACCESS_DENIED | ZwDuplicateToken returns STATUS_ACCESS_DENIED if it couldn't access ExistingTokenHandle. This would occur if the existing token does not have the TOKEN_DUPLICATE access right. |
| STATUS_INVALID_HANDLE | ZwDuplicateToken returns STATUS_INVALID_HANDLE if ExistingTokenHandle refers to an invalid handle. |
Remarks
If no impersonation level information was provided by the ObjectAttributes parameter, the existing token's impersonation level will be used for the new token.
With regard to the structure pointed to by the optional ObjectAttributes parameter, the SecurityQualityOfService member of OBJECT_ATTRIBUTES points to a structure of type SECURITY_QUALITY_OF_SERVICE. See SECURITY_QUALITY_OF_SERVICE in the Microsoft Windows SDK documentation for information on the members of this structure.
Note The SecurityQualityOfService member must be set after calling the InitializeObjectAttributes macro because InitializeObjectAttributes currently sets SecurityQualityOfService to NULL.
For information on the user-mode analog of ZwDuplicateToken, see DuplicateTokenEx in the Windows SDK documentation.
When you have finished using the new token, call the ZwClose function to close the token handle.
Note If the call to the ZwDuplicateToken function occurs in user mode, you should use the name "NtDuplicateToken" instead of "ZwDuplicateToken".
For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.
Requirements
Target platform |
Universal |
Version |
Available starting with Windows 2000. |
Header |
Ntifs.h (include Ntifs.h or FltKernel.h) |
Library |
NtosKrnl.lib |
DLL |
NtosKrnl.exe |
IRQL |
PASSIVE_LEVEL |
DDI compliance rules |
PowerIrpDDis, HwStorPortProhibitedDDIs |
See also