windows-server-2003/base/ntos/se/cttoken.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    cttoken.c

Abstract:

    Common token object test routines.

    These routines are used in both kernel and user mode tests.

    This test assumes the security runtime library routines are
    functioning correctly.

    NOTE:  This test program allocates a lot of memory and frees
           none of it ! ! !



Author:

    Jim Kelly       (JimK)     27-June-1990

Environment:

    Test of token object.

Revision History:

--*/

#include "tsecomm.c"    // Mode dependent macros and routines.



////////////////////////////////////////////////////////////////
//                                                            //
// Module wide variables                                      //
//                                                            //
////////////////////////////////////////////////////////////////

#define DEFAULT_DACL_LENGTH (1024L)
#define GROUP_IDS_LENGTH (1024L)
#define NEW_GROUP_STATE_LENGTH (1024L)
#define PRIVILEGES_LENGTH (128L)
#define TOO_BIG_ACL_SIZE (2048L)
#define TOO_BIG_PRIMARY_GROUP_SIZE (39L)

//
// definitions related to TokenWithGroups
// (we also substitute SYSTEM for NEANDERTHOL in some tests)
//

#define FLINTSTONE_INDEX  (0L)
#define CHILD_INDEX       (1L)
#define NEANDERTHOL_INDEX (2L)
#define SYSTEM_INDEX      (2L)
#define WORLD_INDEX       (3L)
#define GROUP_COUNT       (4L)
#define RESTRICTED_SID_COUNT (2L)


//
// Definitions related to TokenWithPrivileges
//

#define UNSOLICITED_INDEX           (0L)
#define SECURITY_INDEX              (1L)
#define ASSIGN_PRIMARY_INDEX        (2L)
#define PRIVILEGE_COUNT             (3L)


    NTSTATUS Status;

    HANDLE SimpleToken;
    HANDLE TokenWithGroups;
    HANDLE TokenWithDefaultOwner;
    HANDLE TokenWithPrivileges;
    HANDLE TokenWithDefaultDacl;

    HANDLE TokenWithRestrictedGroups;
    HANDLE TokenWithRestrictedPrivileges;
    HANDLE TokenWithRestrictedSids;
    HANDLE TokenWithMoreRestrictedSids;


    HANDLE Token;
    HANDLE ProcessToken;
    HANDLE ImpersonationToken;
    HANDLE AnonymousToken;

    OBJECT_ATTRIBUTES PrimaryTokenAttributes;
    PSECURITY_DESCRIPTOR PrimarySecurityDescriptor;
    SECURITY_QUALITY_OF_SERVICE PrimarySecurityQos;

    OBJECT_ATTRIBUTES ImpersonationTokenAttributes;
    PSECURITY_DESCRIPTOR ImpersonationSecurityDescriptor;
    SECURITY_QUALITY_OF_SERVICE ImpersonationSecurityQos;

    OBJECT_ATTRIBUTES AnonymousTokenAttributes;
    PSECURITY_DESCRIPTOR AnonymousSecurityDescriptor;
    SECURITY_QUALITY_OF_SERVICE AnonymousSecurityQos;

    ULONG DisabledGroupAttributes;
    ULONG OptionalGroupAttributes;
    ULONG NormalGroupAttributes;
    ULONG OwnerGroupAttributes;

    ULONG LengthAvailable;
    ULONG CurrentLength;


    TIME_FIELDS TempTimeFields = {3000, 1, 1, 1, 1, 1, 1, 1};
    LARGE_INTEGER NoExpiration;

    LUID BadAuthenticationId;
    LUID SystemAuthenticationId = SYSTEM_LUID;
    LUID OriginalAuthenticationId;

    TOKEN_SOURCE TestSource = {"SE: TEST", 0};

    PSID Owner;
    PSID Group;
    PACL Dacl;

    PSID TempOwner;
    PSID TempGroup;
    PACL TempDacl;

    UQUAD ThreadStack[256];
    INITIAL_TEB InitialTeb;
    NTSTATUS Status;
    CLIENT_ID ThreadClientId;
    CONTEXT ThreadContext;
    HANDLE ThreadHandle;
    OBJECT_ATTRIBUTES ThreadObja;






////////////////////////////////////////////////////////////////
//                                                            //
// Private Macros                                             //
//                                                            //
////////////////////////////////////////////////////////////////


#define TestpPrintLuid(G)                                                     \
            DbgPrint( "(0x%x, 0x%x)", \
                         (G).HighPart, (G).LowPart);                         \




////////////////////////////////////////////////////////////////
//                                                            //
// Initialization Routine                                     //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenInitialize()
{

    NTSTATUS Status;
    ULONG ReturnLength;
    HANDLE ProcessToken;
    TOKEN_STATISTICS ProcessTokenStatistics;
    PTOKEN_PRIVILEGES NewState;


    if (!TSeVariableInitialization()) {
        DbgPrint("Se:    Failed to initialize global test variables.\n");
        return FALSE;
    }


    DisabledGroupAttributes =  (SE_GROUP_ENABLED_BY_DEFAULT);

    OptionalGroupAttributes =  (SE_GROUP_ENABLED_BY_DEFAULT |
                                SE_GROUP_ENABLED
                                );
    NormalGroupAttributes =    (SE_GROUP_MANDATORY          |
                                SE_GROUP_ENABLED_BY_DEFAULT |
                                SE_GROUP_ENABLED
                                );
    OwnerGroupAttributes  =    (SE_GROUP_MANDATORY          |
                                SE_GROUP_ENABLED_BY_DEFAULT |
                                SE_GROUP_ENABLED            |
                                SE_GROUP_OWNER
                                );


    PrimarySecurityDescriptor =
        (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );

    Status = RtlCreateSecurityDescriptor (
                 PrimarySecurityDescriptor,
                 SECURITY_DESCRIPTOR_REVISION1
                 ); ASSERT(NT_SUCCESS(Status));
    Status = RtlSetDaclSecurityDescriptor (
                 PrimarySecurityDescriptor,
                 TRUE,                  //DaclPresent,
                 NULL,                  //Dacl OPTIONAL,  // No protection
                 FALSE                  //DaclDefaulted OPTIONAL
                 ); ASSERT(NT_SUCCESS(Status));


    InitializeObjectAttributes(
        &PrimaryTokenAttributes,
        NULL,
        OBJ_INHERIT,
        NULL,
        PrimarySecurityDescriptor
        );


    ImpersonationSecurityDescriptor =
        (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );

    ImpersonationSecurityQos.Length = (ULONG)sizeof(SECURITY_QUALITY_OF_SERVICE);
    ImpersonationSecurityQos.ImpersonationLevel = SecurityImpersonation;
    ImpersonationSecurityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    ImpersonationSecurityQos.EffectiveOnly = FALSE;

    InitializeObjectAttributes(
        &ImpersonationTokenAttributes,
        NULL,
        OBJ_INHERIT,
        NULL,
        NULL
        );
    ImpersonationTokenAttributes.SecurityQualityOfService =
        &ImpersonationSecurityQos;


    AnonymousSecurityDescriptor =
        (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );

    AnonymousSecurityQos.Length = (ULONG)sizeof(SECURITY_QUALITY_OF_SERVICE);
    AnonymousSecurityQos.ImpersonationLevel = SecurityAnonymous;
    AnonymousSecurityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    AnonymousSecurityQos.EffectiveOnly = FALSE;

    InitializeObjectAttributes(
        &AnonymousTokenAttributes,
        NULL,
        OBJ_INHERIT,
        NULL,
        NULL
        );
    AnonymousTokenAttributes.SecurityQualityOfService =
        &AnonymousSecurityQos;


    //
    // Build an ACL for use.
    //

    Dacl        = (PACL)TstAllocatePool( PagedPool, 256 );

    Dacl->AclRevision=ACL_REVISION;
    Dacl->Sbz1=0;
    Dacl->Sbz2=0;
    Dacl->AclSize=256;
    Dacl->AceCount=0;


    //
    // Set up expiration times
    //

    TempTimeFields.Year = 3000;
    TempTimeFields.Month = 1;
    TempTimeFields.Day = 1;
    TempTimeFields.Hour = 1;
    TempTimeFields.Minute = 1;
    TempTimeFields.Second = 1;
    TempTimeFields.Milliseconds = 1;
    TempTimeFields.Weekday = 1;

    RtlTimeFieldsToTime( &TempTimeFields, &NoExpiration );

    //
    // Set up a bad authentication ID
    //

    BadAuthenticationId = RtlConvertLongToLuid(1);


    //
    // Use a token source specific to security test
    //

    NtAllocateLocallyUniqueId( &(TestSource.SourceIdentifier) );

    //
    // Create a new thread for impersonation tests
    //


    //
    // Initialize object attributes.
    // Note that the name of the thread is NULL so that we
    // can run multiple copies of the test at the same time
    // without collisions.
    //

    InitializeObjectAttributes(&ThreadObja, NULL, 0, NULL, NULL);

    //
    // Initialize thread context and initial TEB.
    //

    RtlInitializeContext(NtCurrentProcess(),
                         &ThreadContext,
                         NULL,
                         (PVOID)TestTokenInitialize,
                         &ThreadStack[254]);

    InitialTeb.StackBase = &ThreadStack[254];
    InitialTeb.StackLimit = &ThreadStack[0];

    //
    // Create a thread in a suspended state.
    //

    Status = NtCreateThread(&ThreadHandle,
                            THREAD_ALL_ACCESS,
                            &ThreadObja,
                            NtCurrentProcess(),
                            &ThreadClientId,
                            &ThreadContext,
                            &InitialTeb,
                            TRUE);

    ASSERT(NT_SUCCESS(Status));



    //
    // The following is sortof a horse-before-the-cart type of initialization.
    // Now that the system is enforcing things like "you can only create a
    // token with an AuthenticationId that the reference monitor has been told
    // about, it is necessary to obtain some information out of our current
    // token.
    //

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 TOKEN_ALL_ACCESS,
                 &ProcessToken
                 );
    ASSERT( NT_SUCCESS(Status) );
    Status = NtQueryInformationToken(
                 ProcessToken,                 // Handle
                 TokenStatistics,              // TokenInformationClass
                 &ProcessTokenStatistics,      // TokenInformation
                 sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                 &ReturnLength                 // ReturnLength
                 );
    ASSERT(NT_SUCCESS(Status));
    OriginalAuthenticationId = ProcessTokenStatistics.AuthenticationId;


    DbgPrint("Se: enabling AssignPrimary & TCB privileges...\n");

    NewState = (PTOKEN_PRIVILEGES) TstAllocatePool(
                                    PagedPool,
                                    200
                                    );

    NewState->PrivilegeCount = 2;
    NewState->Privileges[0].Luid = CreateTokenPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    NewState->Privileges[1].Luid = AssignPrimaryTokenPrivilege;
    NewState->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;


    Status = NtAdjustPrivilegesToken(
                 ProcessToken,                     // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    if (Status != STATUS_SUCCESS) {

        DbgPrint("Failed to enable TCB and AssignPrimaryToken privilegs: 0x%x\n",Status);
        return FALSE;

    }

    DbgPrint("Done.\n");

    return TRUE;
}



////////////////////////////////////////////////////////////////
//                                                            //
// Test routines                                              //
//                                                            //
////////////////////////////////////////////////////////////////

////////////////////////////////////////////////////////////////
//                                                            //
// Token Creation Test                                        //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenCreate()
{

    BOOLEAN CompletionStatus = TRUE;

    TOKEN_USER UserId;
    TOKEN_PRIMARY_GROUP PrimaryGroup;
    PTOKEN_GROUPS GroupIds;
    PTOKEN_PRIVILEGES Privileges;
    TOKEN_DEFAULT_DACL DefaultDacl;
    TOKEN_DEFAULT_DACL NullDefaultDacl;
    TOKEN_OWNER Owner;

    DbgPrint("\n");

    GroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                               GROUP_IDS_LENGTH
                                               );

    Privileges = (PTOKEN_PRIVILEGES)TstAllocatePool( PagedPool,
                                                     PRIVILEGES_LENGTH
                                                     );

    DefaultDacl.DefaultDacl = (PACL)TstAllocatePool( PagedPool,
                                                     DEFAULT_DACL_LENGTH
                                                     );


    //
    // Create the simplest token possible
    // (no Groups, explicit Owner, or DefaultDacl)
    //

    DbgPrint("Se:     Create Simple Token ...                                ");

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;
    GroupIds->GroupCount = 0;
    Privileges->PrivilegeCount = 0;
    PrimaryGroup.PrimaryGroup = FlintstoneSid;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &SystemAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 NULL,                     // Owner
                 &PrimaryGroup,            // Primary Group
                 NULL,                     // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &SimpleToken,           // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));



    //
    // Create a token with groups
    //

    DbgPrint("Se:     Create Token With Groups ...                           ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[0].Sid  = FlintstoneSid;
    GroupIds->Groups[1].Sid       = ChildSid;
    GroupIds->Groups[2].Sid = NeandertholSid;
    GroupIds->Groups[3].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;


    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Privileges->PrivilegeCount = 0;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &OriginalAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 NULL,                     // Owner
                 &PrimaryGroup,            // Primary Group
                 NULL,                     // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &TokenWithGroups,       // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create a token with default owner
    //

    DbgPrint("Se:     Create Token Default Owner ...                         ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;


    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = 0;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &SystemAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 NULL,                     // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &TokenWithDefaultOwner, // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create a token with default privileges
    //

    DbgPrint("Se:     Create Token privileges ...                            ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;


    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &OriginalAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 NULL,                     // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &TokenWithPrivileges,   // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create a token with default DACL
    //

    DbgPrint("Se:     Create Token With Default Dacl ...                     ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    Status = RtlCreateAcl( DefaultDacl.DefaultDacl, DEFAULT_DACL_LENGTH, ACL_REVISION);

    ASSERT(NT_SUCCESS(Status) );

    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &SystemAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 &DefaultDacl,             // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");

        //
        // Save a copy of this for later use...
        //

        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &TokenWithDefaultDacl,  // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create a token with a null default DACL
    //

    DbgPrint("Se:     Create Token With a Null Default Dacl ...              ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    NullDefaultDacl.DefaultDacl =  NULL;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &OriginalAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 &NullDefaultDacl,         // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create an impersonation token, Impersonation level = Impersonation
    //

    DbgPrint("Se:     Create an impersonation token ...                      ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    Status = RtlCreateAcl( DefaultDacl.DefaultDacl, DEFAULT_DACL_LENGTH, ACL_REVISION);

    ASSERT(NT_SUCCESS(Status) );

    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &ImpersonationTokenAttributes,  // ObjectAttributes
                 TokenImpersonation,       // TokenType
                 &SystemAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 &DefaultDacl,             // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &ImpersonationToken,    // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));




    //
    // Create an impersonation token, Impersonation level = Anonymous
    //

    DbgPrint("Se:     Create an anonymous token ...                          ");

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    Status = RtlCreateAcl( DefaultDacl.DefaultDacl, DEFAULT_DACL_LENGTH, ACL_REVISION);

    ASSERT(NT_SUCCESS(Status) );

    Status = NtCreateToken(
                 &Token,                     // Handle
                 (TOKEN_ALL_ACCESS),         // DesiredAccess
                 &AnonymousTokenAttributes,  // ObjectAttributes
                 TokenImpersonation,         // TokenType
                 &OriginalAuthenticationId,     // Authentication LUID
                 &NoExpiration,              // Expiration Time
                 &UserId,                    // Owner ID
                 GroupIds,                   // Group IDs
                 Privileges,                 // Privileges
                 &Owner,                     // Owner
                 &PrimaryGroup,              // Primary Group
                 &DefaultDacl,               // Default Dacl
                 &TestSource                 // TokenSource
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtDuplicateObject(
                     NtCurrentProcess(),     // SourceProcessHandle
                     Token,                  // SourceHandle
                     NtCurrentProcess(),     // TargetProcessHandle
                     &AnonymousToken,        // TargetHandle
                     0,                      // DesiredAccess (over-ridden by option)
                     0,                      // HandleAttributes
                     DUPLICATE_SAME_ACCESS   // Options
                     );
        ASSERT(NT_SUCCESS(Status));
        Status = NtClose(Token);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));



    //
    // Create the simplest token possible
    // (no Groups, explicit Owner, or DefaultDacl)
    //

    DbgPrint("Se:     Create Token With Bad Authentication Id ...            ");

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;
    GroupIds->GroupCount = 0;
    Privileges->PrivilegeCount = 0;
    PrimaryGroup.PrimaryGroup = FlintstoneSid;


    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &BadAuthenticationId,     // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 NULL,                     // Owner
                 &PrimaryGroup,            // Primary Group
                 NULL,                     // Default Dacl
                 &TestSource               // TokenSource
                 );

    if (Status == STATUS_NO_SUCH_LOGON_SESSION) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Status should be: 0x%lx \n", STATUS_NO_SUCH_LOGON_SESSION);
        CompletionStatus = FALSE;
    }






    //
    // All done with this test
    //

    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Token Filtering Test                                       //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenFilter()
{

    BOOLEAN CompletionStatus = TRUE;

    PTOKEN_GROUPS GroupIds;
    PTOKEN_GROUPS RestrictedGroupIds;
    PTOKEN_PRIVILEGES Privileges;

    DbgPrint("\n");

    GroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                               GROUP_IDS_LENGTH
                                               );

    RestrictedGroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                                         GROUP_IDS_LENGTH
                                                         );

    Privileges = (PTOKEN_PRIVILEGES)TstAllocatePool( PagedPool,
                                                     PRIVILEGES_LENGTH
                                                     );




    //
    // Filter a token without doing anything
    //

    DbgPrint("Se:     Filter null Token ...                                  ");
    Status = NtFilterToken(
                TokenWithGroups,
                0,                      // no flags
                NULL,                   // no groups to disable
                NULL,                   // no privileges to disable
                NULL,                   // no restricted sids
                &Token
                );
    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        NtClose(Token);
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    //
    // Filter a token and remove some groups
    //

    GroupIds->GroupCount = 2;

    GroupIds->Groups[0].Sid  = FlintstoneSid;
    GroupIds->Groups[1].Sid       = ChildSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = SE_GROUP_USE_FOR_DENY_ONLY;
    GroupIds->Groups[CHILD_INDEX].Attributes       = SE_GROUP_USE_FOR_DENY_ONLY;


    DbgPrint("Se:     Filter token with disabled groups ...                  ");
    Status = NtFilterToken(
                TokenWithGroups,
                0,                      // no flags
                GroupIds,               // no groups to disable
                NULL,                   // no privileges to disable
                NULL,                   // no restricted sids
                &TokenWithRestrictedGroups
                );
    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }


    //
    // Filter a token and remove some privileges
    //


    Privileges->PrivilegeCount = 2;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;


    DbgPrint("Se:     Filter token with disabled privilegs ...               ");
    Status = NtFilterToken(
                TokenWithPrivileges,
                0,                      // no flags
                NULL,                   // no groups to disable
                Privileges,             // no privileges to disable
                NULL,                   // no restricted sids
                &TokenWithRestrictedPrivileges
                );
    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }


    //
    // Filter a restricted token and add some restricted sids
    //

    RestrictedGroupIds->GroupCount = RESTRICTED_SID_COUNT;

    RestrictedGroupIds->GroupCount = RESTRICTED_SID_COUNT;

    RestrictedGroupIds->Groups[0].Sid  = FlintstoneSid;
    RestrictedGroupIds->Groups[1].Sid       = ChildSid;

    RestrictedGroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    RestrictedGroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;



    DbgPrint("Se:     Filter token with restricted sids ...                 ");
    Status = NtFilterToken(
                TokenWithGroups,
                0,                      // no flags
                NULL,                   // no groups to disable
                NULL,                   // no privileges to disable
                RestrictedGroupIds,     // no restricted sids
                &TokenWithRestrictedSids
                );
    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }


    //
    // Filter a token and add some restricted sids
    //

    RestrictedGroupIds->GroupCount = RESTRICTED_SID_COUNT;

    RestrictedGroupIds->Groups[0].Sid       = NeandertholSid;
    RestrictedGroupIds->Groups[1].Sid       = WorldSid;

    RestrictedGroupIds->Groups[0].Attributes  = OwnerGroupAttributes;
    RestrictedGroupIds->Groups[1].Attributes       = OptionalGroupAttributes;


    DbgPrint("Se:     Filter token with more restricted sids ...             ");
    Status = NtFilterToken(
                TokenWithRestrictedSids,
                0,                      // no flags
                NULL,                   // no groups to disable
                NULL,                   // no privileges to disable
                RestrictedGroupIds,     // no restricted sids
                &TokenWithMoreRestrictedSids
                );
    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }


    //
    // All done with this test
    //

    return CompletionStatus;
}



////////////////////////////////////////////////////////////////
//                                                            //
// Open Primary Token Test                                    //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenOpenPrimary()
{
    NTSTATUS Status;
    BOOLEAN CompletionStatus = TRUE;

    HANDLE ProcessToken;
    HANDLE SubProcessToken;
    HANDLE SubProcess;

    TOKEN_STATISTICS ProcessTokenStatistics;
    TOKEN_STATISTICS SubProcessTokenStatistics;

    ULONG ReturnLength;

    DbgPrint("\n");

    //
    // Open the current process's token
    //

    DbgPrint("Se:     Open own process's token ...                           ");

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 TOKEN_ALL_ACCESS,
                 &ProcessToken
                 );
    if (NT_SUCCESS(Status)) {
        Status = NtQueryInformationToken(
                     ProcessToken,                 // Handle
                     TokenStatistics,              // TokenInformationClass
                     &ProcessTokenStatistics,      // TokenInformation
                     sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                     &ReturnLength                 // ReturnLength
                     );
        ASSERT(NT_SUCCESS(Status));
        if ( ProcessTokenStatistics.TokenType == TokenPrimary) {
            if ( RtlEqualLuid( &ProcessTokenStatistics.AuthenticationId,
                               &OriginalAuthenticationId ) ) {
                DbgPrint("Succeeded.\n");
            } else {
                DbgPrint("********** Failed ************\n");
                DbgPrint("Unexpected authentication ID value.\n");
                DbgPrint("Authentication ID is: ");
                TestpPrintLuid(ProcessTokenStatistics.AuthenticationId);
                DbgPrint("\n");
                CompletionStatus = FALSE;
            }

        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Token type not TokenPrimary.\n");
            DbgPrint("Returned token type is: 0x%lx \n",
                    ProcessTokenStatistics.TokenType);
            DbgPrint("Authentication ID is: ");
            TestpPrintLuid(ProcessTokenStatistics.AuthenticationId);
            DbgPrint("\n");
            CompletionStatus = FALSE;
        }
        Status = NtClose(ProcessToken);
        ASSERT(NT_SUCCESS(Status));

    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }






    //
    // Open another process's token
    //

    DbgPrint("Se:     Open another process's token ...                       ");

    Status = NtCreateProcess(
                 &SubProcess,
                 (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | DELETE),
                 NULL,
                 NtCurrentProcess(),   // ParentProcess
                 FALSE,                // InheritObjectTable
                 NULL,                 // SectionHandle,
                 NULL,                 // DebugPort,
                 NULL                  // ExceptionPort
                 );

    Status = NtOpenProcessToken(
                 SubProcess,
                 TOKEN_ALL_ACCESS,
                 &SubProcessToken
                 );
    if (NT_SUCCESS(Status)) {
        Status = NtQueryInformationToken(
                     SubProcessToken,              // Handle
                     TokenStatistics,              // TokenInformationClass
                     &SubProcessTokenStatistics,   // TokenInformation
                     sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                     &ReturnLength                 // ReturnLength
                     );
        ASSERT(NT_SUCCESS(Status));
        if ( SubProcessTokenStatistics.TokenType == TokenPrimary) {
            if ( RtlEqualLuid( &SubProcessTokenStatistics.AuthenticationId,
                               &OriginalAuthenticationId ) ) {
                if ( (ProcessTokenStatistics.TokenId.HighPart ==
                      SubProcessTokenStatistics.TokenId.HighPart)  &&
                     (ProcessTokenStatistics.TokenId.LowPart ==
                      SubProcessTokenStatistics.TokenId.LowPart) ) {
                    DbgPrint("********** Failed ************\n");
                    DbgPrint("Same token as parent process (token IDs match).\n");
                    DbgPrint("Authentication ID is: ");
                    TestpPrintLuid(SubProcessTokenStatistics.AuthenticationId);
                    DbgPrint("\n");
                    CompletionStatus = FALSE;

                } else {
                    DbgPrint("Succeeded.\n");
                }
            } else {
                DbgPrint("********** Failed ************\n");
                DbgPrint("Unexpected authentication ID value.\n");
                DbgPrint("Authentication ID is: ");
                TestpPrintLuid(SubProcessTokenStatistics.AuthenticationId);
                DbgPrint("\n");
                CompletionStatus = FALSE;
            }
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Token type not TokenPrimary.\n");
            DbgPrint("Returned token type is: 0x%lx \n",
            SubProcessTokenStatistics.TokenType);
            DbgPrint("Authentication ID is: ");
            TestpPrintLuid(SubProcessTokenStatistics.AuthenticationId);
            DbgPrint("\n");
            CompletionStatus = FALSE;
        }
        Status = NtClose(SubProcessToken);
        ASSERT(NT_SUCCESS(Status));
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }


    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Query Token Test                                           //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenQuery()
{
    BOOLEAN CompletionStatus = TRUE;
    ULONG ReturnLength;
    BOOLEAN ValuesCompare;

    PTOKEN_USER UserId = NULL;
    PTOKEN_PRIMARY_GROUP PrimaryGroup = NULL;
    PTOKEN_GROUPS GroupIds = NULL;
    PTOKEN_GROUPS RestrictedSids = NULL;
    PTOKEN_PRIVILEGES Privileges = NULL;
    PTOKEN_OWNER Owner = NULL;
    PTOKEN_DEFAULT_DACL DefaultDacl = NULL;

    SECURITY_IMPERSONATION_LEVEL QueriedImpersonationLevel;
    TOKEN_SOURCE QueriedSource;
    TOKEN_TYPE QueriedType;
    TOKEN_STATISTICS QueriedStatistics;

    DbgPrint("\n");



#if 0

   //
   // Query invalid return buffer address
   //

    DbgPrint("Se:     Query with invalid buffer address ...                  ");

    UserId = (PTOKEN_USER)((PVOID)0x200L);
    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenUser,                // TokenInformationClass
                 UserId,                   // TokenInformation
                 3000,                     // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_ACCESS_VIOLATION) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

#endif  //0


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query User ID                                               //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query User ID with zero length buffer
   //

    DbgPrint("Se:     Query User ID with zero length buffer ...              ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenUser,                // TokenInformationClass
                 UserId,                   // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    UserId = (PTOKEN_USER)TstAllocatePool( PagedPool,
                                           ReturnLength
                                           );

    //
    // Query user SID
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query token user ...                                   ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenUser,                // TokenInformationClass
                 UserId,                   // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid((UserId->User.Sid), PebblesSid) ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query user with too small buffer ...                   ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenUser,                // TokenInformationClass
                 UserId,                   // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Primary Group                                         //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query primary group with zero length buffer
   //

    DbgPrint("Se:     Query primary group with zero length buffer ...        ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 PrimaryGroup,             // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    PrimaryGroup = (PTOKEN_PRIMARY_GROUP)TstAllocatePool( PagedPool,
                                                          ReturnLength
                                                          );

    //
    // Query primary group SID
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query primary group ...                                ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 PrimaryGroup,             // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid( PrimaryGroup->PrimaryGroup, FlintstoneSid) ) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Unexpected value returned by query.\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query primary group with too small buffer ...          ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 PrimaryGroup,             // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));



////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Groups                                                //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query groups with zero length buffer ...               ");

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    GroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                               ReturnLength
                                               );

    //
    // Query Group SIDs
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query groups ...                                       ");

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Group count = 4
        //    SID 0 = Flintstone
        //    SID 1 = ChildSid
        //    SID 2 = NeandertholSid
        //    SID 3 = WorldSid
        //

        ValuesCompare = TRUE;

        if (GroupIds->GroupCount != GROUP_COUNT) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[FLINTSTONE_INDEX].Sid),
                            FlintstoneSid)) ||
             (GroupIds->Groups[FLINTSTONE_INDEX].Attributes !=
              OwnerGroupAttributes) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[CHILD_INDEX].Sid), ChildSid)) ||
             (GroupIds->Groups[CHILD_INDEX].Attributes !=
              OptionalGroupAttributes) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[NEANDERTHOL_INDEX].Sid),
              NeandertholSid)) ||
             (GroupIds->Groups[NEANDERTHOL_INDEX].Attributes !=
              OptionalGroupAttributes) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[WORLD_INDEX].Sid), WorldSid)) ||
             (GroupIds->Groups[WORLD_INDEX].Attributes != NormalGroupAttributes) ) {
            ValuesCompare = FALSE;
        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("Returned group count is: 0x%lx \n", GroupIds->GroupCount);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query groups with too small buffer ...                 ");

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query restgroups with zero length buffer ...           ");
    Status = NtQueryInformationToken(
                 TokenWithRestrictedGroups,// Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    GroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                               ReturnLength
                                               );

    //
    // Query Group SIDs
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query rest groups ...                                  ");

    Status = NtQueryInformationToken(
                 TokenWithRestrictedGroups,// Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Group count = 4
        //    SID 0 = Flintstone
        //    SID 1 = ChildSid
        //    SID 2 = NeandertholSid
        //    SID 3 = WorldSid
        //

        ValuesCompare = TRUE;

        if (GroupIds->GroupCount != GROUP_COUNT) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[FLINTSTONE_INDEX].Sid),
                            FlintstoneSid)) ||
             (GroupIds->Groups[FLINTSTONE_INDEX].Attributes !=
              ((OwnerGroupAttributes & ~(SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT)) | SE_GROUP_USE_FOR_DENY_ONLY) ) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[CHILD_INDEX].Sid), ChildSid)) ||
             (GroupIds->Groups[CHILD_INDEX].Attributes !=
                            ((OptionalGroupAttributes & ~(SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT)) | SE_GROUP_USE_FOR_DENY_ONLY)) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[NEANDERTHOL_INDEX].Sid),
              NeandertholSid)) ||
             (GroupIds->Groups[NEANDERTHOL_INDEX].Attributes !=
              OptionalGroupAttributes) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((GroupIds->Groups[WORLD_INDEX].Sid), WorldSid)) ||
             (GroupIds->Groups[WORLD_INDEX].Attributes != NormalGroupAttributes) ) {
            ValuesCompare = FALSE;
        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("Returned group count is: 0x%lx \n", GroupIds->GroupCount);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));



////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query RestrictedSids                                        //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query null restricted with zero length buffer ...      ");

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenRestrictedSids,      // TokenInformationClass
                 RestrictedSids,           // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query restricted sids with zero length buffer ...      ");

    Status = NtQueryInformationToken(
                 TokenWithRestrictedSids,  // Handle
                 TokenRestrictedSids,      // TokenInformationClass
                 RestrictedSids,           // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    RestrictedSids = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                                     ReturnLength
                                                     );

    //
    // Query Group SIDs
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query restricted sids ...                              ");

    Status = NtQueryInformationToken(
                 TokenWithRestrictedSids,  // Handle
                 TokenRestrictedSids,      // TokenInformationClass
                 RestrictedSids,           // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG


    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Group count = 2
        //    SID 0 = Flintstone
        //    SID 1 = ChildSid
        //

        ValuesCompare = TRUE;

        if (RestrictedSids->GroupCount != RESTRICTED_SID_COUNT) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((RestrictedSids->Groups[FLINTSTONE_INDEX].Sid),
                            FlintstoneSid)) ||
             (RestrictedSids->Groups[FLINTSTONE_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((RestrictedSids->Groups[CHILD_INDEX].Sid), ChildSid)) ||
             (RestrictedSids->Groups[CHILD_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Unexpected value returned by query.\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            DbgPrint("Returned group count is: 0x%lx \n", RestrictedSids->GroupCount);
            CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));

    //
   // Query restricted sids with zero length buffer
   //

    DbgPrint("Se:     Query more restricted sids with zero length buffer ... ");

    Status = NtQueryInformationToken(
                 TokenWithMoreRestrictedSids,  // Handle
                 TokenRestrictedSids,      // TokenInformationClass
                 RestrictedSids,           // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    RestrictedSids = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                                     ReturnLength
                                                     );

    //
    // Query Group SIDs
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query more restricted sids ...                         ");

    Status = NtQueryInformationToken(
                 TokenWithMoreRestrictedSids,  // Handle
                 TokenRestrictedSids,      // TokenInformationClass
                 RestrictedSids,           // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG


    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Group count = 2
        //    SID 0 = Flintstone
        //    SID 1 = ChildSid
        //    SID 2 = Neaderthol
        //    SID 3 = World
        //

        ValuesCompare = TRUE;

        if (RestrictedSids->GroupCount != GROUP_COUNT) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((RestrictedSids->Groups[FLINTSTONE_INDEX].Sid),
                            FlintstoneSid)) ||
             (RestrictedSids->Groups[FLINTSTONE_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((RestrictedSids->Groups[CHILD_INDEX].Sid), ChildSid)) ||
             (RestrictedSids->Groups[CHILD_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }


        if ( (!RtlEqualSid((RestrictedSids->Groups[NEANDERTHOL_INDEX].Sid),
                            NeandertholSid)) ||
             (RestrictedSids->Groups[NEANDERTHOL_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }

        if ( (!RtlEqualSid((RestrictedSids->Groups[WORLD_INDEX].Sid), WorldSid)) ||
             (RestrictedSids->Groups[WORLD_INDEX].Attributes !=
              (SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY)) ) {
            ValuesCompare = FALSE;
        }



        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Unexpected value returned by query.\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            DbgPrint("Returned group count is: 0x%lx \n", RestrictedSids->GroupCount);
            CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query groups with too small buffer ...                 ");

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenGroups,              // TokenInformationClass
                 GroupIds,                 // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Privileges                                            //
//                                                                    //
////////////////////////////////////////////////////////////////////////


   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query privileges with zero length buffer ...           ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenPrivileges,          // TokenInformationClass
                 NULL,                     // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    Privileges = (PTOKEN_PRIVILEGES)TstAllocatePool( PagedPool,
                                                     ReturnLength
                                                     );

    //
    // Query privileges
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query privileges ...                                   ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenPrivileges,          // TokenInformationClass
                 Privileges,               // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Privilege count = PRIVILEGE_COUNT
        //    Privilege UNSOLICITED_INDEX    = UnsolicitedInputPrivilege
        //    Privilege SECURITY_INDEX       = SecurityPrivilege
        //    Privilege ASSIGN_PRIMARY_INDEX = AssignPrimaryPrivilege
        //

        ValuesCompare = TRUE;

        if (Privileges->PrivilegeCount != PRIVILEGE_COUNT) {
            ValuesCompare = FALSE;
        }

        if ( !RtlEqualLuid(&Privileges->Privileges[UNSOLICITED_INDEX].Luid,
               &UnsolicitedInputPrivilege)      ||
             (Privileges->Privileges[UNSOLICITED_INDEX].Attributes != 0)             ) {
            ValuesCompare = FALSE;
        }

        if ( !RtlEqualLuid(&Privileges->Privileges[SECURITY_INDEX].Luid,
               &SecurityPrivilege)             ||
             (Privileges->Privileges[SECURITY_INDEX].Attributes != 0)             ) {
            ValuesCompare = FALSE;
        }

        if ( !RtlEqualLuid(&Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid,
               &AssignPrimaryTokenPrivilege)             ||
             (Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes != SE_PRIVILEGE_ENABLED)             ) {
            ValuesCompare = FALSE;
        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query privileges with too small buffer ...             ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenPrivileges,          // TokenInformationClass
                 Privileges,               // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

   //
   // Query groups with zero length buffer
   //

    DbgPrint("Se:     Query rest privileges with zero length buffer ...      ");

    ReturnLength = 0;
    Status = NtQueryInformationToken(
                 TokenWithRestrictedPrivileges,      // Handle
                 TokenPrivileges,          // TokenInformationClass
                 NULL,                     // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    Privileges = (PTOKEN_PRIVILEGES)TstAllocatePool( PagedPool,
                                                     ReturnLength
                                                     );

    //
    // Query privileges
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query rest privileges ...                              ");

    Status = NtQueryInformationToken(
                 TokenWithRestrictedPrivileges,      // Handle
                 TokenPrivileges,          // TokenInformationClass
                 Privileges,               // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //    Privilege count = PRIVILEGE_COUNT -2
        //    Privilege ASSIGN_PRIMARY_INDEX = AssignPrimaryPrivilege
        //

        ValuesCompare = TRUE;

        if (Privileges->PrivilegeCount != PRIVILEGE_COUNT - 2) {
            ValuesCompare = FALSE;
        }


        if ( !RtlEqualLuid(&Privileges->Privileges[0].Luid,
               &AssignPrimaryTokenPrivilege)             ||
             (Privileges->Privileges[0].Attributes != SE_PRIVILEGE_ENABLED)             ) {
            ValuesCompare = FALSE;
        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Owner                                                 //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query Owner of simple token with zero length buffer
   //

    DbgPrint("Se:     Query Owner of simple token with zero length buffer... ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));



    Owner = (PTOKEN_OWNER)TstAllocatePool( PagedPool,
                                           ReturnLength
                                           );

    //
    // Query Owner SID
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query owner of simple token ...                        ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid((Owner->Owner), PebblesSid) ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query owner of simple token with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query owner of simple token with too small buffer ...  ");

    Status = NtQueryInformationToken(
                 SimpleToken,              // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


    //
    // Query default owner of token with zero length buffer
    //

    DbgPrint("Se:     Query Default Owner of token with zero length buffer...");

    Status = NtQueryInformationToken(
                 TokenWithDefaultOwner,    // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    Owner = (PTOKEN_OWNER)TstAllocatePool( PagedPool,
                                           ReturnLength
                                           );

    //
    // Query default owner of token
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query default owner of token ...                       ");

    Status = NtQueryInformationToken(
                 TokenWithDefaultOwner,    // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid((Owner->Owner), FlintstoneSid) ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query default owner of token with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query default owner of token with too small buffer ... ");

    Status = NtQueryInformationToken(
                 TokenWithDefaultOwner,    // Handle
                 TokenOwner,               // TokenInformationClass
                 Owner,                    // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Default Dacl                                          //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query default dacl with zero length buffer
   //

    DbgPrint("Se:     Query default DACL with zero length buffer ...         ");

    Status = NtQueryInformationToken(
                 TokenWithDefaultDacl,     // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 DefaultDacl,              // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    DefaultDacl = (PTOKEN_DEFAULT_DACL)TstAllocatePool( PagedPool,
                                                        ReturnLength
                                                        );

    //
    // Query default dacl
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query default dacl ...                                 ");

    Status = NtQueryInformationToken(
                 TokenWithDefaultDacl,     // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 DefaultDacl,              // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlValidAcl(DefaultDacl->DefaultDacl)) {

            if (DefaultDacl->DefaultDacl->AceCount == 0) {

                DbgPrint("Succeeded.\n");
            } else {
                DbgPrint("********** Failed ************\n");
                DbgPrint("Unexpected value returned by query.\n");
                DbgPrint("Status is: 0x%lx \n", Status);
                DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
                CompletionStatus = FALSE;
            }
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Unexpected value returned by query.\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


   //
   // Query with too little buffer
   // (This relies upon the ReturnLength returned from previous call)
   //

    DbgPrint("Se:     Query default Dacl with too small buffer ...           ");

    Status = NtQueryInformationToken(
                 TokenWithDefaultDacl,     // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 DefaultDacl,              // TokenInformation
                 ReturnLength-1,           // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


   //
   // Query token with no default dacl
   //

    DbgPrint("Se:     Query default dacl from token with none ...            ");

    Status = NtQueryInformationToken(
                 SimpleToken,                // Handle
                 TokenDefaultDacl,           // TokenInformationClass
                 DefaultDacl,                // TokenInformation
                 sizeof(TOKEN_DEFAULT_DACL), // TokenInformationLength
                 &ReturnLength               // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Token Source                                          //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query Token Source with zero length buffer
   //

    DbgPrint("Se:     Query Token Source with zero length buffer ...         ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenSource,              // TokenInformationClass
                 &QueriedSource,           // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        if (ReturnLength == sizeof(TOKEN_SOURCE)) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("TOKEN_SOURCE data size is 0x%lx \n", sizeof(TOKEN_SOURCE));
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));



    //
    // Query token source
    //

    DbgPrint("Se:     Query token source ...                                 ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenSource,              // TokenInformationClass
                 &QueriedSource,           // TokenInformation
                 sizeof(TOKEN_SOURCE),     // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value against TestSource
        //

        ValuesCompare = TRUE;

        if ( (QueriedSource.SourceName[0] != TestSource.SourceName[0]) ||
             (QueriedSource.SourceName[1] != TestSource.SourceName[1]) ||
             (QueriedSource.SourceName[2] != TestSource.SourceName[2]) ||
             (QueriedSource.SourceName[3] != TestSource.SourceName[3]) ||
             (QueriedSource.SourceName[4] != TestSource.SourceName[4]) ||
             (QueriedSource.SourceName[5] != TestSource.SourceName[5]) ||
             (QueriedSource.SourceName[6] != TestSource.SourceName[6]) ||
             (QueriedSource.SourceName[7] != TestSource.SourceName[7]) ) {

            ValuesCompare = FALSE;

        }

        if ( !RtlEqualLuid(&QueriedSource.SourceIdentifier,
               &TestSource.SourceIdentifier)   ) {

            ValuesCompare = FALSE;

        }


        if ( ValuesCompare ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query token source with too small buffer ...           ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenSource,              // TokenInformationClass
                 &QueriedSource,           // TokenInformation
                 ReturnLength - 1,         // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Token Type                                            //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query Token type with zero length buffer
   //

    DbgPrint("Se:     Query Token type with zero length buffer ...           ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenType,                // TokenInformationClass
                 &QueriedType,             // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        if (ReturnLength == sizeof(TOKEN_TYPE)) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("TOKEN_TYPE data size is 0x%lx \n", sizeof(TOKEN_TYPE));
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    //
    // Query token type
    //

    DbgPrint("Se:     Query token type ...                                   ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenType,                // TokenInformationClass
                 &QueriedType,             // TokenInformation
                 sizeof(TOKEN_TYPE),       // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value against TestSource
        //


        if ( QueriedType == TokenPrimary ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("Returned token type is: 0x%lx \n", QueriedType);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query token type with too small buffer ...             ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenType,                // TokenInformationClass
                 &QueriedType,             // TokenInformation
                 ReturnLength - 1,         // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Impersonation Level                                   //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query Impersonation Level of primary token
   //

    DbgPrint("Se:     Query Impersonation level of primary token ...         ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,                  // Handle
                 TokenImpersonationLevel,              // TokenInformationClass
                 &QueriedImpersonationLevel,           // TokenInformation
                 sizeof(SECURITY_IMPERSONATION_LEVEL), // TokenInformationLength
                 &ReturnLength                         // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_INVALID_INFO_CLASS) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(Status == STATUS_INVALID_INFO_CLASS);


////////////////////////////////////////////////////////////////////////
//                                                                    //
//        Query Token Statistics                                      //
//                                                                    //
////////////////////////////////////////////////////////////////////////

   //
   // Query Token statistics with zero length buffer
   //

    DbgPrint("Se:     Query Token statistics with zero length buffer ...     ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenStatistics,          // TokenInformationClass
                 &QueriedStatistics,       // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        if (ReturnLength == sizeof(TOKEN_STATISTICS)) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        DbgPrint("TOKEN_STATISTICS data size is 0x%lx \n", sizeof(TOKEN_STATISTICS));
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));




    //
    // Query token statistics
    //

    DbgPrint("Se:     Query token statistics ...                             ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenStatistics,          // TokenInformationClass
                 &QueriedStatistics,       // TokenInformation
                 sizeof(TOKEN_STATISTICS), // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value against TestSource
        //

        if ( ( QueriedStatistics.TokenType == TokenPrimary) &&
             ( QueriedStatistics.GroupCount == 4 )          &&
             ( QueriedStatistics.PrivilegeCount == PRIVILEGE_COUNT) ) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Unexpected value returned by query.\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            DbgPrint("Returned token type is: 0x%lx \n", QueriedStatistics.TokenType);
            DbgPrint("Returned group count is: 0x%lx \n", QueriedStatistics.GroupCount);
            DbgPrint("Returned privilege count is: 0x%lx \n", QueriedStatistics.PrivilegeCount);
            CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query with too little buffer
    // (This relies upon the ReturnLength returned from previous call)
    //

    DbgPrint("Se:     Query token statistics with too small buffer ...       ");

    Status = NtQueryInformationToken(
                 TokenWithPrivileges,      // Handle
                 TokenStatistics,          // TokenInformationClass
                 &QueriedStatistics,       // TokenInformation
                 ReturnLength - 1,         // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));



    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Set Token Test                                             //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenSet()
{
    BOOLEAN CompletionStatus = TRUE;
    ULONG InformationLength;
    ULONG ReturnLength;

    TOKEN_STATISTICS QueriedStatistics;

    TOKEN_PRIMARY_GROUP AssignedPrimaryGroup;
    PTOKEN_PRIMARY_GROUP QueriedPrimaryGroup = NULL;

    TOKEN_OWNER AssignedOwner;
    PTOKEN_OWNER QueriedOwner = NULL;

    TOKEN_DEFAULT_DACL AssignedDefaultDacl;
    PTOKEN_DEFAULT_DACL QueriedDefaultDacl = NULL;

    PSID TooBigSid;

    SID_IDENTIFIER_AUTHORITY BedrockAuthority = BEDROCK_AUTHORITY;

    DbgPrint("\n");


   //
   // Set owner of a token to be an invalid group
   //

    DbgPrint("Se:     Set default owner to be an invalid group ...           ");

    AssignedOwner.Owner = NeandertholSid;
    InformationLength = (ULONG)sizeof(TOKEN_OWNER);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenOwner,               // TokenInformationClass
                 &AssignedOwner,           // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (Status == STATUS_INVALID_OWNER) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("InformationLength is: 0x%lx \n", InformationLength);
        CompletionStatus = FALSE;
    }

    ASSERT(Status == STATUS_INVALID_OWNER);


   //
   // Set owner of a token to be an ID not in the token
   //

    DbgPrint("Se:     Set default owner to be an ID not in the token ...     ");

    AssignedOwner.Owner = BarneySid;
    InformationLength = (ULONG)sizeof(TOKEN_OWNER);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenOwner,               // TokenInformationClass
                 &AssignedOwner,           // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (Status == STATUS_INVALID_OWNER) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("InformationLength is: 0x%lx \n", InformationLength);
        CompletionStatus = FALSE;
    }

    ASSERT(Status == STATUS_INVALID_OWNER);


   //
   // Set owner of a token to be a valid group
   //

    DbgPrint("Se:     Set default owner to be a valid group ...              ");

    AssignedOwner.Owner = FlintstoneSid;
    InformationLength = (ULONG)sizeof(TOKEN_OWNER);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenOwner,               // TokenInformationClass
                 &AssignedOwner,           // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (!NT_SUCCESS(Status)) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("InformationLength is: 0x%lx \n", InformationLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));

    //
    // Query the Owner to see that it was set properly
    //

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenOwner,               // TokenInformationClass
                 QueriedOwner,             // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status != STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("********** Failed Query of length ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

    QueriedOwner = (PTOKEN_OWNER)TstAllocatePool( PagedPool,
                                                  ReturnLength
                                                  );

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenOwner,               // TokenInformationClass
                 QueriedOwner,             // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid((QueriedOwner->Owner), AssignedOwner.Owner) ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed Comparison ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed Query Of Value ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    //  Set Default Dacl

    //
    // Get a buffer for use in all Default Dacl assignment tests.
    // This will be initialized to different sizes for each test.
    //

    AssignedDefaultDacl.DefaultDacl =
        (PACL)TstAllocatePool( PagedPool, TOO_BIG_ACL_SIZE );


    //
    // Assign a discretionary ACL to a token that doesn't yet have one
    //

    DbgPrint("Se:     Set original discretionary ACL in token ...            ");

    InformationLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL);
    RtlCreateAcl( AssignedDefaultDacl.DefaultDacl, 200, ACL_REVISION );

    Status = NtQueryInformationToken(
                 TokenWithGroups,            // Handle
                 TokenDefaultDacl,           // TokenInformationClass
                 &QueriedDefaultDacl,        // TokenInformation
                 0,                          // TokenInformationLength
                 &ReturnLength               // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(Status == STATUS_BUFFER_TOO_SMALL);

    if (ReturnLength != sizeof(TOKEN_DEFAULT_DACL)) {

        //
        // Wait a minute, this token has a default Dacl
        //

            DbgPrint("******** Failed - token has default dacl *********\n");
            DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

    } else {

        Status = NtSetInformationToken(
                     TokenWithGroups,          // Handle
                     TokenDefaultDacl,         // TokenInformationClass
                     &AssignedDefaultDacl,     // TokenInformation
                     InformationLength         // TokenInformationLength
                     );

        if (NT_SUCCESS(Status)) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            CompletionStatus = FALSE;
        }

    }

    ASSERT(NT_SUCCESS(Status));

    //
    // Replace a discretionary ACL in a token that already has one
    // Make it big to help with future "too big" tests...
    //


    //
    // find out how much space is available
    //

    Status = NtQueryInformationToken(
                 TokenWithGroups,                 // Handle
                 TokenStatistics,                 // TokenInformationClass
                 &QueriedStatistics,              // TokenInformation
                 (ULONG)sizeof(TOKEN_STATISTICS), // TokenInformationLength
                 &ReturnLength                    // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 &QueriedDefaultDacl,      // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(Status == STATUS_BUFFER_TOO_SMALL);


    if (ReturnLength > sizeof(TOKEN_STATISTICS)) {
        CurrentLength = ReturnLength - (ULONG)sizeof(TOKEN_STATISTICS);
    } else {
        CurrentLength = 0;
    }

    LengthAvailable = QueriedStatistics.DynamicAvailable + CurrentLength;

    DbgPrint("Se:     Replace discretionary ACL in token ...                 ");

    InformationLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL);
    RtlCreateAcl( AssignedDefaultDacl.DefaultDacl,
                  (ULONG)(LengthAvailable - 50),
                  ACL_REVISION
                  );

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 &QueriedDefaultDacl,      // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG


    if (!(ReturnLength > sizeof(TOKEN_DEFAULT_DACL))) {

        //
        // Wait a minute, this token doesn't have a default Dacl
        //

            DbgPrint("******** Failed - No default dacl *********\n");
            CompletionStatus = FALSE;

    } else {

        Status = NtSetInformationToken(
                     TokenWithGroups,          // Handle
                     TokenDefaultDacl,         // TokenInformationClass
                     &AssignedDefaultDacl,     // TokenInformation
                     InformationLength         // TokenInformationLength
                     );

        if (NT_SUCCESS(Status)) {
            DbgPrint("Succeeded.\n");
        } else {
            DbgPrint("********** Failed ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            CompletionStatus = FALSE;
        }

    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Assign a discretionary ACL that doesn't fit into the dynamic part of the
    // token.
    //


    //
    // find out how much space is available
    //

    Status = NtQueryInformationToken(
                 TokenWithGroups,                 // Handle
                 TokenStatistics,                 // TokenInformationClass
                 &QueriedStatistics,              // TokenInformation
                 (ULONG)sizeof(TOKEN_STATISTICS), // TokenInformationLength
                 &ReturnLength                    // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 &QueriedDefaultDacl,      // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(Status == STATUS_BUFFER_TOO_SMALL);


    if (ReturnLength > sizeof(TOKEN_STATISTICS)) {
        CurrentLength = ReturnLength - (ULONG)sizeof(TOKEN_STATISTICS);
    } else {
        CurrentLength = 0;
    }

    LengthAvailable = QueriedStatistics.DynamicAvailable + CurrentLength;

    DbgPrint("Se:     Set too big discretionary ACL ...                      ");


    //
    // Now make sure our ACL is large enough to exceed the available
    // space.
    //

    RtlCreateAcl( AssignedDefaultDacl.DefaultDacl,
                  TOO_BIG_ACL_SIZE,
                  ACL_REVISION
                  );

    if (TOO_BIG_ACL_SIZE < LengthAvailable) {

        DbgPrint("********** Failed - Dynamic too big ************\n");
        DbgPrint("Dynamic available is: 0x%lx \n",
            QueriedStatistics.DynamicAvailable);
        DbgPrint("Current default Dacl size is: 0x%lx \n", CurrentLength);
        DbgPrint("Big ACL size is: 0x%lx \n", TOO_BIG_ACL_SIZE);
        CompletionStatus = FALSE;
    }


    InformationLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenDefaultDacl,         // TokenInformationClass
                 &AssignedDefaultDacl,     // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (Status == STATUS_ALLOTTED_SPACE_EXCEEDED) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Dynamic available is: 0x%lx \n",
            QueriedStatistics.DynamicAvailable);
        DbgPrint("Current default Dacl size is: 0x%lx \n", CurrentLength);
        DbgPrint("Big ACL size is: 0x%lx \n", TOO_BIG_ACL_SIZE);
        CompletionStatus = FALSE;
    }

    ASSERT(Status == STATUS_ALLOTTED_SPACE_EXCEEDED);


   //
   // Set primary group
   //

    DbgPrint("Se:     Set primary group ...                                  ");

    AssignedPrimaryGroup.PrimaryGroup = RubbleSid;
    InformationLength = (ULONG)sizeof(TOKEN_PRIMARY_GROUP);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 &AssignedPrimaryGroup,    // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (!NT_SUCCESS(Status)) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("InformationLength is: 0x%lx \n", InformationLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Query the Primary Group to see that it was set properly
    //

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 QueriedPrimaryGroup,      // TokenInformation
                 0,                        // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status != STATUS_BUFFER_TOO_SMALL) {
        DbgPrint("********** Failed Query of length ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(!NT_SUCCESS(Status));

    QueriedPrimaryGroup =
        (PTOKEN_PRIMARY_GROUP)TstAllocatePool( PagedPool,
                                               ReturnLength
                                               );

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 QueriedPrimaryGroup,      // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (NT_SUCCESS(Status)) {

        //
        // Check returned value
        //

        if (RtlEqualSid((QueriedPrimaryGroup->PrimaryGroup),
            AssignedPrimaryGroup.PrimaryGroup) ) {
            DbgPrint("Succeeded.\n");
        } else {
        DbgPrint("********** Failed Comparison ************\n");
        DbgPrint("Unexpected value returned by query.\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
        }
    } else {
        DbgPrint("********** Failed Query Of Value ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Required return length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;
    }

    ASSERT(NT_SUCCESS(Status));


    //
    // Assign a primary group that doesn't fit into the dynamic part of the
    // token.
    //


    DbgPrint("Se:     Set too big primary group ...                          ");

    //
    // First, find out how much space is available
    //

    Status = NtQueryInformationToken(
                 TokenWithGroups,                 // Handle
                 TokenStatistics,                 // TokenInformationClass
                 &QueriedStatistics,              // TokenInformation
                 (ULONG)sizeof(TOKEN_STATISTICS), // TokenInformationLength
                 &ReturnLength                    // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));

    Status = NtQueryInformationToken(
                 TokenWithGroups,          // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 QueriedPrimaryGroup,      // TokenInformation
                 ReturnLength,             // TokenInformationLength
                 &ReturnLength             // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));

    CurrentLength = SeLengthSid(QueriedPrimaryGroup->PrimaryGroup);
    LengthAvailable = QueriedStatistics.DynamicAvailable + CurrentLength;

    //
    // Now make sure our fake group ID is large enough to exceed the available
    // space.
    //

    TooBigSid = (PSID)TstAllocatePool(
                          PagedPool,
                          RtlLengthRequiredSid( TOO_BIG_PRIMARY_GROUP_SIZE )
                          );

    RtlInitializeSid(
        TooBigSid,
        &BedrockAuthority,
        TOO_BIG_PRIMARY_GROUP_SIZE
        );

    if ((ULONG) SeLengthSid(TooBigSid) < LengthAvailable) {

        DbgPrint("********** Failed - Dynamic too big ************\n");
        DbgPrint("Dynamic available is: 0x%lx \n",
            QueriedStatistics.DynamicAvailable);
        DbgPrint("Existing primary group length is: 0x%lx \n", CurrentLength);
        DbgPrint("Big SID size is: 0x%lx \n", SeLengthSid(TooBigSid));
        CompletionStatus = FALSE;
    }


    AssignedPrimaryGroup.PrimaryGroup = TooBigSid;
    InformationLength = (ULONG)sizeof(TOKEN_PRIMARY_GROUP);

    Status = NtSetInformationToken(
                 TokenWithGroups,          // Handle
                 TokenPrimaryGroup,        // TokenInformationClass
                 &AssignedPrimaryGroup,    // TokenInformation
                 InformationLength         // TokenInformationLength
                 );

    if (Status == STATUS_ALLOTTED_SPACE_EXCEEDED) {
        DbgPrint("Succeeded.\n");
    } else {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Dynamic available is: 0x%lx \n",
            QueriedStatistics.DynamicAvailable);
        DbgPrint("Existing primary group length is: 0x%lx \n", CurrentLength);
        DbgPrint("Big SID size is: 0x%lx \n", SeLengthSid(TooBigSid));
        CompletionStatus = FALSE;
    }




    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Adjust Privileges Test                                     //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenAdjustPrivileges()
{

    BOOLEAN CompletionStatus = TRUE;
    NTSTATUS Status;
    NTSTATUS IgnoreStatus;

    PTOKEN_PRIVILEGES NewState;
    PTOKEN_PRIVILEGES PreviousState;
    PTOKEN_PRIVILEGES PrePrivileges;
    PTOKEN_PRIVILEGES PostPrivileges;

    ULONG NewStateBufferLength = 200;
    ULONG PreviousStateBufferLength = 200;
    ULONG PrePrivilegesLength = 200;
    ULONG PostPrivilegesLength = 200;

    ULONG ReturnLength;
    ULONG IgnoreReturnLength;

    DbgPrint("\n");

    PreviousState = (PTOKEN_PRIVILEGES)TstAllocatePool(
                        PagedPool,
                        PreviousStateBufferLength
                        );

    PrePrivileges = (PTOKEN_PRIVILEGES)TstAllocatePool(
                        PagedPool,
                        PrePrivilegesLength
                        );

    PostPrivileges = (PTOKEN_PRIVILEGES)TstAllocatePool(
                        PagedPool,
                        PostPrivilegesLength
                        );

    NewState = (PTOKEN_PRIVILEGES)TstAllocatePool(
                   PagedPool,
                   NewStateBufferLength
                   );





    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Adjust privileges giving no instructions                         //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     Adjust privileges with no instructions ...             ");

    Status = NtAdjustPrivilegesToken(
                 SimpleToken,                      // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NULL,                             // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    if (Status == STATUS_INVALID_PARAMETER) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_INVALID_PARAMETER);


    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable privileges in token with no privileges                    //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    NewState->PrivilegeCount = 1;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    DbgPrint("Se:     Enable privilege in token with none ...                ");

    Status = NtAdjustPrivilegesToken(
                 SimpleToken,                      // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);


    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    //  Enable a privilege that isn't assigned                          //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    NewState->PrivilegeCount = 1;
    NewState->Privileges[0].Luid = CreateTokenPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    DbgPrint("Se:     Enable unassigned privilege in token with some ...     ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

         //
         // Check the privilege values
         //

         if ( (PrePrivileges->Privileges[0].Attributes ==
               PostPrivileges->Privileges[0].Attributes)    &&
              (PrePrivileges->Privileges[1].Attributes ==
               PostPrivileges->Privileges[1].Attributes)    ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);




    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Disable All Privileges (which they already are)                  //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable already disabled privileges ...                ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[0].Attributes == 0 );
    ASSERT( PrePrivileges->Privileges[1].Attributes == 0 );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 TRUE,                             // DisableAllPrivileges
                 NULL,                             // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );


    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[0].Attributes == 0) &&
              (PostPrivileges->Privileges[1].Attributes == 0)    ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable currently disabled privileges                             //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable currently disabled privileges ...               ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[0].Attributes == 0 );
    ASSERT( PrePrivileges->Privileges[1].Attributes == 0 );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->PrivilegeCount = 2;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[1].Luid = UnsolicitedInputPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    NewState->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[0].Attributes == SE_PRIVILEGE_ENABLED)    &&
              (PostPrivileges->Privileges[1].Attributes == SE_PRIVILEGE_ENABLED)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Disable all enabled privileges                                   //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable all enabled privileges ...                     ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[0].Attributes == SE_PRIVILEGE_ENABLED );
    ASSERT( PrePrivileges->Privileges[1].Attributes == SE_PRIVILEGE_ENABLED );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 TRUE,                             // DisableAllPrivileges
                 NULL,                             // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );


    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[0].Attributes == 0)    &&
              (PostPrivileges->Privileges[1].Attributes == 0)    ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable privileges requesting previous state with no return       //
    // length buffer                                                    //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     PreviousState not NULL, ReturnLength NULL...           ");

    NewState->PrivilegeCount = 2;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[1].Luid = UnsolicitedInputPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    NewState->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 PreviousState,                    // PreviousState (OPTIONAL)
                 NULL                              // ReturnLength
                 );

    if (Status == STATUS_ACCESS_VIOLATION) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_ACCESS_VIOLATION);




    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable privileges without requesting previous state and          //
    // providing no return length buffer                                //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     PreviousState and ReturnLength both NULL...            ");

    NewState->PrivilegeCount = 2;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[1].Luid = UnsolicitedInputPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    NewState->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 NULL                              // ReturnLength
                 );

    if (Status == STATUS_SUCCESS) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);






    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable privileges requesting previous state with insufficient    //
    // buffer                                                           //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     Too small buffer for previous state ...                ");

    //
    // Establish a known previous state first...
    //

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 TRUE,                             // DisableAllPrivileges
                 NULL,                             // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    NewState->PrivilegeCount = 2;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[1].Luid = UnsolicitedInputPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    NewState->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 0,                                // BufferLength
                 PreviousState,                    // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    if (Status == STATUS_BUFFER_TOO_SMALL) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_BUFFER_TOO_SMALL);





    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable one of the privileges requesting previous state           //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable one requesting previous state ...               ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[0].Attributes == 0 );
    ASSERT( PrePrivileges->Privileges[1].Attributes == 0 );
    ASSERT(NT_SUCCESS(IgnoreStatus) );


    NewState->PrivilegeCount = 1;
    NewState->Privileges[0].Luid = SecurityPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 PreviousStateBufferLength,        // BufferLength
                 PreviousState,                    // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));
    ASSERT(PreviousState->PrivilegeCount == 1);


    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[SECURITY_INDEX].Attributes ==
               SE_PRIVILEGE_ENABLED)    &&
              (PostPrivileges->Privileges[UNSOLICITED_INDEX].Attributes == 0)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        DbgPrint("Change Count is: 0x%lx \n", PreviousState->PrivilegeCount);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);




    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Enable the other privilege requesting previous state             //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable one requesting previous state ...               ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[SECURITY_INDEX].Attributes ==
            SE_PRIVILEGE_ENABLED );
    ASSERT( PrePrivileges->Privileges[UNSOLICITED_INDEX].Attributes == 0 );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->PrivilegeCount = 1;
    NewState->Privileges[0].Luid = UnsolicitedInputPrivilege;
    NewState->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 NewState,                         // NewState (OPTIONAL)
                 PreviousStateBufferLength,        // BufferLength
                 PreviousState,                    // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(Status));
    ASSERT(PreviousState->PrivilegeCount == 1);


    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[0].Attributes == SE_PRIVILEGE_ENABLED)    &&
              (PostPrivileges->Privileges[1].Attributes == SE_PRIVILEGE_ENABLED)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        DbgPrint("Change Count is: 0x%lx \n", PreviousState->PrivilegeCount);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);





    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Return privileges to their previous state                        //
    // Uses PreviousState from previous call                            //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Return privileges to previous state ...                ");

    PrePrivileges->PrivilegeCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PrePrivileges,              // TokenInformation
                       PrePrivilegesLength,        // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PrePrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT( PrePrivileges->Privileges[0].Attributes == SE_PRIVILEGE_ENABLED );
    ASSERT( PrePrivileges->Privileges[1].Attributes == SE_PRIVILEGE_ENABLED );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustPrivilegesToken(
                 TokenWithPrivileges,              // TokenHandle
                 FALSE,                            // DisableAllPrivileges
                 PreviousState,                    // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    ASSERT(NT_SUCCESS(Status));
    ASSERT(PreviousState->PrivilegeCount == 1);


    PostPrivileges->PrivilegeCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithPrivileges,        // TokenHandle
                       TokenPrivileges,            // TokenInformationClass
                       PostPrivileges,             // TokenInformation
                       PostPrivilegesLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT( PostPrivileges->PrivilegeCount == PRIVILEGE_COUNT );
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the privilege values
         //

         if ( (PostPrivileges->Privileges[SECURITY_INDEX].Attributes ==
              SE_PRIVILEGE_ENABLED)    &&
              (PostPrivileges->Privileges[UNSOLICITED_INDEX].Attributes == 0)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);
            DbgPrint("Before and after privilege 0 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[0].Attributes,
                    PostPrivileges->Privileges[0].Attributes);
            DbgPrint("Before and after privilege 1 state: 0x%lx,  0x%lx \n",
                    PrePrivileges->Privileges[1].Attributes,
                    PostPrivileges->Privileges[1].Attributes);
            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }


    ASSERT(Status == STATUS_SUCCESS);




    ////////////////////////////////////////////////////////////////
    //                                                            //
    // Done with test                                             //
    //                                                            //
    ////////////////////////////////////////////////////////////////



    TstDeallocatePool( PreviousState, PreviousStateBufferLength );
    TstDeallocatePool( NewState, NewStateBufferLength );
    TstDeallocatePool( PrePrivileges, PrePrivilegesLength );
    TstDeallocatePool( PostPrivileges, PostPrivilegesLength );


    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Adjust Groups Test                                         //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenAdjustGroups()
{
    BOOLEAN CompletionStatus = TRUE;
    NTSTATUS Status;
    NTSTATUS IgnoreStatus;

    PTOKEN_GROUPS NewState;
    PTOKEN_GROUPS PreviousState;
    PTOKEN_GROUPS PreGroups;
    PTOKEN_GROUPS PostGroups;

    ULONG NewStateBufferLength = 600;
    ULONG PreviousStateBufferLength = 600;
    ULONG PreGroupsLength = 600;
    ULONG PostGroupsLength = 600;

    ULONG ReturnLength;
    ULONG IgnoreReturnLength;

    DbgPrint("\n");

    PreviousState = (PTOKEN_GROUPS)TstAllocatePool(
                        PagedPool,
                        PreviousStateBufferLength
                        );

    PreGroups = (PTOKEN_GROUPS)TstAllocatePool(
                        PagedPool,
                        PreGroupsLength
                        );

    PostGroups = (PTOKEN_GROUPS)TstAllocatePool(
                        PagedPool,
                        PostGroupsLength
                        );

    NewState = (PTOKEN_GROUPS)TstAllocatePool(
                   PagedPool,
                   NewStateBufferLength
                   );





    //////////////////////////////////////////////////////////////////////
    //                                                                  //
    // Adjust groups giving no instructions                             //
    //                                                                  //
    //////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     Adjust groups with no instructions ...                 ");

    Status = NtAdjustGroupsToken(
                 SimpleToken,                      // TokenHandle
                 FALSE,                            // ResetToDefault
                 NULL,                             // NewState (OPTIONAL)
                 0,                                // BufferLength
                 NULL,                             // PreviousState (OPTIONAL)
                 &ReturnLength                     // ReturnLength
                 );

    if (Status == STATUS_INVALID_PARAMETER) {

        DbgPrint("Succeeded. \n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_INVALID_PARAMETER);


/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable unknown group                                              //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable unknown group ...                              ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    if (IgnoreStatus != STATUS_SUCCESS) {
        DbgPrint(" \n IgnoreStatus = 0x%lx \n", IgnoreStatus);
        DbgPrint(" \n IgnoreReturnLength = 0x%lx \n", IgnoreReturnLength);
    }

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = RubbleSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable unknown group                                               //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable unknown group ...                               ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = RubbleSid;
    NewState->Groups[0].Attributes = OptionalGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable mandatory group                                            //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable mandatory group ...                            ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = WorldSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_CANT_DISABLE_MANDATORY) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_CANT_DISABLE_MANDATORY);




/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable mandatory group                                             //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable mandatory group ...                             ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = WorldSid;
    NewState->Groups[0].Attributes = OptionalGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength         // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable optional group                                             //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable optional group ...                             ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable already disabled group                                     //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable already disabled group ...                     ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = 0;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable optional group                                              //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable optional group ...                              ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = SE_GROUP_ENABLED;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable already enabled group                                       //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable already enabled group ...                       ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = SE_GROUP_ENABLED;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable optional and unknown group                                 //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable optional and unknown group ...                 ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 2;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[1].Sid = RubbleSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;
    NewState->Groups[1].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);




/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable optional and unknown group                                  //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable optional and unknown group ...                  ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 2;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[1].Sid = RubbleSid;
    NewState->Groups[0].Attributes = OptionalGroupAttributes;
    NewState->Groups[1].Attributes = OptionalGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_NOT_ALL_ASSIGNED) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_NOT_ALL_ASSIGNED);




/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable optional and mandatory group                               //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable optional and mandatory group ...               ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 2;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[1].Sid = WorldSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;
    NewState->Groups[1].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_CANT_DISABLE_MANDATORY) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_CANT_DISABLE_MANDATORY);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Enable optional and mandatory group                                //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Enable optional and mandatory group ...                ");

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
    ASSERT(Status == STATUS_SUCCESS);

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 2;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[1].Sid = WorldSid;
    NewState->Groups[0].Attributes = OptionalGroupAttributes;
    NewState->Groups[1].Attributes = OptionalGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



//////////////////////////////////////////////////////////////////////
//                                                                  //
// Disable optional group requesting previous state with            //
// insufficient buffer                                              //
//                                                                  //
//////////////////////////////////////////////////////////////////////


    DbgPrint("Se:     Too small buffer for previous state ...                ");


    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 1;
    NewState->Groups[0].Sid = ChildSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 0,                            // BufferLength
                 PreviousState,                // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_BUFFER_TOO_SMALL) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_BUFFER_TOO_SMALL);




/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Disable optional requesting previous state                         //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Disable optional, requesting previous state ...        ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    NewState->GroupCount = 2;
    NewState->Groups[0].Sid = NeandertholSid;
    NewState->Groups[1].Sid = ChildSid;
    NewState->Groups[0].Attributes = DisabledGroupAttributes;
    NewState->Groups[1].Attributes = DisabledGroupAttributes;
    PreviousState->GroupCount = 99;

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 NewState,                     // NewState (OPTIONAL)
                 PreviousStateBufferLength,    // BufferLength
                 PreviousState,                // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         ASSERT( PreviousState->GroupCount == 2 );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == DisabledGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)   &&
              (PreviousState->Groups[0].Attributes == OptionalGroupAttributes) &&
              (PreviousState->Groups[1].Attributes == OptionalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            DbgPrint("Previous count is: 0x%lx \n", PreviousState->GroupCount);
            DbgPrint("Previous state of group 0 is: 0x%lx \n",
                    PreviousState->Groups[0].Attributes);
            DbgPrint("Previous state of group 1 is: 0x%lx \n",
                    PreviousState->Groups[1].Attributes);


            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Return group to previous state                                     //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Return to previous state ...                           ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 PreviousState,                // NewState (OPTIONAL)
                 PreviousStateBufferLength,    // BufferLength
                 PreviousState,                // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)   &&
              (PreviousState->Groups[0].Attributes == DisabledGroupAttributes) &&
              (PreviousState->Groups[1].Attributes == DisabledGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Return to previous state again                                     //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Return to previous state again ...                     ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 PreviousState,                // NewState (OPTIONAL)
                 PreviousStateBufferLength,    // BufferLength
                 PreviousState,                // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == DisabledGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)   &&
              (PreviousState->Groups[0].Attributes == OptionalGroupAttributes) &&
              (PreviousState->Groups[1].Attributes == OptionalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);




/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Return to default state (capture previous state)                   //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Return to default state (w/previous state) ...         ");

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 TRUE,                         // ResetToDefault
                 NULL,                         // NewState (OPTIONAL)
                 PreviousStateBufferLength,    // BufferLength
                 PreviousState,                // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) return length: 0x%lx \n", ReturnLength);
#endif //TOKEN_DEBUG

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)   &&
              (PreviousState->Groups[0].Attributes == DisabledGroupAttributes) &&
              (PreviousState->Groups[1].Attributes == DisabledGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);



/////////////////////////////////////////////////////////////////////////
//                                                                     //
//  Return to default state  (don't capture previous state)            //
//                                                                     //
/////////////////////////////////////////////////////////////////////////

    DbgPrint("Se:     Return to default state (no previous state) ...        ");

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 FALSE,                        // ResetToDefault
                 PreviousState,                // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    ASSERT(Status == STATUS_SUCCESS);

    PreGroups->GroupCount = 77;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PreGroups,              // TokenInformation
                       PreGroupsLength,        // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(PreGroups->GroupCount == GROUP_COUNT );
    ASSERT(PreGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes);
    ASSERT(PreGroups->Groups[CHILD_INDEX].Attributes       == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[NEANDERTHOL_INDEX].Attributes == DisabledGroupAttributes);
    ASSERT(PreGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes);
    ASSERT(NT_SUCCESS(IgnoreStatus) );

    Status = NtAdjustGroupsToken(
                 TokenWithGroups,              // TokenHandle
                 TRUE,                         // ResetToDefault
                 NULL,                         // NewState (OPTIONAL)
                 0,                            // BufferLength
                 NULL,                         // PreviousState (OPTIONAL)
                 &ReturnLength                 // ReturnLength
                 );

    PostGroups->GroupCount = 88;
    IgnoreStatus = NtQueryInformationToken(
                       TokenWithGroups,        // TokenHandle
                       TokenGroups,            // TokenInformationClass
                       PostGroups,             // TokenInformation
                       PostGroupsLength,       // TokenInformationLength
                       &IgnoreReturnLength     // ReturnLength
                       );
#ifdef TOKEN_DEBUG
DbgPrint("\n (debug) ignore return length: 0x%lx \n", IgnoreReturnLength);
#endif //TOKEN_DEBUG

    ASSERT(NT_SUCCESS(IgnoreStatus) );

    if (Status == STATUS_SUCCESS) {

         //
         // Check the group values
         //

         ASSERT( PostGroups->GroupCount == GROUP_COUNT );
         if ( (PostGroups->Groups[FLINTSTONE_INDEX].Attributes  == OwnerGroupAttributes)    &&
              (PostGroups->Groups[CHILD_INDEX].Attributes       == OptionalGroupAttributes) &&
              (PostGroups->Groups[NEANDERTHOL_INDEX].Attributes == OptionalGroupAttributes) &&
              (PostGroups->Groups[WORLD_INDEX].Attributes       == NormalGroupAttributes)
         ) {

            DbgPrint("Succeeded. \n");

         } else {

            DbgPrint("********** Failed  Value Check ************\n");
            DbgPrint("Status is: 0x%lx \n", Status);

            DbgPrint("Before/after Flintstone state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[FLINTSTONE_INDEX].Attributes,
                    PostGroups->Groups[FLINTSTONE_INDEX].Attributes);

            DbgPrint("Before/after Child state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[CHILD_INDEX].Attributes,
                    PostGroups->Groups[CHILD_INDEX].Attributes);

            DbgPrint("Before/after Neanderthol state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[NEANDERTHOL_INDEX].Attributes,
                    PostGroups->Groups[NEANDERTHOL_INDEX].Attributes);

            DbgPrint("Before/after World state: 0x%lx / 0x%lx \n",
                    PreGroups->Groups[WORLD_INDEX].Attributes,
                    PostGroups->Groups[WORLD_INDEX].Attributes);

            DbgPrint("Return Length is: 0x%lx \n", ReturnLength);

            CompletionStatus = FALSE;

        }

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        DbgPrint("Return Length is: 0x%lx \n", ReturnLength);
        CompletionStatus = FALSE;

    }

    ASSERT(Status == STATUS_SUCCESS);




    ////////////////////////////////////////////////////////////////
    //                                                            //
    // Done with test                                             //
    //                                                            //
    ////////////////////////////////////////////////////////////////



    TstDeallocatePool( PreviousState, PreviousStateBufferLength );
    TstDeallocatePool( NewState, NewStateBufferLength );
    TstDeallocatePool( PreGroups, PreGroupsLength );
    TstDeallocatePool( PostGroups, PostGroupsLength );


    return CompletionStatus;
}


////////////////////////////////////////////////////////////////
//                                                            //
// Compare duplicate to original token & display test results //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestpCompareDuplicateToken(
    IN NTSTATUS Status,
    IN HANDLE OldToken,
    IN OBJECT_ATTRIBUTES NewAttributes,
    IN BOOLEAN EffectiveOnly,
    IN TOKEN_TYPE NewType,
    IN HANDLE NewToken
    )

{
    BOOLEAN CompletionStatus = TRUE;

    ULONG OldReturnLength;
    ULONG NewReturnLength;

    PTOKEN_USER OldUserId = NULL;
    PTOKEN_USER NewUserId = NULL;

    TOKEN_SOURCE OldSource;
    TOKEN_SOURCE NewSource;

    TOKEN_STATISTICS OldStatistics;
    TOKEN_STATISTICS NewStatistics;

    BOOLEAN SomeNotCompared = FALSE;


    //
    // Appease the compiler Gods
    //
    NewAttributes = NewAttributes;
    NewType = NewType;
    EffectiveOnly = EffectiveOnly;


    //
    // If the status isn't success, don't bother comparing the tokens
    //

    if (!NT_SUCCESS(Status)) {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        return FALSE;
    }

    //
    // Compare the user IDs
    //

    Status = NtQueryInformationToken(
                 OldToken,                 // Handle
                 TokenUser,                // TokenInformationClass
                 OldUserId,                // TokenInformation
                 0,                        // TokenInformationLength
                 &OldReturnLength          // ReturnLength
                 ); ASSERT(Status == STATUS_BUFFER_TOO_SMALL);
    OldUserId = (PTOKEN_USER)TstAllocatePool( PagedPool, OldReturnLength );

    Status = NtQueryInformationToken(
                 OldToken,                 // Handle
                 TokenUser,                // TokenInformationClass
                 OldUserId,                // TokenInformation
                 OldReturnLength,          // TokenInformationLength
                 &OldReturnLength          // ReturnLength
                 ); ASSERT(NT_SUCCESS(Status));


    Status = NtQueryInformationToken(
                 NewToken,                 // Handle
                 TokenUser,                // TokenInformationClass
                 NewUserId,                // TokenInformation
                 0,                        // TokenInformationLength
                 &NewReturnLength          // ReturnLength
                 ); ASSERT(Status == STATUS_BUFFER_TOO_SMALL);

    NewUserId = (PTOKEN_USER)TstAllocatePool( PagedPool, NewReturnLength );

    Status = NtQueryInformationToken(
                 NewToken,                 // Handle
                 TokenUser,                // TokenInformationClass
                 NewUserId,                // TokenInformation
                 NewReturnLength,          // TokenInformationLength
                 &NewReturnLength          // ReturnLength
                 ); ASSERT(NT_SUCCESS(Status));


    if ( !RtlEqualSid(OldUserId->User.Sid, NewUserId->User.Sid) ) {

        if (CompletionStatus) {
            DbgPrint("*** Failed Value Comparison ***\n");
        }
        DbgPrint("User IDs don't match.\n");
        CompletionStatus = FALSE;
    }

    TstDeallocatePool( OldUserId, OldReturnLength );
    TstDeallocatePool( NewUserId, NewReturnLength );


    //
    // Check the token statistics
    //

    if (CompletionStatus) {
        Status = NtQueryInformationToken(
                     OldToken,                        // Handle
                     TokenStatistics,                 // TokenInformationClass
                     &OldStatistics,                  // TokenInformation
                     (ULONG)sizeof(TOKEN_STATISTICS), // TokenInformationLength
                     &OldReturnLength                 // ReturnLength
                     ); ASSERT(NT_SUCCESS(Status));

        Status = NtQueryInformationToken(
                     NewToken,                        // Handle
                     TokenStatistics,                 // TokenInformationClass
                     &NewStatistics,                  // TokenInformation
                     (ULONG)sizeof(TOKEN_STATISTICS), // TokenInformationLength
                     &NewReturnLength                 // ReturnLength
                     ); ASSERT(NT_SUCCESS(Status));
        //
        // Must have:
        //             Different TokenId values
        //             Same authenticationId value
        //             Same ExpirationTime
        //             Same token type
        //             Same ImpersonationLevel (if correct token type)
        //             Same DynamicCharged & DynamicAvailable
        //
        // GroupCount and PrivilegeCount are deferred to the group and
        // privilege comparison due to the difficulty involved with
        // taking EffectiveOnly into account.
        //
        // The new token must have a ModifiedId that is the same as the
        // original.
        //

        //
        // Token ID
        //

        if ( (OldStatistics.TokenId.HighPart ==
              NewStatistics.TokenId.HighPart)    &&
             (OldStatistics.TokenId.LowPart ==
              NewStatistics.TokenId.LowPart)  ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       TokenIds are equal.\n");
            DbgPrint("       Old TokenId is: (0x%xl, 0x%xl)\n",
                            OldStatistics.TokenId.HighPart,
                            OldStatistics.TokenId.LowPart);
            DbgPrint("       New TokenId is: (0x%xl, 0x%xl)\n",
                            NewStatistics.TokenId.HighPart,
                            NewStatistics.TokenId.LowPart);
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }


        //
        // Authentication ID
        //

        if ( !RtlEqualLuid(&OldStatistics.AuthenticationId,
                           &NewStatistics.AuthenticationId) ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       AuthenticationIds are not equal.\n");
            DbgPrint("Original Authentication ID is: ");
            TestpPrintLuid(OldStatistics.AuthenticationId);
            DbgPrint("\n");
            DbgPrint("New Authentication ID is: ");
            TestpPrintLuid(NewStatistics.AuthenticationId);
            DbgPrint("\n");
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }

        //
        // ExpirationTime
        //

        if ( (OldStatistics.ExpirationTime.HighPart !=
              NewStatistics.ExpirationTime.HighPart)    ||
             (OldStatistics.ExpirationTime.LowPart !=
              NewStatistics.ExpirationTime.LowPart)  ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       ExpirationTimes differ.\n");
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }

        //
        // TokenType
        //

        if ( OldStatistics.TokenType != NewStatistics.TokenType ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       Token types are different.\n");
            DbgPrint("       Old token type is:  0x%lx \n", OldStatistics.TokenType );
            DbgPrint("       New token type is:  0x%lx \n", NewStatistics.TokenType );
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }

        //
        // ImpersonationLevel
        //

        if (NewStatistics.TokenType = TokenImpersonation) {
            if ( OldStatistics.ImpersonationLevel !=
                 NewStatistics.ImpersonationLevel ) {

                DbgPrint("*** Failed ***\n");
                DbgPrint("       Impersonation levels are different.\n");
                DbgPrint("       Old impersonation level  is:  0x%lx \n",
                                OldStatistics.ImpersonationLevel );
                DbgPrint("       New impersonation level is:  0x%lx \n",
                                NewStatistics.ImpersonationLevel );
                DbgPrint("       ");
                CompletionStatus = FALSE;
            }
        }

        //
        // DynamicCharged
        //

        if ( OldStatistics.DynamicCharged != NewStatistics.DynamicCharged ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       DynamicCharges are different.\n");
            DbgPrint("       Old value is:  0x%lx \n", OldStatistics.DynamicCharged );
            DbgPrint("       New value is:  0x%lx \n", NewStatistics.DynamicCharged );
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }

        //
        // DynamicAvailable
        //

        if ( OldStatistics.DynamicAvailable != NewStatistics.DynamicAvailable ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       DynamicAvailable are different.\n");
            DbgPrint("       Old value is:  0x%lx \n", OldStatistics.DynamicAvailable );
            DbgPrint("       New value is:  0x%lx \n", NewStatistics.DynamicAvailable );
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }


        //
        // ModifiedId
        //

        if ( (NewStatistics.ModifiedId.HighPart !=
              OldStatistics.ModifiedId.HighPart)   ||
             (NewStatistics.ModifiedId.LowPart  !=
              OldStatistics.ModifiedId.LowPart)     ) {

            DbgPrint("*** Failed ***\n");
            DbgPrint("       ModifiedIds different.\n");
            DbgPrint("       Old ModifiedId is: (0x%xl, 0x%xl)\n",
                            OldStatistics.ModifiedId.HighPart,
                            OldStatistics.ModifiedId.LowPart);
            DbgPrint("       New ModifiedId is: (0x%xl, 0x%xl)\n",
                            NewStatistics.ModifiedId.HighPart,
                            NewStatistics.ModifiedId.LowPart);
            DbgPrint("       ");
            CompletionStatus = FALSE;
        }

    }

    //
    // Compare the group IDs
    //

    SomeNotCompared = TRUE;

    //
    // Compare the privileges
    //

    SomeNotCompared = TRUE;

    //
    // Compare the owner IDs
    //

    SomeNotCompared = TRUE;

    //
    // Compare the primary group IDs
    //

    SomeNotCompared = TRUE;

    //
    // Compare the default dacls
    //

    SomeNotCompared = TRUE;

    //
    // Compare the token source
    //

    if (CompletionStatus) {
        Status = NtQueryInformationToken(
                     OldToken,                    // Handle
                     TokenSource,                 // TokenInformationClass
                     &OldSource,                  // TokenInformation
                     (ULONG)sizeof(TOKEN_SOURCE), // TokenInformationLength
                     &OldReturnLength             // ReturnLength
                     ); ASSERT(NT_SUCCESS(Status));

        Status = NtQueryInformationToken(
                     NewToken,                    // Handle
                     TokenSource,                 // TokenInformationClass
                     &NewSource,                  // TokenInformation
                     (ULONG)sizeof(TOKEN_SOURCE), // TokenInformationLength
                     &NewReturnLength             // ReturnLength
                     ); ASSERT(NT_SUCCESS(Status));

        if ( (OldSource.SourceIdentifier.HighPart ==
              NewSource.SourceIdentifier.HighPart)    &&
             (OldSource.SourceIdentifier.LowPart ==
              NewSource.SourceIdentifier.LowPart)  ) {
            if (  (OldSource.SourceName[0] != NewSource.SourceName[0])  ||
                  (OldSource.SourceName[1] != NewSource.SourceName[1])  ||
                  (OldSource.SourceName[2] != NewSource.SourceName[2])  ||
                  (OldSource.SourceName[3] != NewSource.SourceName[3])  ||
                  (OldSource.SourceName[4] != NewSource.SourceName[4])  ||
                  (OldSource.SourceName[5] != NewSource.SourceName[5])  ||
                  (OldSource.SourceName[6] != NewSource.SourceName[6])  ||
                  (OldSource.SourceName[7] != NewSource.SourceName[7])  ) {

                DbgPrint("*** Failed Value Comparison ***\n");
                DbgPrint("       SourceName changed.\n");
                CompletionStatus = FALSE;

            }
        } else {

            DbgPrint("*** Failed Value Comparison ***\n");
            DbgPrint("       SourceIdentifier changed.\n");
            DbgPrint("       Old SourceIdentifier is: (0x%xl, 0x%xl)\n",
                            OldSource.SourceIdentifier.HighPart,
                            OldSource.SourceIdentifier.LowPart);
            DbgPrint("       New SourceIdentifier is: (0x%xl, 0x%xl)\n",
                            NewSource.SourceIdentifier.HighPart,
                            NewSource.SourceIdentifier.LowPart);
            CompletionStatus = FALSE;

        }
    }

    ////////////////////////////////// Done /////////////////////////


    if (SomeNotCompared) {
        DbgPrint("Incomplete\n");
        DbgPrint("        Some fields not yet compared ...                       ");
    }

    if (CompletionStatus) {

        DbgPrint("Succeeded. \n");
    }

    return CompletionStatus;
}


////////////////////////////////////////////////////////////////
//                                                            //
// Duplicate Token Test                                       //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenDuplicate()
{
    BOOLEAN CompletionStatus = TRUE;

    BOOLEAN EffectiveOnly;
    TOKEN_TYPE NewType;
    HANDLE NewToken;

    OBJECT_ATTRIBUTES NewAttributes;

    SECURITY_QUALITY_OF_SERVICE ImpersonationLevel;
    SECURITY_QUALITY_OF_SERVICE IdentificationLevel;



    DbgPrint("\n");

    //
    // Initialize variables
    //

    ImpersonationLevel.Length = (ULONG)sizeof(SECURITY_QUALITY_OF_SERVICE);
    ImpersonationLevel.ImpersonationLevel = SecurityImpersonation;
    ImpersonationLevel.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    ImpersonationLevel.EffectiveOnly = FALSE;

    IdentificationLevel.Length = (ULONG)sizeof(SECURITY_QUALITY_OF_SERVICE);
    IdentificationLevel.ImpersonationLevel = SecurityImpersonation;
    IdentificationLevel.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    IdentificationLevel.EffectiveOnly = FALSE;


    InitializeObjectAttributes(
        &NewAttributes,
        NULL,
        OBJ_INHERIT,
        NULL,
        NULL
        );



    ////////////////////////////////////////////////////////////
    //                                                        //
    // Duplicate the simple token                             //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Duplicate primary token ...                            ");

    EffectiveOnly = FALSE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;

    Status = NtDuplicateToken(
                 SimpleToken,             // ExistingTokenHandle
                 0,                       // DesiredAccess
                 &NewAttributes,          // ObjectAttributes
                 EffectiveOnly,           // EffectiveOnly
                 NewType,                 // TokenType
                 &NewToken                // NewTokenHandle
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtClose( NewToken ); ASSERT(NT_SUCCESS(NewToken));

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        return FALSE;
    }



    ////////////////////////////////////////////////////////////
    //                                                        //
    // Duplicate the restricted token                         //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Duplicate restricted sids ...                          ");

    EffectiveOnly = FALSE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;

    Status = NtDuplicateToken(
                 TokenWithRestrictedSids, // ExistingTokenHandle
                 0,                       // DesiredAccess
                 &NewAttributes,          // ObjectAttributes
                 EffectiveOnly,           // EffectiveOnly
                 NewType,                 // TokenType
                 &NewToken                // NewTokenHandle
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtClose( NewToken ); ASSERT(NT_SUCCESS(NewToken));

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        return FALSE;
    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Duplicate the token with restricted groups             //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Duplicate restricted groups ...                          ");

    EffectiveOnly = TRUE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;

    Status = NtDuplicateToken(
                 TokenWithRestrictedSids, // ExistingTokenHandle
                 0,                       // DesiredAccess
                 &NewAttributes,          // ObjectAttributes
                 EffectiveOnly,           // EffectiveOnly
                 NewType,                 // TokenType
                 &NewToken                // NewTokenHandle
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtClose( NewToken ); ASSERT(NT_SUCCESS(NewToken));

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        return FALSE;
    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Duplicate the full impersonation token                 //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Duplicate full impersonation token ...                      ");

    EffectiveOnly = FALSE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;

    Status = NtDuplicateToken(
                 ImpersonationToken,       // ExistingTokenHandle
                 0,                        // DesiredAccess
                 &NewAttributes,           // ObjectAttributes
                 EffectiveOnly,            // EffectiveOnly
                 NewType,                  // TokenType
                 &NewToken                 // NewTokenHandle
                 );
    //
    // Check to see that the duplicate is really a duplicate of
    // the original and display the test results.
    //

    if (!TestpCompareDuplicateToken( Status,
                                     ImpersonationToken,
                                     NewAttributes,
                                     EffectiveOnly,
                                     NewType,
                                     NewToken ) ) {

        CompletionStatus = FALSE;
    }

    if (NT_SUCCESS(Status)) {

        Status = NtClose( NewToken );

        ASSERT(NT_SUCCESS(Status));
    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Duplicate the full token, effective only               //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Duplicate full token, effective only ...                    ");

    EffectiveOnly = TRUE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;

    Status = NtDuplicateToken(
                 ImpersonationToken,       // ExistingTokenHandle
                 0,                        // DesiredAccess
                 &NewAttributes,           // ObjectAttributes
                 EffectiveOnly,            // EffectiveOnly
                 NewType,                  // TokenType
                 &NewToken                 // NewTokenHandle
                 );
    //
    // Check to see that the duplicate is really a duplicate of
    // the original and display the test results.
    //

    if (!TestpCompareDuplicateToken( Status,
                                     ImpersonationToken,
                                     NewAttributes,
                                     EffectiveOnly,
                                     NewType,
                                     NewToken ) ) {

        CompletionStatus = FALSE;
    }

    if (NT_SUCCESS(Status)) {

        Status = NtClose( NewToken );

        ASSERT(NT_SUCCESS(Status));
    }










    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Assign Primary Token Test                                  //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenAssignPrimary()
{
    BOOLEAN CompletionStatus = TRUE;
    ULONG ReturnLength;

    TOKEN_STATISTICS OriginalTokenStatistics;
    TOKEN_STATISTICS NewTokenStatistics;
    TOKEN_STATISTICS AssignedTokenStatistics;


    TOKEN_USER UserId;
    TOKEN_PRIMARY_GROUP PrimaryGroup;
    PTOKEN_GROUPS GroupIds;
    PTOKEN_PRIVILEGES Privileges;
    TOKEN_DEFAULT_DACL DefaultDacl;
    TOKEN_OWNER Owner;

    PROCESS_ACCESS_TOKEN PrimaryTokenInfo;

    DbgPrint("\n");


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Assign a valid primary token                           //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Assign new primary token ...                           ");

    //
    // Get information about the current token
    //

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 TOKEN_ALL_ACCESS,
                 &ProcessToken
                 );
    ASSERT (NT_SUCCESS(Status));

    Status = NtQueryInformationToken(
                 ProcessToken,                 // Handle
                 TokenStatistics,              // TokenInformationClass
                 &OriginalTokenStatistics,     // TokenInformation
                 sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                 &ReturnLength                 // ReturnLength
                 );
    ASSERT(NT_SUCCESS(Status));




    //
    // Create a token with default DACL for use
    //

    GroupIds = (PTOKEN_GROUPS)TstAllocatePool( PagedPool,
                                               GROUP_IDS_LENGTH
                                               );

    Privileges = (PTOKEN_PRIVILEGES)TstAllocatePool( PagedPool,
                                                     PRIVILEGES_LENGTH
                                                     );

    DefaultDacl.DefaultDacl = (PACL)TstAllocatePool( PagedPool,
                                                     DEFAULT_DACL_LENGTH
                                                     );

    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[SYSTEM_INDEX].Sid      = LocalSystemSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[SYSTEM_INDEX].Attributes      = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    Status = RtlCreateAcl( DefaultDacl.DefaultDacl, DEFAULT_DACL_LENGTH, ACL_REVISION);

    ASSERT(NT_SUCCESS(Status) );

    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &PrimaryTokenAttributes,  // ObjectAttributes
                 TokenPrimary,             // TokenType
                 &SystemAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 &DefaultDacl,             // Default Dacl
                 &TestSource               // TokenSource
                 );
    ASSERT(NT_SUCCESS(Status));

    //
    // Make sure key data is different than what is already on the process.
    //

    Status = NtQueryInformationToken(
                 Token,                        // Handle
                 TokenStatistics,              // TokenInformationClass
                 &NewTokenStatistics,          // TokenInformation
                 sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                 &ReturnLength                 // ReturnLength
                 );
    ASSERT(NT_SUCCESS(Status));

    ASSERT( (OriginalTokenStatistics.TokenId.HighPart !=
             NewTokenStatistics.TokenId.HighPart)  ||
            (OriginalTokenStatistics.TokenId.LowPart !=
             NewTokenStatistics.TokenId.LowPart)        );



    //
    // Assign the new token
    //

    PrimaryTokenInfo.Token  = Token;
    PrimaryTokenInfo.Thread = NtCurrentThread();
    Status = NtSetInformationProcess(
                 NtCurrentProcess(),
                 ProcessAccessToken,
                 (PVOID)&PrimaryTokenInfo,
                 (ULONG)sizeof(PROCESS_ACCESS_TOKEN)
                 );

    if (!NT_SUCCESS(Status)) {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    } else {

        Status = NtClose( Token );
        ASSERT(NT_SUCCESS(Status));


        //
        // Get information about the assigned token
        //

        Status = NtOpenProcessToken(
                     NtCurrentProcess(),
                     TOKEN_QUERY | TOKEN_QUERY_SOURCE,
                     &Token
                     );
        ASSERT (NT_SUCCESS(Status));

        Status = NtQueryInformationToken(
                     Token,                        // Handle
                     TokenStatistics,              // TokenInformationClass
                     &AssignedTokenStatistics,     // TokenInformation
                     sizeof(TOKEN_STATISTICS),     // TokenInformationLength
                     &ReturnLength                 // ReturnLength
                     );
        ASSERT(NT_SUCCESS(Status));

        Status = NtClose( Token );
        ASSERT(NT_SUCCESS(Status));


        //
        // Information about assigned token and the new token
        // should be the same
        //

        ASSERT(AssignedTokenStatistics.TokenType == TokenPrimary);

        if ( (NewTokenStatistics.TokenId.HighPart ==
              AssignedTokenStatistics.TokenId.HighPart)  &&
             (NewTokenStatistics.TokenId.LowPart ==
              AssignedTokenStatistics.TokenId.LowPart) ) {

            DbgPrint("Succeeded.\n");

        } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Token ID mismatch.\n");
        DbgPrint("New token ID is:      (0x%lx, 0x%lx) \n",
                 NewTokenStatistics.TokenId.HighPart,
                 NewTokenStatistics.TokenId.LowPart);
        DbgPrint("Assigned token ID is: (0x%lx, 0x%lx) \n",
                 AssignedTokenStatistics.TokenId.HighPart,
                 AssignedTokenStatistics.TokenId.LowPart);
        CompletionStatus = FALSE;

        }
    }

    //
    // Change back to the original token
    //

    PrimaryTokenInfo.Token  = ProcessToken;
    PrimaryTokenInfo.Thread = NtCurrentThread();
    Status = NtSetInformationProcess(
                 NtCurrentProcess(),
                 ProcessAccessToken,
                 (PVOID)&PrimaryTokenInfo,
                 (ULONG)sizeof(PROCESS_ACCESS_TOKEN)
                 );

    ASSERT(NT_SUCCESS(Status));
    Status = NtClose( ProcessToken );
    ASSERT(NT_SUCCESS(Status));


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Attempt to assign an impersonation token as primary    //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Assign impersonation token as primary ...              ");


    //
    // Create an impersonation token
    //
    GroupIds->GroupCount = GROUP_COUNT;

    GroupIds->Groups[FLINTSTONE_INDEX].Sid  = FlintstoneSid;
    GroupIds->Groups[CHILD_INDEX].Sid       = ChildSid;
    GroupIds->Groups[NEANDERTHOL_INDEX].Sid = NeandertholSid;
    GroupIds->Groups[WORLD_INDEX].Sid       = WorldSid;

    GroupIds->Groups[FLINTSTONE_INDEX].Attributes  = OwnerGroupAttributes;
    GroupIds->Groups[CHILD_INDEX].Attributes       = OptionalGroupAttributes;
    GroupIds->Groups[NEANDERTHOL_INDEX].Attributes = OptionalGroupAttributes;
    GroupIds->Groups[WORLD_INDEX].Attributes       = NormalGroupAttributes;

    UserId.User.Sid = PebblesSid;
    UserId.User.Attributes = 0;

    Owner.Owner = FlintstoneSid;

    Privileges->PrivilegeCount = PRIVILEGE_COUNT;

    Privileges->Privileges[UNSOLICITED_INDEX].Luid = UnsolicitedInputPrivilege;
    Privileges->Privileges[SECURITY_INDEX].Luid = SecurityPrivilege;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Luid = AssignPrimaryTokenPrivilege;
    Privileges->Privileges[UNSOLICITED_INDEX].Attributes = 0;
    Privileges->Privileges[SECURITY_INDEX].Attributes = 0;
    Privileges->Privileges[ASSIGN_PRIMARY_INDEX].Attributes = SE_PRIVILEGE_ENABLED;

    PrimaryGroup.PrimaryGroup = FlintstoneSid;

    Status = RtlCreateAcl( DefaultDacl.DefaultDacl, DEFAULT_DACL_LENGTH, ACL_REVISION);

    ASSERT(NT_SUCCESS(Status) );

    Status = NtCreateToken(
                 &Token,                   // Handle
                 (TOKEN_ALL_ACCESS),       // DesiredAccess
                 &ImpersonationTokenAttributes,  // ObjectAttributes
                 TokenImpersonation,       // TokenType
                 &OriginalAuthenticationId,   // Authentication LUID
                 &NoExpiration,            // Expiration Time
                 &UserId,                  // Owner ID
                 GroupIds,                 // Group IDs
                 Privileges,               // Privileges
                 &Owner,                   // Owner
                 &PrimaryGroup,            // Primary Group
                 &DefaultDacl,             // Default Dacl
                 &TestSource               // TokenSource
                 );
    ASSERT(NT_SUCCESS(Status));

    //
    // Assign the new token
    //

    PrimaryTokenInfo.Token  = Token;
    PrimaryTokenInfo.Thread = NtCurrentThread();
    Status = NtSetInformationProcess(
                 NtCurrentProcess(),
                 ProcessAccessToken,
                 (PVOID)&PrimaryTokenInfo,
                 (ULONG)sizeof(PROCESS_ACCESS_TOKEN)
                 );

    if (Status == STATUS_BAD_TOKEN_TYPE) {

        DbgPrint("Succeeded.\n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }

    Status = NtClose( Token );
    ASSERT(NT_SUCCESS(Status));


    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Impersonation Test  (with open test)                       //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
TestTokenImpersonation()
{
    BOOLEAN CompletionStatus = TRUE;

    HANDLE OpenedToken;
    HANDLE NewToken;
    OBJECT_ATTRIBUTES NewAttributes;
    TOKEN_TYPE NewType;
    BOOLEAN EffectiveOnly = FALSE;

    SECURITY_QUALITY_OF_SERVICE ImpersonationLevel;



    DbgPrint("\n");


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Terminate impersonation using NtSetInformationThread() //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Revert to self (specify NULL handle) ...               ");

    NewToken = NULL;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Attempt to assign a primary token as an impersonation  //
    // token.                                                 //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Assigning primary token as impersonation token ...     ");

    NewToken = TokenWithGroups;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );

    if (Status == STATUS_BAD_TOKEN_TYPE) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Assign a valid impersonation token                     //
    //                                                        //
    ////////////////////////////////////////////////////////////

    DbgPrint("Se:     Assign valid impersonation token ...                   ");

    NewToken = ImpersonationToken;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Open the impersonation token                           //
    //                                                        //
    ////////////////////////////////////////////////////////////


    DbgPrint("Se:     Open an impersonation token ...                        ");

    Status = NtOpenThreadToken(
                 NtCurrentThread(),
                 TOKEN_ALL_ACCESS,
                 TRUE,
                 &OpenedToken
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
        Status = NtClose( OpenedToken );
        ASSERT(NT_SUCCESS(Status));
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }



    ////////////////////////////////////////////////////////////
    //                                                        //
    // Open a non-existent impersonation token                //
    //                                                        //
    ////////////////////////////////////////////////////////////


    DbgPrint("Se:     Open a non-existent impersonation token ...            ");

    //
    // Clear any existing impersonation token.
    //

    NewToken = NULL;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));

    Status = NtOpenThreadToken(
                 NtCurrentThread(),
                 TOKEN_ALL_ACCESS,
                 TRUE,
                 &OpenedToken
                 );

    if (Status == STATUS_NO_TOKEN) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Open an anonymous   impersonation token                //
    //                                                        //
    ////////////////////////////////////////////////////////////


    DbgPrint("Se:     Open an anonymous impersonation token ...              ");

    //
    //  Assign an anonymous impersonation token
    //

    NewToken = AnonymousToken;
    Status = NtSetInformationThread(
                 ThreadHandle,
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));


    Status = NtOpenThreadToken(
                 ThreadHandle,
                 TOKEN_ALL_ACCESS,
                 TRUE,
                 &OpenedToken
                 );

    if (Status == STATUS_CANT_OPEN_ANONYMOUS) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }


    ////////////////////////////////////////////////////////////
    //                                                        //
    // Change the impersonation of a thread                   //
    //                                                        //
    ////////////////////////////////////////////////////////////


    DbgPrint("Se:     Change the impersonation token ...                     ");

    NewToken = NULL;
    Status = NtSetInformationThread(
                 ThreadHandle,
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));

    NewToken = AnonymousToken;
    Status = NtSetInformationThread(
                 ThreadHandle,
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));

    NewToken = ImpersonationToken;
    Status = NtSetInformationThread(
                 ThreadHandle,
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }

    ////////////////////////////////////////////////////////////
    //                                                        //
    // Impersonate a restricted token                         //
    //                                                        //
    ////////////////////////////////////////////////////////////


    DbgPrint("Se:     Impersonate restricted token ...                      ");

    NewToken = NULL;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));




    //
    // Initialize variables
    //

    InitializeObjectAttributes(
        &NewAttributes,
        NULL,
        OBJ_INHERIT,
        NULL,
        NULL
        );


    ImpersonationLevel.Length = (ULONG)sizeof(SECURITY_QUALITY_OF_SERVICE);
    ImpersonationLevel.ImpersonationLevel = SecurityImpersonation;
    ImpersonationLevel.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    ImpersonationLevel.EffectiveOnly = FALSE;
    NewType = TokenImpersonation;
    NewAttributes.SecurityQualityOfService = &ImpersonationLevel;


    Status = NtDuplicateToken(
                 TokenWithRestrictedSids, // ExistingTokenHandle
                 TOKEN_ALL_ACCESS,        // DesiredAccess
                 &NewAttributes,          // ObjectAttributes
                 EffectiveOnly,           // EffectiveOnly
                 NewType,                 // TokenType
                 &NewToken                // NewTokenHandle
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));

    //
    // Now try to open something, like the process, which should fail
    //

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 TOKEN_QUERY | TOKEN_QUERY_SOURCE,
                 &Token
                 );
    if (Status != STATUS_ACCESS_DENIED) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 MAXIMUM_ALLOWED,
                 &Token
                 );
    if (Status != STATUS_ACCESS_DENIED) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    Status = NtDuplicateToken(
                 TokenWithMoreRestrictedSids, // ExistingTokenHandle
                 TOKEN_ALL_ACCESS,        // DesiredAccess
                 &NewAttributes,          // ObjectAttributes
                 EffectiveOnly,           // EffectiveOnly
                 NewType,                 // TokenType
                 &NewToken                // NewTokenHandle
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");

    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );  ASSERT(NT_SUCCESS(Status));


    //
    // Now try to open something, like the process, which should succeed
    //

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 TOKEN_QUERY | TOKEN_QUERY_SOURCE,
                 &Token
                 );
    if (Status != STATUS_SUCCESS) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    Status = NtOpenProcessToken(
                 NtCurrentProcess(),
                 MAXIMUM_ALLOWED,
                 &Token
                 );
    if (Status != STATUS_SUCCESS) {
        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;
    }

    NewToken = NULL;
    Status = NtSetInformationThread(
                 NtCurrentThread(),
                 ThreadImpersonationToken,
                 (PVOID)&NewToken,
                 (ULONG)sizeof(HANDLE)
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("Succeeded.\n");
    } else {

        DbgPrint("********** Failed ************\n");
        DbgPrint("Status is: 0x%lx \n", Status);
        CompletionStatus = FALSE;

    }

    Status = NtTerminateThread(
                 ThreadHandle,
                 (NTSTATUS)0
                 );

    ASSERT(NT_SUCCESS(Status));

    return CompletionStatus;
}

////////////////////////////////////////////////////////////////
//                                                            //
// Main Program Entry                                         //
//                                                            //
////////////////////////////////////////////////////////////////

BOOLEAN
CTToken()      // Common Test for Token object
{
    BOOLEAN Result = TRUE;

    DbgPrint("Se:   Initialization...");
    TestTokenInitialize();

    DbgPrint("Se:   Token Creation Test...                                 Test");
    if (!TestTokenCreate()) { Result = FALSE; }

    DbgPrint("Se:   Token Filtering Test...                                Test");
    if (!TestTokenFilter()) { Result = FALSE; }

    DbgPrint("Se:   Token Open Test (with primary token)...                Test");
    if (!TestTokenOpenPrimary()) { Result = FALSE; }

    DbgPrint("Se:   Token Query Test...                                    Test");
    if (!TestTokenQuery()) { Result = FALSE; }

    DbgPrint("Se:   Token Set Test...                                      Test");
    if (!TestTokenSet()) { Result = FALSE; }

    DbgPrint("Se:   Token Adjust Privileges Test...                        Test");
    if (!TestTokenAdjustPrivileges()) {Result = FALSE; }

    DbgPrint("Se:   Token Adjust Group Test...                             Test");
    if (!TestTokenAdjustGroups()) { Result = FALSE; }

    DbgPrint("Se:   Token Duplication Test...                              Test");
    if (!TestTokenDuplicate()) { Result = FALSE; }

    DbgPrint("Se:   Primary Token Assignment Test...                       Test");
    if (!TestTokenAssignPrimary()) { Result = FALSE; }

    DbgPrint("Se:   Impersonation Test (and impersonation open)...         Test");
    if (!TestTokenImpersonation()) { Result = FALSE; }


    DbgPrint("\n");
    DbgPrint("\n");
    DbgPrint("    ********************\n");
    DbgPrint("    **                **\n");
    if (Result) {
        DbgPrint("Se: ** Test Succeeded **\n");
    } else {
        DbgPrint("Se: **  Test Failed   **\n");
    }

    DbgPrint("    **                **\n");
    DbgPrint("    ********************\n");
    DbgPrint("\n");
    DbgPrint("\n");

    return Result;
}