windows-server-2003/ds/security/dsrole/client/rpcapi.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    rpcapi.c

Abstract:

    This module contains the routines for the dssetup APIs that use RPC.  The
    routines in this module are merely wrappers that work as follows:

    Fuke copied lsa\uclient and hacked on to make it work for DsRole apis

Author:

    Mac McLain     (MacM)    April 14, 1997

Revision History:

--*/

#include <lsacomp.h>
#include "dssetup_c.h"
#include <rpcndr.h>
#include <dssetp.h>
#include <winreg.h>
#include <rpcasync.h>

#include <wxlpc.h>
#include <crypt.h>
#include <rc4.h>
#include <md5.h>
#include <winbase.h> //for RtlSecureZeroMemory

//
// Local prototypes
//
DWORD
DsRolepGetPrimaryDomainInformationDownlevel(
    IN LPWSTR Server,
    OUT PBYTE *Buffer
    );

DWORD
DsRolepGetProductTypeForServer(
    IN LPWSTR Server,
    IN OUT PNT_PRODUCT_TYPE ProductType
    );


DWORD
DsRolepEncryptPasswordStart(
    IN LPCWSTR ServerName OPTIONAL,
    IN LPCWSTR *Passwords,
    IN ULONG   Count,
    OUT RPC_BINDING_HANDLE *RpcBindingHandle,
    OUT HANDLE *RedirHandle,
    OUT OPTIONAL PUSER_SESSION_KEY UserSessionKey,
    IN OUT PDSROLEPR_ENCRYPTED_USER_PASSWORD *EncryptedUserPassword
    );

VOID
DsRolepEncryptPasswordEnd(
    IN RPC_BINDING_HANDLE RpcBindingHandle,
    IN HANDLE RedirHandle OPTIONAL,
    IN PDSROLEPR_ENCRYPTED_USER_PASSWORD *EncryptedUserPassword OPTIONAL,
    IN ULONG Count
    );

DWORD
DsRolepHashkey(
    IN OUT LPWSTR key,
    OUT PUNICODE_STRING Hash
    );

DWORD
DsRolepEncryptHash(
    IN PUSER_SESSION_KEY UserSessionKey,
    IN OUT PUNICODE_STRING Syskey,
    OUT PDSROLEPR_ENCRYPTED_HASH EncryptedSyskey
    );

////////////////////////////////////////////////////////////////////////////
//                                                                        //
// DS Setup and initialization routines                                   //
//                                                                        //
////////////////////////////////////////////////////////////////////////////

BOOLEAN
DsRolepIsSetupRunning(
    VOID
    )
/*++

Routine Description:

    This routine determines if this call is being made during setup or not

Arguments:

    VOID

Return Value:

    TRUE -- The call is being made during setup

    FALSE -- The call is not being made during setup

--*/
{
    NTSTATUS Status;
    HANDLE InstallationEvent;
    OBJECT_ATTRIBUTES EventAttributes;
    UNICODE_STRING EventName;
    BOOLEAN Setup = FALSE;

    //
    // If the following event exists, then we are in setup mode
    //
    RtlInitUnicodeString( &EventName,
                          L"\\INSTALLATION_SECURITY_HOLD" );
    InitializeObjectAttributes( &EventAttributes,
                                &EventName, 0, 0, NULL );

    Status = NtOpenEvent( &InstallationEvent,
                          SYNCHRONIZE,
                          &EventAttributes );

    if ( NT_SUCCESS( Status) ) {

        NtClose( InstallationEvent );
        Setup = TRUE;

    }

    return( Setup );
}


DWORD
DsRolepGetPrimaryDomainInfoServerBind(
    IN OPTIONAL PDSROLE_SERVER_NAME   ServerName,
    OUT handle_t *BindHandle
    )
/*++

Routine Description:

    This routine is called from the LSA client stubs when
    it is necessary to bind to the LSA on some server.

Arguments:

    ServerName - A pointer to a string containing the name of the server
        to bind with.

Return Value:

    The binding handle is returned to the stub routine.  If the
    binding is unsuccessful, a NULL will be returned.

--*/
{
    handle_t    BindingHandle = NULL;
    NTSTATUS Status;
    
    //
    // Can't go remote when running in setup mode
    //
    if ( DsRolepIsSetupRunning() && ServerName != NULL ) {

        return( STATUS_INVALID_SERVER_STATE );
    }

    Status = RpcpBindRpc ( ServerName,
                           L"lsarpc",
                           0,
                           &BindingHandle );

    if (!NT_SUCCESS(Status)) {

        DbgPrint("DsRolepGetPrimaryDomainInfoServerBind: RpcpBindRpc failed 0x%lx\n", Status);

    } else {

        *BindHandle = BindingHandle;
    }

    return RtlNtStatusToDosError( Status );

}


DWORD
DsRolepServerBind(
    IN OPTIONAL PDSROLE_SERVER_NAME   ServerName,
    OUT handle_t *BindHandle
    )
/*++

Routine Description:

    This routine is called from the LSA client stubs when
    it is necessary to bind to the LSA on some server.

Arguments:

    ServerName - A pointer to a string containing the name of the server
        to bind with.

Return Value:

    The binding handle is returned to the stub routine.  If the
    binding is unsuccessful, a NULL will be returned.

--*/
{
    handle_t    BindingHandle      = NULL;
    DWORD       Win32Err           = ERROR_SUCCESS;
    WCHAR       *pwszStringBinding = NULL;
    BOOL        fAuth              = TRUE;

    //
    // Can't go remote when running in setup mode
    //
    if ( DsRolepIsSetupRunning() && ServerName != NULL ) {

        return( STATUS_INVALID_SERVER_STATE );
    }

    RpcTryExcept
    {
        Win32Err = RpcStringBindingComposeW(NULL,
                                            L"ncalrpc",
                                            NULL,
                                            L"dsrole",
                                            NULL,
                                            &pwszStringBinding);

        if (RPC_S_OK != Win32Err) {
            __leave;
        }

        Win32Err = RpcBindingFromStringBindingW(pwszStringBinding, 
                                                &BindingHandle);
        if (RPC_S_OK != Win32Err) {
            __leave;
        }


        Win32Err = RpcEpResolveBinding(BindingHandle, 
                                       dsrole_ClientIfHandle);
        
        if ( RPC_S_OK != Win32Err ) {
            __leave;
        }

        // Set authentication info using our process's credentials.

        Win32Err = RpcBindingSetAuthInfo(BindingHandle,
                                         NULL,
                                         /*Uses the default authentication 
                                         level for the specified 
                                         authentication service.*/
                                         RPC_C_AUTHN_LEVEL_DEFAULT,
                                         /*RPC_C_AUTHN_DEFAULT is specified, 
                                         the RPC run-time library uses 
                                         the RPC_C_AUTHN_WINNT authentication 
                                         service for remote procedure calls 
                                         made using hBinding */
                                         RPC_C_AUTHN_DEFAULT,
                                         NULL,
                                         //Default authentication service.
                                         RPC_C_AUTHN_DEFAULT);
        if (RPC_S_OK != Win32Err) {
            __leave;
        }
    
        
    }
    RpcExcept( I_RpcExceptionFilter( RpcExceptionCode() ) )
    {
        Win32Err = RpcExceptionCode();        
    }
    RpcEndExcept;

    if ( RPC_S_OK == Win32Err ) {

        *BindHandle = BindingHandle;

    } else {

        if (BindingHandle) {

            RpcpUnbindRpc ( BindingHandle );

        }

    }

    if ( pwszStringBinding )
    {
        RpcStringFree(&pwszStringBinding);
    }

    return( Win32Err );

}



VOID
DsRolepServerUnbind (
    IN OPTIONAL PDSROLE_SERVER_NAME  ServerName,
    IN handle_t           BindingHandle
    )

/*++

Routine Description:

    This routine is called from the LSA client stubs when
    it is necessary to unbind from the LSA server.


Arguments:

    ServerName - This is the name of the server from which to unbind.

    BindingHandle - This is the binding handle that is to be closed.

Return Value:

    none.

--*/
{
    UNREFERENCED_PARAMETER( ServerName );     // This parameter is not used

    RpcpUnbindRpc ( BindingHandle );
    return;
}



DWORD
DsRolepApiReturnResult(
    ULONG ExceptionCode
    )

/*++

Routine Description:

    This function converts an exception code or status value returned
    from the client stub to a value suitable for return by the API to
    the client.

Arguments:

    ExceptionCode - The exception code to be converted.

Return Value:

    DWORD - The converted Nt Status code.

--*/

{
    //
    // Return the actual value if compatible with Nt status codes,
    // otherwise, return STATUS_UNSUCCESSFUL.
    //
    NTSTATUS Status;
    DWORD Results;

    if ( !NT_SUCCESS( ( NTSTATUS )ExceptionCode ) ) {

        Results = RtlNtStatusToDosError( ( NTSTATUS )ExceptionCode );

    } else {

        Results = ExceptionCode;
    }

    return( Results );
}



VOID
WINAPI
DsRoleFreeMemory(
    IN PVOID    Buffer
    )
/*++

Routine Description:


    Some setup services that return a potentially large amount of memory,
    such as an enumeration might, allocate the buffer in which the data
    is returned.  This function is used to free those buffers when they
    are no longer needed.

Parameters:

    Buffer - Pointer to the buffer to be freed.  This buffer must
        have been allocated by a previous dssetup service call.

Return Values:

    STATUS_SUCCESS - normal, successful completion.

--*/
{
    MIDL_user_free( Buffer );
}



DWORD
WINAPI
DsRoleDnsNameToFlatName(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  LPCWSTR lpDnsName,
    OUT LPWSTR *lpFlatName,
    OUT PULONG  lpStatusFlag
    )
/*++

Routine Description:

    This routine will get the default NetBIOS (or flat) domain name for the given Dns domain name

Arguments:

    lpServer - Server on which to remote the call (NULL is local)

    lpDnsName - Dns domain name to generate the flat name for

    lpFlatName - Where the flat name is returned. Must be freed via MIDL_user_free
        (or DsRoleFreeMemory)

    lpStatusFlag - Flags that indicate information about the returned name.  Valid flags are:
        DSROLE_FLATNAME_DEFAULT -- This is the default NetBIOS name for this dns domain name
        DSROLE_FLATNAME_UPGRADE -- This is the name that is current in use by this machine as
            a flat name and cannot be changed.

Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        *lpFlatName = NULL;
        *lpStatusFlag = 0;

        Win32Err = DsRolerDnsNameToFlatName(
                         Handle,
                         ( LPWSTR )lpDnsName,
                         lpFlatName,
                         lpStatusFlag );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleDcAsDc(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  LPCWSTR lpDnsDomainName,
    IN  LPCWSTR lpFlatDomainName,
    IN  LPCWSTR lpDomainAdminPassword OPTIONAL,
    IN  LPCWSTR lpSiteName OPTIONAL,
    IN  LPCWSTR lpDsDatabasePath,
    IN  LPCWSTR lpDsLogPath,
    IN  LPCWSTR lpSystemVolumeRootPath,
    IN  LPCWSTR lpParentDnsDomainName OPTIONAL,
    IN  LPCWSTR lpParentServer OPTIONAL,
    IN  LPCWSTR lpAccount OPTIONAL,
    IN  LPCWSTR lpPassword OPTIONAL,
    IN  LPCWSTR lpDsRepairPassword OPTIONAL,
    IN  ULONG Options,
    OUT DSROLE_SERVEROP_HANDLE *DsOperationHandle
    )
/*++

Routine Description:

    This routine will get the promote a server to be a DC in a domain

Arguments:

    lpServer - Server on which to remote the call (NULL is local)

    lpDnsDomainName - Dns domain name of the domain to install

    lpFlatDomainName - NetBIOS domain name of the domain to install

    lpDomainAdminPassword - Password to set on the administrator account if it is a new install

    SiteName - Name of the site this DC should belong to

    lpDsDatabasePath - Absolute path on the local machine where the Ds DIT should go

    lpDsLogPath - Absolute path on the local machine where the Ds log files should go

    lpSystemVolumeRootPath - Absolute path on the local machine which will be the root of
        the system volume.

    lpParentDnsDomainName - Optional.  If present, set this domain up as a child of the
        specified domain

    lpParentServer - Optional.  If present, use this server in the parent domain to replicate
        the required information from

    lpAccount - User account to use when setting up as a child domain

    lpPassword - Password to use with the above account
    
    lpDsRepairPassword - Password to use for the admin account of the repair mode

    Options - Options to control the creation of the domain

    DsOperationHandle - Handle to the operation is returned here.

Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;
    HANDLE RedirHandle = NULL;

#define DSROLEP_DC_AS_DC_DA_PWD_INDEX        0
#define DSROLEP_DC_AS_DC_PWD_INDEX           1
#define DSROLEP_DC_AS_DC_DS_REPAIR_PWD_INDEX 2
#define DSROLEP_DC_AS_DC_MAX_PWD_COUNT       3

    PDSROLEPR_ENCRYPTED_USER_PASSWORD EncryptedPasswords[DSROLEP_DC_AS_DC_MAX_PWD_COUNT];
    LPCWSTR Passwords[DSROLEP_DC_AS_DC_MAX_PWD_COUNT];

    Passwords[DSROLEP_DC_AS_DC_DA_PWD_INDEX]        = lpDomainAdminPassword;
    Passwords[DSROLEP_DC_AS_DC_PWD_INDEX]           = lpPassword;
    Passwords[DSROLEP_DC_AS_DC_DS_REPAIR_PWD_INDEX] = lpDsRepairPassword;
    
    RtlZeroMemory( EncryptedPasswords, sizeof(EncryptedPasswords) );

    Win32Err = DsRolepEncryptPasswordStart( lpServer,
                                            Passwords,
                                            NELEMENTS(Passwords),
                                            &Handle,
                                            &RedirHandle,
                                            NULL,
                                            EncryptedPasswords );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }


    RpcTryExcept {

        Win32Err = DsRolerDcAsDc( Handle,
                                  ( LPWSTR )lpDnsDomainName,
                                  ( LPWSTR )lpFlatDomainName,
                                  EncryptedPasswords[DSROLEP_DC_AS_DC_DA_PWD_INDEX],
                                  ( LPWSTR )lpSiteName,
                                  ( LPWSTR )lpDsDatabasePath,
                                  ( LPWSTR )lpDsLogPath,
                                  ( LPWSTR )lpSystemVolumeRootPath,
                                  ( LPWSTR )lpParentDnsDomainName,
                                  ( LPWSTR )lpParentServer,
                                  ( LPWSTR )lpAccount,
                                  EncryptedPasswords[DSROLEP_DC_AS_DC_PWD_INDEX],
                                  EncryptedPasswords[DSROLEP_DC_AS_DC_DS_REPAIR_PWD_INDEX],
                                  Options,
                                  ( PDSROLER_HANDLE )DsOperationHandle );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepEncryptPasswordEnd( Handle,
                               RedirHandle,
                               EncryptedPasswords,
                               NELEMENTS(EncryptedPasswords) );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleDcAsReplica(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  LPCWSTR lpDnsDomainName,
    IN  LPCWSTR lpReplicaServer,
    IN  LPCWSTR lpSiteName OPTIONAL,
    IN  LPCWSTR lpDsDatabasePath,
    IN  LPCWSTR lpDsLogPath,
    IN  LPCWSTR lpRestorePath OPTIONAL,   
    IN  LPCWSTR lpSystemVolumeRootPath,
    IN OUT LPWSTR lpBootkey OPTIONAL,
    IN  LPCWSTR lpAccount OPTIONAL,
    IN  LPCWSTR lpPassword OPTIONAL,
    IN  LPCWSTR lpDsRepairPassword OPTIONAL,
    IN  ULONG Options,
    OUT DSROLE_SERVEROP_HANDLE *DsOperationHandle
    )
/*++

Routine Description:

    This routine will install a server as a replica of an existing domain.

Arguments:

    lpServer - OPTIONAL. Server to remote the call to.

    lpDnsDomainName - Dns domain name of the domain to install into

    lpReplicaServer -  The name of a Dc within the existing domain, against which to replicate

    lpSiteName - Name of the site this DC should belong to

    lpDsDatabasePath - Absolute path on the local machine where the Ds DIT should go

    lpDsLogPath - Absolute path on the local machine where the Ds log files should go
    
    lpRestorepath - This is the path to a restored directory.

    lpSystemVolumeRootPath - Absolute path on the local machine which will be the root of
        the system volume.

    lpAccount - User account to use when setting up as a child domain

    lpPassword - Password to use with the above account
    
    lpDsRepairPassword - Password to use for the admin account of the repair mode

    Options - Options to control the creation of the domain

    DsOperationHandle - Handle to the operation is returned here.

Return Values:

--*/
{

    DWORD Win32Err = ERROR_SUCCESS;
    NTSTATUS Status = STATUS_SUCCESS;
    handle_t Handle = NULL;
    HANDLE RedirHandle = NULL;
    USER_SESSION_KEY UserSessionKey;
    UNICODE_STRING ClearBootKeyHash;
    DSROLEPR_ENCRYPTED_HASH EncryptedBootKey;
    
#define DSROLEP_DC_AS_REPLICA_PWD_INDEX           0
#define DSROLEP_DC_AS_REPLICA_DS_REPAIR_PWD_INDEX 1
#define DSROLEP_DC_AS_REPLICA_MAX_PWD_COUNT       2

    PDSROLEPR_ENCRYPTED_USER_PASSWORD EncryptedPasswords[DSROLEP_DC_AS_REPLICA_MAX_PWD_COUNT];
    LPCWSTR Passwords[DSROLEP_DC_AS_REPLICA_MAX_PWD_COUNT];

    Passwords[DSROLEP_DC_AS_REPLICA_PWD_INDEX]           = lpPassword;
    Passwords[DSROLEP_DC_AS_REPLICA_DS_REPAIR_PWD_INDEX] = lpDsRepairPassword;
    RtlZeroMemory( EncryptedPasswords, sizeof(EncryptedPasswords) );

    Win32Err = DsRolepEncryptPasswordStart( lpServer,
                                            Passwords,
                                            NELEMENTS(Passwords),
                                            &Handle,
                                            &RedirHandle,
                                            &UserSessionKey,
                                            EncryptedPasswords );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    if(lpBootkey)
    {
        Win32Err = DsRolepHashkey(lpBootkey,
                                  &ClearBootKeyHash
                                  );
        if (Win32Err != ERROR_SUCCESS) {
            return Win32Err;
        }

        Win32Err = DsRolepEncryptHash(&UserSessionKey,
                                      &ClearBootKeyHash,
                                      &EncryptedBootKey);
        if (Win32Err != ERROR_SUCCESS) {
            return Win32Err;
        }
    } else {
        EncryptedBootKey.EncryptedHash.Buffer = NULL;
        EncryptedBootKey.EncryptedHash.Length = 0;
        EncryptedBootKey.EncryptedHash.MaximumLength = 0;
    }
                                                  
    RpcTryExcept {

            Win32Err = DsRolerDcAsReplica( Handle,
                                         ( LPWSTR )lpDnsDomainName,
                                         ( LPWSTR )lpReplicaServer,
                                         ( LPWSTR )lpSiteName,
                                         ( LPWSTR )lpDsDatabasePath,
                                         ( LPWSTR )lpDsLogPath,
                                         ( LPWSTR )lpRestorePath,
                                         ( LPWSTR )lpSystemVolumeRootPath,
                                         EncryptedBootKey.EncryptedHash.Buffer==NULL?
                                           NULL:&EncryptedBootKey,
                                         ( LPWSTR )lpAccount,
                                         EncryptedPasswords[DSROLEP_DC_AS_REPLICA_PWD_INDEX],
                                         EncryptedPasswords[DSROLEP_DC_AS_REPLICA_DS_REPAIR_PWD_INDEX],
                                         Options,
                                         ( PDSROLER_HANDLE )DsOperationHandle );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;

    if(EncryptedBootKey.EncryptedHash.Buffer)
    {
        MIDL_user_free(EncryptedBootKey.EncryptedHash.Buffer);
        EncryptedBootKey.EncryptedHash.Length=0;
        EncryptedBootKey.EncryptedHash.MaximumLength=0;
    }



    DsRolepEncryptPasswordEnd( Handle,
                               RedirHandle,
                               EncryptedPasswords,
                               NELEMENTS(EncryptedPasswords) );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleDemoteDc(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  LPCWSTR lpDnsDomainName,
    IN  DSROLE_SERVEROP_DEMOTE_ROLE ServerRole,
    IN  LPCWSTR lpAccount OPTIONAL,
    IN  LPCWSTR lpPassword OPTIONAL,
    IN  ULONG Options,
    IN  BOOL fLastDcInDomain,
    IN  ULONG cRemoveNCs,
    IN  LPCWSTR *pszRemoveNCs OPTIONAL,
    IN  LPCWSTR lpAdminPassword OPTIONAL,
    OUT DSROLE_SERVEROP_HANDLE *DsOperationHandle
    )
/*++

Routine Description:

    This routine will demote an existing Dc to a standalone or member server.

Arguments:

    lpServer - Server to remote the call to

    lpDnsDomainName - Name of the domain on this machine to demote.  If NULL, demote all of the
        domains on this machine

    ServerRole - The new role this machine should take

    lpAccount - OPTIONAL User account to use when deleting the trusted domain object

    lpPassword - Password to use with the above account

    Options - Options to control the demotion of the domain

    fLastDcInDomain - If TRUE, this is the last dc in the domain

    cRemoveNCs - Count of string pointers in pszRemoveNCs

    pszRemoveNCs - Array of (cRemoveNCs) strings. Strings are DNs of NDNCs to be removed

    lpAdminPassword - New local addmin password

    DsOperationHandle - Handle to the operation is returned here.

Return Values:

    ERROR_SUCCESS - Success
--*/

{

    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;
    HANDLE RedirHandle = NULL;

#define DSROLEP_DEMOTE_PWD_INDEX          0
#define DSROLEP_DEMOTE_ADMIN_PWD_INDEX    1
#define DSROLEP_DEMOTE_MAX_PWD_COUNT      2

    PDSROLEPR_ENCRYPTED_USER_PASSWORD EncryptedPasswords[DSROLEP_DEMOTE_MAX_PWD_COUNT];
    LPCWSTR Passwords[DSROLEP_DEMOTE_MAX_PWD_COUNT];

    Passwords[DSROLEP_DEMOTE_PWD_INDEX]   = lpPassword;
    Passwords[DSROLEP_DEMOTE_ADMIN_PWD_INDEX] = lpAdminPassword;
    RtlZeroMemory( EncryptedPasswords, sizeof(EncryptedPasswords) );

    Win32Err = DsRolepEncryptPasswordStart( lpServer,
                                            Passwords,
                                            NELEMENTS(Passwords),
                                            &Handle,
                                            &RedirHandle,
                                            NULL,
                                            EncryptedPasswords );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerDemoteDc( Handle,
                                      ( LPWSTR )lpDnsDomainName,
                                      ServerRole,
                                      ( LPWSTR )lpAccount,
                                      EncryptedPasswords[DSROLEP_DEMOTE_PWD_INDEX],
                                      Options,
                                      fLastDcInDomain,
                                      cRemoveNCs,
                                      pszRemoveNCs,
                                      EncryptedPasswords[DSROLEP_DEMOTE_ADMIN_PWD_INDEX],
                                      ( PDSROLER_HANDLE )DsOperationHandle );


    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepEncryptPasswordEnd( Handle,
                               RedirHandle,
                               EncryptedPasswords,
                               NELEMENTS(EncryptedPasswords) );

    return( Win32Err );
}


DWORD
WINAPI
DsRoleGetDcOperationProgress(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  DSROLE_SERVEROP_HANDLE DsOperationHandle,
    OUT PDSROLE_SERVEROP_STATUS *ServerOperationStatus
    )
/*++

Routine Description:

    Gets the progress of the currently running operation

Arguments:

    lpServer - Server to remote the call to

    DsOperationHandle - Handle of currently running operation.  Returned by one of the DsRoleDcAs
        apis

    ServerOperationStatus - Where the current operation status is returned.  Must be freed via
        MIDL_user_free (or DsRoleFreeMemory)

Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    PDSROLER_SERVEROP_STATUS ServerStatus = NULL;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerGetDcOperationProgress(
                         Handle,
                         (PDSROLER_HANDLE)&DsOperationHandle,
                         &ServerStatus );

        if ( Win32Err == ERROR_SUCCESS || Win32Err == ERROR_IO_PENDING ) {

            *ServerOperationStatus = ( PDSROLE_SERVEROP_STATUS )ServerStatus;
        }

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleGetDcOperationResults(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  DSROLE_SERVEROP_HANDLE DsOperationHandle,
    OUT PDSROLE_SERVEROP_RESULTS *ServerOperationResults
    )
/*++

Routine Description:

    Gets the final results of an attempted promotion/demotion operation

Arguments:

    lpServer - Server to remote the call to

    DsOperationHandle - Handle of currently running operation.  Returned by one of the DsRoleDcAs
        apis

    ServerOperationResults - Where the current operation result is returned.  Must be freed via
        MIDL_user_free (or DsRoleFreeMemory)

Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    PDSROLER_SERVEROP_RESULTS ServerResults = NULL;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        *ServerOperationResults = 0;
        Win32Err = DsRolerGetDcOperationResults(
                         Handle,
                         (PDSROLER_HANDLE)&DsOperationHandle,
                         &ServerResults );

        if ( Win32Err == ERROR_SUCCESS ) {

            *ServerOperationResults = ( PDSROLE_SERVEROP_RESULTS )ServerResults;
        }

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleGetPrimaryDomainInformation(
    IN LPCWSTR lpServer OPTIONAL,
    IN DSROLE_PRIMARY_DOMAIN_INFO_LEVEL InfoLevel,
    OUT PBYTE *Buffer )
/*++

Routine Description:

    Gets information on the machine

Arguments:

    lpServer - Server to remote the call to

    InfoLevel - What level of information is being requested.  Currently supported levels are:
        DsRolePrimaryDomainInfoBasic

    Buffer - Where the information is returned.  The returned pointer should be cast to the
        appropriate type for the info level passed in.  The returned buffer should be freed via
        MIDL_user_free (or DsRoleFreeMemory)


Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    PDSROLER_PRIMARY_DOMAIN_INFORMATION PrimaryDomainInfo = NULL;
    handle_t Handle = NULL;
    NTSTATUS Status = STATUS_SUCCESS;

    if ( Buffer == NULL ) {

        return( ERROR_INVALID_PARAMETER );
    }

    Win32Err = DsRolepGetPrimaryDomainInfoServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                                      &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    if ( NULL == Handle) {

        return( ERROR_NOT_ENOUGH_MEMORY );
    }

    RpcTryExcept {

        *Buffer = NULL;
        Win32Err = DsRolerGetPrimaryDomainInformation(
                         Handle,
                         InfoLevel,
                         &PrimaryDomainInfo );

        *Buffer = ( PBYTE )PrimaryDomainInfo;

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Status = I_RpcMapWin32Status( RpcExceptionCode() );
        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;

    
    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );
    
    //
    // If this fails because we are calling a downlevel server, cobble up the information here
    //
    if ( ( Status == RPC_NT_UNKNOWN_IF || Status == RPC_NT_PROCNUM_OUT_OF_RANGE ) &&
         InfoLevel == DsRolePrimaryDomainInfoBasic ) {

         Win32Err = DsRolepGetPrimaryDomainInformationDownlevel( ( LPWSTR )lpServer, Buffer );

    }




    return( Win32Err );
}



DWORD
WINAPI
DsRoleCancel(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  DSROLE_SERVEROP_HANDLE DsOperationHandle
    )
/*++

Routine Description:

    Cancels a currently running operation

Arguments:

    lpServer - Server to remote the call to

    DsOperationHandle - Handle of currently running operation.  Returned by one of the DsRoleDcAs
        apis


Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerCancel( Handle,
                                  ( PDSROLER_HANDLE )&DsOperationHandle );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );

    return( Win32Err );
}


DWORD
WINAPI
DsRoleIfmHandleFree(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  DSROLE_IFM_OPERATION_HANDLE * pIfmHandle
    )
/*++

Routine Description:

    Cancels a currently running operation

Arguments:

    lpServer - Server to remote the call to

    DsOperationHandle - Handle of currently running operation.  Returned by one of the DsRoleDcAs
        apis


Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerIfmHandleFree( Handle,
                                         ( DSROLER_IFM_HANDLE ) pIfmHandle );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );

    return( Win32Err );
}



DWORD
WINAPI
DsRoleServerSaveStateForUpgrade(
    IN LPCWSTR lpAnswerFile OPTIONAL
    )
/*++

Routine Description:

    This function is to be invoked during setup and saves the required server state to
    complete the promotion following the reboot.  Following the successful completion
    of this API call, the server will be demoted to a member server in the same domain.

Arguments:

    lpAnswerFile -- Optional path to an answer file to be used by DCPROMO when it is
        invoked to do the upgrade


Return Values:

    ERROR_SUCCESS - Success

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;

    Win32Err = DsRolepServerBind( NULL,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerServerSaveStateForUpgrade( Handle, ( LPWSTR )lpAnswerFile );

    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepServerUnbind( NULL, Handle );

    return( Win32Err );
}


DWORD
WINAPI
DsRoleUpgradeDownlevelServer(
    IN  LPCWSTR lpDnsDomainName,
    IN  LPCWSTR lpSiteName,
    IN  LPCWSTR lpDsDatabasePath,
    IN  LPCWSTR lpDsLogPath,
    IN  LPCWSTR lpSystemVolumeRootPath,
    IN  LPCWSTR lpParentDnsDomainName OPTIONAL,
    IN  LPCWSTR lpParentServer OPTIONAL,
    IN  LPCWSTR lpAccount OPTIONAL,
    IN  LPCWSTR lpPassword OPTIONAL,
    IN  LPCWSTR lpDsRepairPassword OPTIONAL,
    IN  ULONG Options,
    OUT DSROLE_SERVEROP_HANDLE *DsOperationHandle
    )
/*++

Routine Description:

    This routine process the information saved from a DsRoleServerSaveStateForUpgrade to
    promote a downlevel (NT4 or previous) server to an NT5 DC

Arguments:

    lpDnsDomainName - Dns domain name of the domain to install

    SiteName - Name of the site this DC should belong to

    lpDsDatabasePath - Absolute path on the local machine where the Ds DIT should go

    lpDsLogPath - Absolute path on the local machine where the Ds log files should go

    lpSystemVolumeRootPath - Absolute path on the local machine which will be the root of
        the system volume.

    lpParentDnsDomainName - Optional.  If present, set this domain up as a child of the
        specified domain

    lpParentServer - Optional.  If present, use this server in the parent domain to replicate
        the required information from

    lpAccount - User account to use when setting up as a child domain

    lpPassword - Password to use with the above account
    
    lpDsRepairPassword - Password to use for the admin account of the repair mode

    Options - Options to control the creation of the domain

    DsOperationHandle - Handle to the operation is returned here.


Return Values:

    ERROR_SUCCESS - Success

--*/
{

    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;
    HANDLE RedirHandle = NULL;

#define DSROLEP_UPGRADE_PWD_INDEX              0
#define DSROLEP_UPGRADE_DS_REPAIR_PWD_INDEX    1
#define DSROLEP_UPGRADE_MAX_PWD_COUNT          2

    PDSROLEPR_ENCRYPTED_USER_PASSWORD EncryptedPasswords[DSROLEP_UPGRADE_MAX_PWD_COUNT];
    LPCWSTR Passwords[DSROLEP_UPGRADE_MAX_PWD_COUNT];

    Passwords[DSROLEP_UPGRADE_PWD_INDEX]   = lpPassword;
    Passwords[DSROLEP_UPGRADE_DS_REPAIR_PWD_INDEX] = lpDsRepairPassword;
    RtlZeroMemory( EncryptedPasswords, sizeof(EncryptedPasswords) );

    Win32Err = DsRolepEncryptPasswordStart( NULL,
                                            Passwords,
                                            NELEMENTS(Passwords),
                                            &Handle,
                                            &RedirHandle,
                                            NULL,
                                            EncryptedPasswords );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }


    RpcTryExcept {

        Win32Err = DsRolerUpgradeDownlevelServer( Handle,
                                                  ( LPWSTR )lpDnsDomainName,
                                                  ( LPWSTR )lpSiteName,
                                                  ( LPWSTR )lpDsDatabasePath,
                                                  ( LPWSTR )lpDsLogPath,
                                                  ( LPWSTR )lpSystemVolumeRootPath,
                                                  ( LPWSTR )lpParentDnsDomainName,
                                                  ( LPWSTR )lpParentServer,
                                                  ( LPWSTR )lpAccount,
                                                  EncryptedPasswords[DSROLEP_UPGRADE_PWD_INDEX],
                                                  EncryptedPasswords[DSROLEP_UPGRADE_DS_REPAIR_PWD_INDEX],
                                                  Options,
                                                  ( PDSROLER_HANDLE )DsOperationHandle );
        
    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepEncryptPasswordEnd( Handle,
                               RedirHandle,
                               EncryptedPasswords,
                               NELEMENTS(EncryptedPasswords) );


    return( Win32Err );
}


DWORD
WINAPI
DsRoleAbortDownlevelServerUpgrade(
    IN LPCWSTR lpAdminPassword,
    IN LPCWSTR lpAccount, OPTIONAL
    IN LPCWSTR lpPassword, OPTIONAL
    IN ULONG Options
    )
/*++

Routine Description:

    This routine cleans up the information saved from a DsRoleSaveServerStateForUpgrade call,
    leaving the machine as a member or standalone server

Arguments:

    lpAdminPassword - New local administrator account password

    lpAccount - User account to use when setting up as a child domain

    lpPassword - Password to use with the above account


Return Values:

    ERROR_SUCCESS - Success

--*/
{

    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;
    HANDLE RedirHandle = NULL;

#define DSROLEP_ABORT_PWD_INDEX         0
#define DSROLEP_ABORT_ADMIN_PWD_INDEX   1
#define DSROLEP_ABORT_MAX_PWD_COUNT     2

    PDSROLEPR_ENCRYPTED_USER_PASSWORD EncryptedPasswords[DSROLEP_ABORT_MAX_PWD_COUNT];
    LPCWSTR Passwords[DSROLEP_ABORT_MAX_PWD_COUNT];

    Passwords[DSROLEP_ABORT_PWD_INDEX]   = lpPassword;
    Passwords[DSROLEP_ABORT_ADMIN_PWD_INDEX] = lpAdminPassword;
    RtlZeroMemory( EncryptedPasswords, sizeof(EncryptedPasswords) );

    Win32Err = DsRolepEncryptPasswordStart( NULL,
                                            Passwords,
                                            NELEMENTS(Passwords),
                                            &Handle,
                                            &RedirHandle,
                                            NULL,
                                            EncryptedPasswords );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }

    RpcTryExcept {

        Win32Err = DsRolerAbortDownlevelServerUpgrade( Handle,
                                                       ( LPWSTR )lpAccount,
                                                       EncryptedPasswords[DSROLEP_ABORT_PWD_INDEX],
                                                       EncryptedPasswords[DSROLEP_ABORT_ADMIN_PWD_INDEX],
                                                       Options );
    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;


    DsRolepEncryptPasswordEnd( Handle,
                               RedirHandle,
                               EncryptedPasswords,
                               NELEMENTS(EncryptedPasswords) );


    return( Win32Err );
}

DWORD
WINAPI
DsRoleGetDatabaseFacts(
    IN  LPCWSTR lpServer OPTIONAL,
    IN  LPCWSTR lpRestorePath,
    OUT LPWSTR *lpDNSDomainName,
    OUT PULONG State,
    OUT DSROLE_IFM_OPERATION_HANDLE * pIfmHandle
    )
/*++

Routine Description:

    This function is the RPC procedure exposed to setup the server side
    IFM handle DsRolepCurrentIfmOperationHandle, which caches the information
    we'll need from the IFM system's registry.  This function also returns
    the relevant subset of this IFM system information to the caller (dcpromo).
    
    Note: We do this only once, because in the case that the IFM registry
    is in a non-writeable location (such as a CD), we will need to copy off
    the registry to a temporary location to use it.
    
    This function returns to the caller:
    1. the way the syskey is stored (State)
    2. the domain that the database came from (lpDNSDomainName)
    3. where the backup was taken from a GC or not (State)

Arguments:

    lpServer - The server to get the Facts from

    lpRestorePath - The location of the restored files.
    
    lpDNSDomainName - This parameter will recieve the name of the domain that this backup came
                      from

    State - The return Values that report How the syskey is stored and If the back was likely
              taken form a GC or not.

    pIfmHandle - Pointer to the IFM handle handed back.  This is primarily used
        to "free" the IFM System Info.


Return Values:

    Win32 Error

--*/
{
    DWORD Win32Err = ERROR_SUCCESS;
    handle_t Handle = NULL;

    if(lpDNSDomainName == NULL ||
       IsBadWritePtr(lpDNSDomainName, sizeof(LPWSTR)) ||
       State == NULL ||
       IsBadWritePtr(State, sizeof(DWORD)) ||
       pIfmHandle == NULL ||
       IsBadWritePtr(pIfmHandle, sizeof(void *)) ){
        return ERROR_INVALID_PARAMETER;
    }

    Win32Err = DsRolepServerBind( (PDSROLE_SERVER_NAME)lpServer,
                                  &Handle );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );                     
    }
    
    RpcTryExcept {

        Win32Err = DsRolerGetDatabaseFacts( Handle,
                                          ( LPWSTR )lpRestorePath,
                                          ( LPWSTR * )lpDNSDomainName,
                                          ( PULONG )State,
                                          ( DSROLER_IFM_HANDLE * ) pIfmHandle );
    } RpcExcept( EXCEPTION_EXECUTE_HANDLER ) {

        Win32Err = DsRolepApiReturnResult( RpcExceptionCode( ) );

    } RpcEndExcept;

    DsRolepServerUnbind( (PDSROLE_SERVER_NAME)lpServer, Handle );


    return Win32Err;
}



//
// Local functions
//
DWORD
DsRolepGetPrimaryDomainInformationDownlevel(
    IN LPWSTR Server,
    OUT PBYTE *Buffer
    )
{
    DWORD Win32Err = ERROR_SUCCESS;
    NTSTATUS Status;
    LSA_HANDLE PolicyHandle;
    PPOLICY_PRIMARY_DOMAIN_INFO PDI = NULL;
    PPOLICY_LSA_SERVER_ROLE_INFO ServerRole = NULL;
    PPOLICY_ACCOUNT_DOMAIN_INFO ADI = NULL;
    UNICODE_STRING UnicodeServer;
    OBJECT_ATTRIBUTES OA;
    PDSROLE_PRIMARY_DOMAIN_INFO_BASIC PDIB = NULL;
    DSROLE_MACHINE_ROLE MachineRole = DsRole_RoleStandaloneServer;
    NT_PRODUCT_TYPE ProductType;

    Win32Err = DsRolepGetProductTypeForServer( Server, &ProductType );

    if ( Win32Err != ERROR_SUCCESS ) {

        return( Win32Err );
    }


    InitializeObjectAttributes( &OA, NULL, 0, NULL, NULL);
    if ( Server ) {

        RtlInitUnicodeString( &UnicodeServer, Server );
    }

    Status = LsaOpenPolicy( Server ? &UnicodeServer : NULL,
                            &OA,
                            POLICY_VIEW_LOCAL_INFORMATION,
                            &PolicyHandle );

    if ( NT_SUCCESS( Status ) ) {

        Status = LsaQueryInformationPolicy( PolicyHandle,
                                            PolicyPrimaryDomainInformation,
                                            ( PVOID * ) &PDI );

        if ( NT_SUCCESS( Status ) ) {

            switch ( ProductType ) {
            case NtProductWinNt:
                if ( PDI->Sid == NULL ) {

                    MachineRole = DsRole_RoleStandaloneWorkstation;

                } else {

                    MachineRole = DsRole_RoleMemberWorkstation;

                }
                break;

            case NtProductServer:
                if ( PDI->Sid == NULL ) {

                    MachineRole = DsRole_RoleStandaloneServer;

                } else {

                    MachineRole = DsRole_RoleMemberServer;

                }
                break;

            case NtProductLanManNt:

                Status = LsaQueryInformationPolicy( PolicyHandle,
                                                    PolicyLsaServerRoleInformation,
                                                    ( PVOID * )&ServerRole );
                if ( NT_SUCCESS( Status ) ) {

                    if ( ServerRole->LsaServerRole == PolicyServerRolePrimary ) {

                        //
                        // If we think we're a primary domain controller, we'll need to
                        // guard against the case where we're actually standalone during setup
                        //
                        Status = LsaQueryInformationPolicy( PolicyHandle,
                                                            PolicyAccountDomainInformation,
                                                            ( PVOID * )&ADI );
                        if ( NT_SUCCESS( Status ) ) {


                            if ( PDI->Sid == NULL ||
                                 ADI->DomainSid == NULL ||
                                 !RtlEqualSid( ADI->DomainSid, PDI->Sid ) ) {

                                MachineRole = DsRole_RoleStandaloneServer;

                            } else {

                                MachineRole = DsRole_RolePrimaryDomainController;

                            }
                        }


                    } else {

                        MachineRole = DsRole_RoleBackupDomainController;
                    }
                }

                break;

            default:

                Status = STATUS_INVALID_PARAMETER;
                break;
            }

        }

        //
        // Build the return buffer
        //
        if ( NT_SUCCESS( Status ) ) {

            PDIB = MIDL_user_allocate( sizeof( DSROLE_PRIMARY_DOMAIN_INFO_BASIC ) +
                                       PDI->Name.Length + sizeof( WCHAR ) );

            if ( PDIB == NULL ) {

                Status = STATUS_INSUFFICIENT_RESOURCES;

            } else {

                RtlZeroMemory( PDIB, sizeof( DSROLE_PRIMARY_DOMAIN_INFO_BASIC ) +
                                       PDI->Name.Length + sizeof( WCHAR ) );

                PDIB->MachineRole = MachineRole;
                PDIB->DomainNameFlat = ( LPWSTR ) ( ( PBYTE )PDIB +
                                                sizeof( DSROLE_PRIMARY_DOMAIN_INFO_BASIC ) );
                RtlCopyMemory( PDIB->DomainNameFlat, PDI->Name.Buffer, PDI->Name.Length );

                *Buffer = ( PBYTE )PDIB;
            }
        }

        LsaClose( PolicyHandle );

        LsaFreeMemory( PDI );

        if ( ADI != NULL ) {

            LsaFreeMemory( ADI );
        }

        if ( ServerRole != NULL ) {

            LsaFreeMemory( ServerRole );
        }
    }

    Win32Err = RtlNtStatusToDosError( Status );

    return( Win32Err );
}


DWORD
DsRolepGetProductTypeForServer(
    IN LPWSTR Server,
    IN OUT PNT_PRODUCT_TYPE ProductType
    )
{
    DWORD Win32Err = ERROR_SUCCESS;
    PWSTR RegServer = NULL;
    HKEY RemoteKey, ProductKey;
    PBYTE Buffer = NULL;
    ULONG Type, Size = 0;



    if ( Server == NULL ) {

        if ( RtlGetNtProductType( ProductType ) == FALSE ) {

            Win32Err = RtlNtStatusToDosError( STATUS_UNSUCCESSFUL );

        }

    } else {

        if ( wcslen( Server ) > 2 && *Server == L'\\' && *( Server + 1 ) == L'\\' ) {

            RegServer = Server;

        } else {

            RegServer = LocalAlloc( LMEM_FIXED, ( wcslen( Server ) + 3 ) * sizeof( WCHAR ) );

            if ( RegServer ) {

                swprintf( RegServer, L"\\\\%ws", Server );

            } else {

                Win32Err = ERROR_NOT_ENOUGH_MEMORY;

            }
        }

        if ( Win32Err == ERROR_SUCCESS ) {

            Win32Err = RegConnectRegistry( RegServer,
                                           HKEY_LOCAL_MACHINE,
                                           &RemoteKey );

            if ( Win32Err == ERROR_SUCCESS ) {

                Win32Err = RegOpenKeyEx( RemoteKey,
                                         L"system\\currentcontrolset\\control\\productoptions",
                                         0,
                                         KEY_READ,
                                         &ProductKey );

                if ( Win32Err == ERROR_SUCCESS ) {

                    Win32Err = RegQueryValueEx( ProductKey,
                                                L"ProductType",
                                                0,
                                                &Type,
                                                0,
                                                &Size );

                    if ( Win32Err == ERROR_SUCCESS ) {

                        Buffer = LocalAlloc( LMEM_FIXED, Size );

                        if ( Buffer ) {

                            Win32Err = RegQueryValueEx( ProductKey,
                                                        L"ProductType",
                                                        0,
                                                        &Type,
                                                        Buffer,
                                                        &Size );

                            if ( Win32Err == ERROR_SUCCESS ) {

                                if ( !_wcsicmp( ( PWSTR )Buffer, L"LanmanNt" ) ) {

                                    *ProductType = NtProductLanManNt;

                                } else if ( !_wcsicmp( ( PWSTR )Buffer, L"ServerNt" ) ) {

                                    *ProductType = NtProductServer;

                                } else if ( !_wcsicmp( ( PWSTR )Buffer, L"WinNt" ) ) {

                                    *ProductType = NtProductWinNt;

                                } else {

                                    Win32Err = ERROR_UNKNOWN_PRODUCT;
                                }
                            }

                            LocalFree( Buffer );

                        } else {

                            Win32Err = ERROR_NOT_ENOUGH_MEMORY;
                        }
                    }

                    RegCloseKey( ProductKey );
                }


                RegCloseKey( RemoteKey );
            }

        }

        if ( RegServer != Server ) {

            LocalFree( RegServer );
        }
    }

    return( Win32Err );

}

NTSTATUS
DsRolepRandomFill(
    IN ULONG BufferSize,
    IN OUT PUCHAR Buffer
)
/*++

Routine Description:

    This routine fills a buffer with random data.

Parameters:

    BufferSize - Length of the input buffer, in bytes.

    Buffer - Input buffer to be filled with random data.

Return Values:

    Errors from NtQuerySystemTime()


--*/
{
    if( RtlGenRandom(Buffer, BufferSize) )
    {
        return STATUS_SUCCESS;
    }

    return STATUS_UNSUCCESSFUL;
}

DWORD
DsRolepEncryptPasswordStart(
    IN LPCWSTR ServerName OPTIONAL,
    IN LPCWSTR *Passwords,
    IN ULONG   Count,
    OUT RPC_BINDING_HANDLE *RpcBindingHandle,
    OUT HANDLE *RedirHandle,
    OUT OPTIONAL PUSER_SESSION_KEY pUserSessionKey,
    IN OUT PDSROLEPR_ENCRYPTED_USER_PASSWORD *EncryptedUserPasswords
    )
/*++

Routine Description:

    This routine takes a number of cleartext unicode NT password from the user,
    and encrypts them with the session key.
    
    This routine's algorithm was taken from CliffV's work when encrypting the
    passwords for the NetrJoinDomain2 interface.

Parameters:

    ServerName - UNC server name of the server to remote the API to

    Passwords - the cleartext unicode NT passwords.
    
    Count - the number of password

    RpcBindingHandle - RPC handle used for acquiring a session key.

    RedirHandle - Returns a handle to the redir.  Since RpcBindingHandles don't represent
        and open connection to the server, we have to ensure the connection stays open
        until the server side has a chance to get this same UserSessionKey.  The only
        way to do that is to keep the connect open.

        Returns NULL if no handle is needed.
        
    UserSessionKey - OPTIONAL - Session Key used to encrypt passwords
    
    EncryptedUserPassword - receives the encrypted cleartext passwords.
        If lpPassword is NULL, a NULL is returned for that entry.

Return Values:

    If this routine returns NO_ERROR, the returned data must be freed using
        LocalFree.


--*/
{
    DWORD WinError = ERROR_SUCCESS;
    NTSTATUS NtStatus;
    RC4_KEYSTRUCT Rc4Key;
    MD5_CTX Md5Context;
    USER_SESSION_KEY UserSessionKey;
    PDSROLEPR_USER_PASSWORD UserPassword = NULL;
    ULONG PasswordSize;
    ULONG i;

    //
    // Initialization
    //

    *RpcBindingHandle = NULL;
    *RedirHandle = NULL;
    for ( i = 0; i < Count; i++ ) {
        EncryptedUserPasswords[i] = NULL;
    }

    //
    // Verify parameters
    //
    for ( i = 0; i < Count; i++ ) {
        if ( Passwords[i] ) {
            PasswordSize = wcslen( Passwords[i] ) * sizeof(WCHAR);
            if ( PasswordSize > DSROLE_MAX_PASSWORD_LENGTH * sizeof(WCHAR)) {
                WinError = ERROR_PASSWORD_RESTRICTION;
                goto Cleanup;
            }
        }
    }

    //
    // Get an RPC handle to the server.
    //

    WinError = DsRolepServerBind( (PDSROLE_SERVER_NAME) ServerName,
                                  RpcBindingHandle );

    if ( ERROR_SUCCESS != WinError ) {
        goto Cleanup;
    }

    //
    // Get the session key.
    //

    NtStatus = RtlGetUserSessionKeyClientBinding(
                   *RpcBindingHandle,
                   RedirHandle,
                   &UserSessionKey );

    if ( !NT_SUCCESS(NtStatus) ) {
        WinError = RtlNtStatusToDosError( NtStatus );
        goto Cleanup;
    }

    //Return the UserSessionKey if requested
    if (pUserSessionKey) {
        CopyMemory(pUserSessionKey, &UserSessionKey, sizeof(UserSessionKey));
    }

    //
    // Encrypt the passwords
    //
    for ( i = 0; i < Count; i++ ) {
        

        if ( NULL == Passwords[i] ) {
            // Nothing to encrypt
            continue;
        }

        PasswordSize = wcslen( Passwords[i] ) * sizeof(WCHAR);

        //
        // Allocate a buffer to encrypt and fill it in.
        //
    
        UserPassword = LocalAlloc( 0, sizeof(DSROLEPR_USER_PASSWORD) );
    
        if ( UserPassword == NULL ) {
            WinError = ERROR_NOT_ENOUGH_MEMORY;
            goto Cleanup;
        }
    
        //
        // Copy the password into the tail end of the buffer.
        //
    
        RtlCopyMemory(
            ((PCHAR) UserPassword->Buffer) +
                (DSROLE_MAX_PASSWORD_LENGTH * sizeof(WCHAR)) -
                PasswordSize,
            Passwords[i],
            PasswordSize );
    
        UserPassword->Length = PasswordSize;
    
        //
        // Fill the front of the buffer with random data
        //
    
        NtStatus = DsRolepRandomFill(
                    (DSROLE_MAX_PASSWORD_LENGTH * sizeof(WCHAR)) -
                        PasswordSize,
                    (PUCHAR) UserPassword->Buffer );
    
        if ( !NT_SUCCESS(NtStatus) ) {
            WinError = RtlNtStatusToDosError( NtStatus );
            goto Cleanup;
        }
    
        NtStatus = DsRolepRandomFill(
                    DSROLE_OBFUSCATOR_LENGTH,
                    (PUCHAR) UserPassword->Obfuscator );

        if ( !NT_SUCCESS(NtStatus) ) {
            WinError = RtlNtStatusToDosError( NtStatus );
            goto Cleanup;
        }
    
    
        //
        // The UserSessionKey is the same for the life of the session.  RC4'ing multiple
        //  strings with a single key is weak (if you crack one you've cracked them all).
        //  So compute a key that's unique for this particular encryption.
        //
        //
    
        MD5Init(&Md5Context);
    
        MD5Update( &Md5Context, (LPBYTE)&UserSessionKey, sizeof(UserSessionKey) );
        MD5Update( &Md5Context, UserPassword->Obfuscator, sizeof(UserPassword->Obfuscator) );
    
        MD5Final( &Md5Context );
    
        rc4_key( &Rc4Key, MD5DIGESTLEN, Md5Context.digest );

        //
        // Encrypt it.
        //  Don't encrypt the obfuscator.  The server needs that to compute the key.
        //
    
        rc4( &Rc4Key, sizeof(UserPassword->Buffer)+sizeof(UserPassword->Length), (LPBYTE) UserPassword->Buffer );

        EncryptedUserPasswords[i] = (PDSROLEPR_ENCRYPTED_USER_PASSWORD) UserPassword;
        UserPassword = NULL;

    }

    WinError = ERROR_SUCCESS;

Cleanup:

    if ( WinError != ERROR_SUCCESS ) {
        if ( UserPassword != NULL ) {
            LocalFree( UserPassword );
        }
        if ( *RpcBindingHandle != NULL ) {
            DsRolepServerUnbind( NULL, *RpcBindingHandle );
            *RpcBindingHandle = NULL;
        }
        if ( *RedirHandle != NULL ) {
            NtClose( *RedirHandle );
            *RedirHandle = NULL;
        }
        for ( i = 0; i < Count; i++ ) {
            if ( EncryptedUserPasswords[i] ) {
                LocalFree( EncryptedUserPasswords[i] );
                EncryptedUserPasswords[i] = NULL;
            }
        }
    }

    return WinError;
}


VOID
DsRolepEncryptPasswordEnd(
    IN RPC_BINDING_HANDLE RpcBindingHandle,
    IN HANDLE RedirHandle OPTIONAL,
    IN PDSROLEPR_ENCRYPTED_USER_PASSWORD *EncryptedUserPasswords OPTIONAL,
    IN ULONG Count
    )
/*++

Routine Description:

    This routine takes the variables returned by DsRolepEncryptPasswordStart and
    frees them.

Parameters:

    RpcBindingHandle - RPC handle used for acquiring a session key.

    RedirHandle - Handle to the redirector

    EncryptedUserPasswords - the encrypted cleartext passwords.
    
    Count - the number of passwords

Return Values:

--*/
{
    ULONG i;

    //
    // Free the RPC binding handle.
    //

    if ( RpcBindingHandle != NULL ) {
        (VOID) DsRolepServerUnbind ( NULL, RpcBindingHandle );
    }

    //
    // Close the redir handle.
    //

    if ( RedirHandle != NULL ) {
        NtClose( RedirHandle );
    }

    //
    // Free the encrypted passwords.
    //

    for ( i = 0; i < Count; i++ ) {
        if ( EncryptedUserPasswords[i] != NULL ) {
            LocalFree( EncryptedUserPasswords[i] );
        }
    }

    return;
}

DWORD
DsRolepHashkey(
    IN OUT LPWSTR key,
    OUT PUNICODE_STRING Hash
)
/*++

    Routine Description

    This routine is used to store the boot type
    in the registry

    Paramaeters

        key - the user passed in Key
        
        Hash - the hash of the key

    Return Values

        STATUS_SUCCESS
        STATUS_UNSUCCESSFUL
--*/
{
    MD5_CTX Md5;
    if (!key) {
        return ERROR_INVALID_PARAMETER;
    }

    MD5Init( &Md5 );
    MD5Update( &Md5, (PUCHAR) key, wcslen(key)*sizeof(WCHAR) );
    MD5Final( &Md5 );

    RtlSecureZeroMemory( key, wcslen(key)*sizeof(WCHAR) );

    Hash->Buffer = (LPWSTR) MIDL_user_allocate(SYSKEY_SIZE);
    if (!Hash->Buffer) {
        return ERROR_NOT_ENOUGH_MEMORY;
    }
    RtlCopyMemory(Hash->Buffer, Md5.digest, SYSKEY_SIZE);
    RtlSecureZeroMemory( Md5.digest, SYSKEY_SIZE );
    Hash->Length=SYSKEY_SIZE;
    Hash->MaximumLength=SYSKEY_SIZE;
    
    return ERROR_SUCCESS;
}

DWORD
DsRolepEncryptHash(
    IN PUSER_SESSION_KEY UserSessionKey,
    IN OUT PUNICODE_STRING Syskey,
    OUT PDSROLEPR_ENCRYPTED_HASH EncryptedSyskey
    )
/*++

    Routine Description

    This routine is used to store the boot type
    in the registry

    Paramaeters

        NewType Indicates the new boot type

    Return Values

        STATUS_SUCCESS
        STATUS_UNSUCCESSFUL
--*/
{
    DWORD WinError = ERROR_SUCCESS;
    NTSTATUS NtStatus;
    RC4_KEYSTRUCT Rc4Key;
    MD5_CTX Md5Context;
    
    //Init the buffer
    if (EncryptedSyskey) {
        EncryptedSyskey->EncryptedHash.Buffer = NULL;
    } else {
        WinError = ERROR_INVALID_PARAMETER;
        goto Cleanup;
    }

    //
    //parameter checking
    //
    if ( !Syskey || !Syskey->Buffer || (Syskey->Length < 1) 
         || ! UserSessionKey) {
        WinError = ERROR_INVALID_PARAMETER;
        goto Cleanup;
    }

    //Init PDSROLEPR_ENCRYPTED_HASH structure
    EncryptedSyskey->EncryptedHash.Buffer = Syskey->Buffer;
    EncryptedSyskey->EncryptedHash.Length = Syskey->Length;
    EncryptedSyskey->EncryptedHash.MaximumLength = Syskey->MaximumLength;

    //Clear out the Syskey
    RtlSecureZeroMemory(Syskey,sizeof(*Syskey));
    
    //Create a Random Salt
    NtStatus = DsRolepRandomFill(
                DSROLE_SALT_LENGTH,
                EncryptedSyskey->Salt );

    if ( !NT_SUCCESS(NtStatus) ) {
        WinError = RtlNtStatusToDosError( NtStatus );
        goto Cleanup;
    }

    //
    // The UserSessionKey is the same for the life of the session.  RC4'ing multiple
    //  strings with a single key is weak (if you crack one you've cracked them all).
    //  So compute a key that's unique for this particular encryption.
    //
    //

    MD5Init(&Md5Context);

    MD5Update( &Md5Context, (LPBYTE)UserSessionKey, sizeof(*UserSessionKey) );
    MD5Update( &Md5Context, EncryptedSyskey->Salt, sizeof(EncryptedSyskey->Salt) );

    MD5Final( &Md5Context );

    //
    // Encrypt it.
    //  Don't encrypt the salt.  The server needs that to compute the key.
    //
    rc4_key( &Rc4Key, MD5DIGESTLEN, Md5Context.digest );
    rc4( &Rc4Key, EncryptedSyskey->EncryptedHash.Length, (LPBYTE) EncryptedSyskey->EncryptedHash.Buffer );

    WinError = ERROR_SUCCESS;

Cleanup:

    if ( ERROR_SUCCESS != WinError ) {
        if (Syskey && Syskey->Buffer) {
             MIDL_user_free(Syskey->Buffer);
        }
        else if (EncryptedSyskey && EncryptedSyskey->EncryptedHash.Buffer) {
            MIDL_user_free(EncryptedSyskey->EncryptedHash.Buffer);
        }
    }

    return WinError;
}