windows-server-2003/inetsrv/iis/setup/osrc/setuser.cpp

#include "stdafx.h"
#include "svc.h"
#include "setuser.h"
#include "dcomperm.h"
#include "rights.hxx"

#ifndef _CHICAGO_
USE_USER_RIGHTS();

int GetGuestUserName_SlowWay(LPWSTR lpGuestUsrName)
{
    LPWSTR ServerName = NULL; // default to local machine
    DWORD Level = 1; // to retrieve info of all local and global normal user accounts
    DWORD Index = 0;
    DWORD EntriesRequested = 5;
    DWORD PreferredMaxLength = 1024;
    DWORD ReturnedEntryCount = 0;
    PVOID SortedBuffer = NULL;
    NET_DISPLAY_USER *p = NULL;
    DWORD i=0;
    int err = 0;
    BOOL fStatus = TRUE;

    while (fStatus) 
    {
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetQueryDisplayInformation().Start.")));
        err = NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaxLength, &ReturnedEntryCount, &SortedBuffer);
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetQueryDisplayInformation().End.")));
        if (err == NERR_Success)
            fStatus = FALSE;
        if (err == NERR_Success || err == ERROR_MORE_DATA) 
        {
            p = (NET_DISPLAY_USER *)SortedBuffer;
            i = 0;
            while (i < ReturnedEntryCount && (p[i].usri1_user_id != DOMAIN_USER_RID_GUEST))
                i++;
            if (i == ReturnedEntryCount) 
            {
                if (err == ERROR_MORE_DATA) 
                { // need to get more entries
                    Index = p[i-1].usri1_next_index;
                }
            }
            else 
            {
                wcscpy(lpGuestUsrName, p[i].usri1_name);
                fStatus = FALSE;
            }
        }
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
        NetApiBufferFree(SortedBuffer);
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
    }

    return 0;
}

int GetGuestGrpName(LPTSTR lpGuestGrpName)
{
    LPCTSTR ServerName = NULL; // local machine
    DWORD cbName = UNLEN+1;
    TCHAR ReferencedDomainName[200];
    DWORD cbReferencedDomainName = sizeof(ReferencedDomainName) / sizeof(TCHAR);
    SID_NAME_USE sidNameUse = SidTypeUser;

    SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
    PSID GuestsSid = NULL;

    AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS,0,0,0,0,0,0, &GuestsSid);

    LookupAccountSid(ServerName, GuestsSid, lpGuestGrpName, &cbName, ReferencedDomainName, &cbReferencedDomainName, &sidNameUse);

    if (GuestsSid)
        FreeSid(GuestsSid);

    return 0;
}

void InitLsaString(PLSA_UNICODE_STRING LsaString,LPWSTR String)
{
    DWORD StringLength;
 
    if (String == NULL) 
    {
        LsaString->Buffer = NULL;
        LsaString->Length = 0;
        LsaString->MaximumLength = 0;
        return;
    }
 
    StringLength = wcslen(String);
    LsaString->Buffer = String;
    LsaString->Length = (USHORT) StringLength * sizeof(WCHAR);
    LsaString->MaximumLength=(USHORT)(StringLength+1) * sizeof(WCHAR);
}

DWORD OpenPolicy(LPTSTR ServerName,DWORD DesiredAccess,PLSA_HANDLE PolicyHandle)
{
    DWORD Error;
    LSA_OBJECT_ATTRIBUTES ObjectAttributes;
    LSA_UNICODE_STRING ServerString;
    PLSA_UNICODE_STRING Server = NULL;
    SECURITY_QUALITY_OF_SERVICE QualityOfService;

    QualityOfService.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
    QualityOfService.ImpersonationLevel = SecurityImpersonation;
    QualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    QualityOfService.EffectiveOnly = FALSE;

    //
    // The two fields that must be set are length and the quality of service.
    //
    ObjectAttributes.Length = sizeof(LSA_OBJECT_ATTRIBUTES);
    ObjectAttributes.RootDirectory = NULL;
    ObjectAttributes.ObjectName = NULL;
    ObjectAttributes.Attributes = 0;
    ObjectAttributes.SecurityDescriptor = NULL;
    ObjectAttributes.SecurityQualityOfService = &QualityOfService;

    if (ServerName != NULL)
    {
        //
        // Make a LSA_UNICODE_STRING out of the LPWSTR passed in
        //
        InitLsaString(&ServerString,ServerName);
        Server = &ServerString;
    }
    //
    // Attempt to open the policy for all access
    //
    Error = LsaOpenPolicy(Server,&ObjectAttributes,DesiredAccess,PolicyHandle);
    return(Error);

}

INT RegisterAccountToLocalGroup(LPCTSTR szAccountName, LPCTSTR szLocalGroupName, BOOL fAction)
{
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("RegisterAccountToLocalGroup:Action=%d,Account=%s\n"), fAction, szAccountName));

    int err;

    // get the sid of szAccountName
    PSID pSID = NULL;
    BOOL bWellKnownSID = FALSE;
    err = GetPrincipalSID ((LPTSTR)szAccountName, &pSID, &bWellKnownSID);
    if (err != ERROR_SUCCESS) 
    {
        iisDebugOut((LOG_TYPE_ERROR, _T("RegisterAccountToLocalGroup:GetPrincipalSID:fAction=%d, Account=%s, Group=%s, err=%d.\n"), fAction, szAccountName, szLocalGroupName, err));
        return (err);
    }

    // Get the localized LocalGroupName
    TCHAR szLocalizedLocalGroupName[GNLEN + 1];
    if (_tcsicmp(szLocalGroupName, _T("Guests")) == 0) 
    {
        GetGuestGrpName(szLocalizedLocalGroupName);
    }
    else 
    {
        _tcscpy(szLocalizedLocalGroupName, szLocalGroupName);
    }
    
    // transfer szLocalGroupName to WCHAR
    WCHAR wszLocalGroupName[_MAX_PATH];
#if defined(UNICODE) || defined(_UNICODE)
    _tcscpy(wszLocalGroupName, szLocalizedLocalGroupName);
#else
    MultiByteToWideChar( CP_ACP, 0, szLocalizedLocalGroupName, -1, wszLocalGroupName, _MAX_PATH);
#endif

    LOCALGROUP_MEMBERS_INFO_0 buf;

    buf.lgrmi0_sid = pSID;

    if (fAction) 
    {
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetLocalGroupAddMembers().Start.")));
        err = NetLocalGroupAddMembers(NULL, wszLocalGroupName, 0, (LPBYTE)&buf, 1);
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetLocalGroupAddMembers().End.")));
    }
    else 
    {
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetLocalGroupDelMembers().Start.")));
        err = NetLocalGroupDelMembers(NULL, wszLocalGroupName, 0, (LPBYTE)&buf, 1);
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetLocalGroupDelMembers().End.")));
    }

    iisDebugOut((LOG_TYPE_TRACE, _T("RegisterAccountToLocalGroup:fAction=%d, Account=%s, Group=%s, err=%d.\n"), fAction, szAccountName, szLocalGroupName, err));

    if (pSID) 
    {
        if (bWellKnownSID)
            FreeSid (pSID);
        else
            free (pSID);
    }

    return (err);
}


VOID UpdateUserRights(LPCTSTR account,LPTSTR pstrRights[],DWORD dwNofRights,INT iDoAdd)
{
    DWORD status;
    BOOL  fPresence;
    
    for (DWORD i=0;i<dwNofRights;i++)
    {
        status = DoesUserHaveThisRight(account,pstrRights[i],&fPresence);
        if (!NT_SUCCESS(status))
        {
            iisDebugOut((LOG_TYPE_ERROR, _T("UpdateAnonymousUser:ModifyRightToUserAccount:Account=%s,righ %s,err=0x%0X.\n"), account, pstrRights[i], status));
        }
        else
        {
            if (!fPresence)
            {
                status = ModifyRightToUserAccount(account,pstrRights[i],iDoAdd);
                if (!NT_SUCCESS(status))
                {
                    if (iDoAdd)
                    {
                        iisDebugOut((LOG_TYPE_ERROR, _T("UpdateAnonymousUser:ModifyRightToUserAccount:Account=%s,righ %s,err=0x%0X.\n"), account, pstrRights[i], status));
                    }
                }
            }
        }
    }
}


DWORD ModifyRightToUserAccount(LPCTSTR szAccountName,LPTSTR PrivilegeName, INT iDoAdd)
{
    BOOL fEnabled = FALSE;
    NTSTATUS status;
	LSA_UNICODE_STRING UserRightString;
    LSA_HANDLE PolicyHandle = NULL;

    // Create a LSA_UNICODE_STRING for the privilege name.
    InitLsaString(&UserRightString, (LPTSTR) PrivilegeName);

    // get the sid of szAccountName
    PSID pSID = NULL;
    BOOL bWellKnownSID = FALSE;

    status = GetPrincipalSID ((LPTSTR)szAccountName, &pSID, &bWellKnownSID);
    if (status != ERROR_SUCCESS) 
    {
        iisDebugOut((LOG_TYPE_ERROR, _T("ModifyRightToUserAccount:GetPrincipalSID:Account=%s, err=0x%0X.\n"), szAccountName, status));
        return (status);
    }

    status = OpenPolicy(NULL, POLICY_ALL_ACCESS,&PolicyHandle);
    if ( status == NERR_Success )
    {
        LSA_UNICODE_STRING *rgUserRights = NULL;

        if (iDoAdd)
        {
		    status = LsaAddAccountRights (
			    	 PolicyHandle,
				     pSID,
				     &UserRightString,
				     1);
        }
        else
        {
            status = LsaRemoveAccountRights (
                     PolicyHandle,
                     pSID,
                     FALSE,
                     &UserRightString,
                     1);
        }
    }

    if (PolicyHandle)
    {
        LsaClose(PolicyHandle);
    }
    if (pSID) 
    {
        if (bWellKnownSID)
        {
            FreeSid (pSID);
        }
        else
        {
            free (pSID);
        }
    }
    return status;
}


BOOL IsUserExist( LPWSTR strUsername )
{
    BYTE *pBuffer;
    INT err = NERR_Success;
   
    do
    {
        WCHAR *pMachineName = NULL;

        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().Start.")));
        err = NetServerGetInfo( NULL, 101, &pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().End.")));
        
        //  make sure we are not backup docmain first
        if (err != NERR_Success )
        {
            // if this call returns that the service is not running, then let's just assume that the user does exist!!!!
            if (err == NERR_ServerNotStarted)
            {
                // Try to start the server service.
                err = InetStartService(_T("LanmanServer"));
                if (err == 0 || err == ERROR_SERVICE_ALREADY_RUNNING)
                {
                    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().Start.")));
                    err = NetServerGetInfo( NULL, 101, &pBuffer );
                    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().End.")));
                    if (err != NERR_Success )
                    {
                        if (err == NERR_ServerNotStarted)
                        {
                            iisDebugOut((LOG_TYPE_WARN, _T("NetServerGetInfo:failed.The Server service is not started. assume that %s exists.err=0x%x.\n"),strUsername,err));
                            err = NERR_Success;
                        }
                    }
                }
                else
                {
                    iisDebugOut((LOG_TYPE_ERROR, _T("NetServerGetInfo:failed.The Server service is not started. assume that %s exists.err=0x%x.\n"),strUsername,err));
                    err = NERR_Success;
                }
            }
            else
            {
                iisDebugOut((LOG_TYPE_ERROR, _T("NetServerGetInfo:failed.Do not call this on PDC or BDC takes too long.This must be a PDC or BDC.err=0x%x.\n"),err));
            }
            break;
        }

        LPSERVER_INFO_101 pInfo = (LPSERVER_INFO_101)pBuffer;
        if (( pInfo->sv101_type & SV_TYPE_DOMAIN_BAKCTRL ) != 0 )
        {
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetGetDCName().Start.")));
            NetGetDCName( NULL, NULL, (LPBYTE*)&pMachineName );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetGetDCName().End.")));
        }

        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
        NetApiBufferFree( pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));

        if (pMachineName){iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NetUserGetInfo:[%s\\%s].Start.\n"),pMachineName,strUsername));}
        else{iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NetUserGetInfo:[(null)\\%s].Start.\n"),strUsername));}
       
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetUserGetInfo().Start.")));
        err = NetUserGetInfo( pMachineName, strUsername, 3, &pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetUserGetInfo().End.")));

        if (pMachineName){iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NetUserGetInfo:[%s\\%s].End.Ret=0x%x.\n"),pMachineName,strUsername,err));}
        else{iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NetUserGetInfo:[(null)\\%s].End.\n"),strUsername));}

        if ( err == NERR_Success )
        {
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
            NetApiBufferFree( pBuffer );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
        }
        if ( pMachineName != NULL )
        {
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
            NetApiBufferFree( pMachineName );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
        }

    } while (FALSE);

    return(err == NERR_Success );
}


//
// Create InternetGuest Account
//
INT CreateUser( LPCTSTR szUsername, LPCTSTR szPassword, LPCTSTR szComment, LPCTSTR szFullName, BOOL fiWamUser,INT *NewlyCreated)
{
    iisDebugOut((LOG_TYPE_TRACE, _T("CreateUser: %s\n"), szUsername));
    INT iTheUserAlreadyExists = FALSE;
    INT err = NERR_Success;

    INT iTheUserIsMissingARight = FALSE;

    BYTE *pBuffer;
    WCHAR defGuest[UNLEN+1];
    TCHAR defGuestGroup[GNLEN+1];
    WCHAR wchGuestGroup[GNLEN+1];
    WCHAR wchUsername[UNLEN+1];
    WCHAR wchPassword[LM20_PWLEN+1];
    WCHAR *pMachineName = NULL;

    *NewlyCreated = 0;
    
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserName:Start.\n")));
    GetGuestUserName(defGuest);
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserName:End.\n")));

    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestGrpName:Start.\n")));
    GetGuestGrpName(defGuestGroup);
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestGrpName:End.\n")));

    iisDebugOut((LOG_TYPE_TRACE, _T("defGuest=%s, defGuestGroup=%s\n"), defGuest, defGuestGroup));

    memset((PVOID)wchUsername, 0, sizeof(wchUsername));
    memset((PVOID)wchPassword, 0, sizeof(wchPassword));
#if defined(UNICODE) || defined(_UNICODE)
    wcsncpy(wchGuestGroup, defGuestGroup, GNLEN);
    wcsncpy(wchUsername, szUsername, UNLEN);
    wcsncpy(wchPassword, szPassword, LM20_PWLEN);
#else
    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)defGuestGroup, -1, (LPWSTR)wchGuestGroup, GNLEN);
    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)szUsername, -1, (LPWSTR)wchUsername, UNLEN);
    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)szPassword, -1, (LPWSTR)wchPassword, LM20_PWLEN);
#endif

    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserGetInfo:(%s) Start.\n"),defGuest));
    err = NetUserGetInfo( NULL, defGuest, 3, &pBuffer );
    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserGetInfo:(%s) End.Ret=0x%x.\n"),defGuest,err));

    if ( err == NERR_Success )
    {
        do
        {
            WCHAR wchComment[MAXCOMMENTSZ+1];
            WCHAR wchFullName[UNLEN+1];

            memset((PVOID)wchComment, 0, sizeof(wchComment));
            memset((PVOID)wchFullName, 0, sizeof(wchFullName));
#if defined(UNICODE) || defined(_UNICODE)
            wcsncpy(wchComment, szComment, MAXCOMMENTSZ);
            wcsncpy(wchFullName, szFullName, UNLEN);
#else
            MultiByteToWideChar(CP_ACP, 0, (LPCSTR)szComment, -1, (LPWSTR)wchComment, MAXCOMMENTSZ);
            MultiByteToWideChar(CP_ACP, 0, (LPCSTR)szFullName, -1, (LPWSTR)wchFullName, UNLEN);
#endif
            USER_INFO_3 *lpui3 = (USER_INFO_3 *)pBuffer;

            lpui3->usri3_name = wchUsername;
            lpui3->usri3_password = wchPassword;
            lpui3->usri3_flags &= ~ UF_ACCOUNTDISABLE;
            lpui3->usri3_flags |= UF_DONT_EXPIRE_PASSWD;
            lpui3->usri3_acct_expires = TIMEQ_FOREVER;

            lpui3->usri3_comment = wchComment;
            lpui3->usri3_usr_comment = wchComment;
            lpui3->usri3_full_name = wchFullName;
            lpui3->usri3_primary_group_id = DOMAIN_GROUP_RID_USERS;

            DWORD parm_err;

            iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserAdd():Start.\n")));
            err = NetUserAdd( NULL, 3, pBuffer, &parm_err );
            iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserAdd():End.Ret=0x%x.\n"),err));

            if ( err == NERR_NotPrimary )
            {
                // it is a backup dc
                iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():Start.\n")));
                err = NetGetDCName( NULL, NULL, (LPBYTE *)&pMachineName );
                iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():End.Ret=0x%x\n"),err));

                if (err != NERR_Success)
                {
                    MyMessageBox(NULL, _T("CreateUser:NetGetDCName"), err, MB_OK | MB_SETFOREGROUND);
                    break;
                }
                else 
                {
                    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserAdd().Start.")));
                    err = NetUserAdd( pMachineName, 3, pBuffer, &parm_err );
                    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserAdd().End.")));
                }
            }
            else if ( err == NERR_UserExists )
            {
                iTheUserAlreadyExists = TRUE;
                iisDebugOut((LOG_TYPE_TRACE, _T("CreateUser:User Already exists. reusing.")));
                // see if we can just change the password.
                if (TRUE == ChangeUserPassword((LPTSTR) szUsername, (LPTSTR) szPassword))
                {
                    err = NERR_Success;
                }
            }

            if ( err != NERR_Success )
            {
                MyMessageBox(NULL, _T("CreateUser:NetUserAdd"), err, MB_OK | MB_SETFOREGROUND);
                break;
            }

        } while (FALSE);
        if ( pMachineName != NULL )
        {
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
            NetApiBufferFree( pMachineName );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
        }
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
        NetApiBufferFree( pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
    }
    if ( err == NERR_Success ) 
    {
        if (iTheUserAlreadyExists)
        {
            // if its the the iwam user, then make sure they are not part of the Guests Group by removing them
            if (fiWamUser)
            {
                RegisterAccountToLocalGroup(szUsername, _T("Guests"), FALSE);
            }
        }
        else
        {
            // User was successfully newly created
            *NewlyCreated = 1;

            // add it to the guests group
            // (but don't do it for the iwam user)
            if (!fiWamUser)
            {
                RegisterAccountToLocalGroup(szUsername, _T("Guests"), TRUE);
            }
        }

        if (fiWamUser)
        {
            UpdateUserRights(szUsername,g_pstrRightsFor_IWAM,sizeof(g_pstrRightsFor_IWAM)/sizeof(LPTSTR), TRUE);
        }
        else
        {
            UpdateUserRights(szUsername,g_pstrRightsFor_IUSR,sizeof(g_pstrRightsFor_IUSR)/sizeof(LPTSTR), TRUE);
        }
    }

    if (TRUE == iTheUserAlreadyExists)
        {*NewlyCreated = 2;}

    // Clear password to be safe
    SecureZeroMemory( wchPassword, sizeof( wchPassword ) );

    return err;
}

INT DeleteGuestUser(LPCTSTR szUsername, INT *UserWasDeleted)
{
    iisDebugOut((LOG_TYPE_TRACE, _T("DeleteGuestUser:%s\n"), szUsername));

    INT err = NERR_Success;
    BYTE *pBuffer;
    *UserWasDeleted = 0;

    WCHAR wchUsername[UNLEN+1];
#if defined(UNICODE) || defined(_UNICODE)
    wcsncpy(wchUsername, szUsername, UNLEN);
#else
    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)szUsername, -1, (LPWSTR)wchUsername, UNLEN);
#endif

    if (FALSE == IsUserExist(wchUsername)) 
    {
        *UserWasDeleted = 1;
        iisDebugOut((LOG_TYPE_TRACE, _T("DeleteGuestUser return. %s doesn't exist.\n"), szUsername));
        return err;
    }

    // remove it from the guests group
    RegisterAccountToLocalGroup(szUsername, _T("Guests"), FALSE);

    // remove certain user rights of this account
    UpdateUserRights(szUsername,g_pstrRightsFor_AnyUserRemoval,sizeof(g_pstrRightsFor_AnyUserRemoval)/sizeof(LPTSTR), FALSE);

    do
    {
        WCHAR *pMachine = NULL;

        //  make sure we are not backup docmain first
        iisDebugOut((LOG_TYPE_TRACE, _T("NetServerGetInfo:Start.\n")));
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().Start.")));
        err = NetServerGetInfo( NULL, 101, &pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetServerGetInfo().End.")));
        if (err != NERR_Success )
        {
            iisDebugOut((LOG_TYPE_ERROR, _T("NetServerGetInfo:failed.err=0x%x.\n"),err));
            break;
        }
        iisDebugOut((LOG_TYPE_TRACE, _T("NetServerGetInfo:End.\n")));

        LPSERVER_INFO_101 pInfo = (LPSERVER_INFO_101)pBuffer;
        if (( pInfo->sv101_type & SV_TYPE_DOMAIN_BAKCTRL ) != 0 )
        {
            iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():Start.\n")));
            NetGetDCName( NULL, NULL, (LPBYTE *)&pMachine);
            iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():End.\n")));
        }

        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
        NetApiBufferFree( pBuffer );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));

        iisDebugOut((LOG_TYPE_TRACE, _T("NetUserDel:Start.\n")));
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetUserDel().Start.")));
        INT err = ::NetUserDel( pMachine, wchUsername );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetUserDel().End.")));
        iisDebugOut((LOG_TYPE_TRACE, _T("NetUserDel:End.Ret=0x%x.\n"),err));

        if (err == NERR_Success)
        {
            *UserWasDeleted = 1;
        }
        if ( pMachine != NULL )
        {
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().Start.")));
            NetApiBufferFree( pMachine );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("NETAPI32.dll:NetApiBufferFree().End.")));
        }
    } while(FALSE);

    iisDebugOut((LOG_TYPE_TRACE, _T("DeleteGuestUser:%s. End. Return 0x%x\n"), szUsername, err));
    return err;
}

BOOL GuestAccEnabled()
{
    BOOL fEnabled = FALSE;
    INT err = NERR_Success;

    BYTE *pBuffer;
    WCHAR defGuest[UNLEN+1];
    
    GetGuestUserName(defGuest);

    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserGetInfo:Start.\n")));
    err = NetUserGetInfo( NULL, defGuest, 3, &pBuffer );
    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetUserGetInfo:End.Ret=0x%x.\n"),err));

    if ( err == NERR_Success )
    {
        USER_INFO_3 *lpui3 = (USER_INFO_3 *)pBuffer;
        fEnabled = ( lpui3->usri3_flags & UF_ACCOUNTDISABLE ) == 0;
    }
    return fEnabled;
    
}


NET_API_STATUS
NetpNtStatusToApiStatus (
    IN NTSTATUS NtStatus
    )

/*++

Routine Description:

    This function takes an NT status code and maps it to the appropriate
    LAN Man error code.

Arguments:

    NtStatus - Supplies the NT status.

Return Value:

    Returns the appropriate LAN Man error code for the NT status.

--*/
{
    NET_API_STATUS error;

    //
    // A small optimization for the most common case.
    //
    if ( NtStatus == STATUS_SUCCESS ) {
        return NERR_Success;
    }


    switch ( NtStatus ) {

        case STATUS_BUFFER_TOO_SMALL :
            return NERR_BufTooSmall;

        case STATUS_FILES_OPEN :
            return NERR_OpenFiles;

        case STATUS_CONNECTION_IN_USE :
            return NERR_DevInUse;

        case STATUS_INVALID_LOGON_HOURS :
            return NERR_InvalidLogonHours;

        case STATUS_INVALID_WORKSTATION :
            return NERR_InvalidWorkstation;

        case STATUS_PASSWORD_EXPIRED :
            return NERR_PasswordExpired;

        case STATUS_ACCOUNT_EXPIRED :
            return NERR_AccountExpired;

        case STATUS_REDIRECTOR_NOT_STARTED :
            return NERR_NetNotStarted;

        case STATUS_GROUP_EXISTS:
                return NERR_GroupExists;

        case STATUS_INTERNAL_DB_CORRUPTION:
                return NERR_InvalidDatabase;

        case STATUS_INVALID_ACCOUNT_NAME:
                return NERR_BadUsername;

        case STATUS_INVALID_DOMAIN_ROLE:
        case STATUS_INVALID_SERVER_STATE:
        case STATUS_BACKUP_CONTROLLER:
                return NERR_NotPrimary;

        case STATUS_INVALID_DOMAIN_STATE:
                return NERR_ACFNotLoaded;

        case STATUS_MEMBER_IN_GROUP:
                return NERR_UserInGroup;

        case STATUS_MEMBER_NOT_IN_GROUP:
                return NERR_UserNotInGroup;

        case STATUS_NONE_MAPPED:
        case STATUS_NO_SUCH_GROUP:
                return NERR_GroupNotFound;

        case STATUS_SPECIAL_GROUP:
        case STATUS_MEMBERS_PRIMARY_GROUP:
                return NERR_SpeGroupOp;

        case STATUS_USER_EXISTS:
                return NERR_UserExists;

        case STATUS_NO_SUCH_USER:
                return NERR_UserNotFound;

        case STATUS_PRIVILEGE_NOT_HELD:
                return ERROR_ACCESS_DENIED;

        case STATUS_LOGON_SERVER_CONFLICT:
                return NERR_LogonServerConflict;

        case STATUS_TIME_DIFFERENCE_AT_DC:
                return NERR_TimeDiffAtDC;

        case STATUS_SYNCHRONIZATION_REQUIRED:
                return NERR_SyncRequired;

        case STATUS_WRONG_PASSWORD_CORE:
                return NERR_BadPasswordCore;

        case STATUS_DOMAIN_CONTROLLER_NOT_FOUND:
                return NERR_DCNotFound;

        case STATUS_PASSWORD_RESTRICTION:
                return NERR_PasswordTooShort;

        case STATUS_ALREADY_DISCONNECTED:
                return NERR_Success;

        default:

            //
            // Use the system routine to do the mapping to ERROR_ codes.
            //

#ifndef WIN32_CHICAGO
            error = RtlNtStatusToDosError( NtStatus );

            if ( error != (NET_API_STATUS)NtStatus ) {
                return error;
            }
#endif // WIN32_CHICAGO

            //
            // Could not map the NT status to anything appropriate.
            // Write this to the eventlog file
            //

            return NERR_InternalError;
    }
} // NetpNtStatusToApiStatus


NET_API_STATUS
UaspGetDomainId(
    IN LPCWSTR ServerName OPTIONAL,
    OUT PSAM_HANDLE SamServerHandle OPTIONAL,
    OUT PPOLICY_ACCOUNT_DOMAIN_INFO * AccountDomainInfo
    )
/*++
Routine Description:
    Return a domain ID of the account domain of a server.
Arguments:
    ServerName - A pointer to a string containing the name of the
        Domain Controller (DC) to query.  A NULL pointer
        or string specifies the local machine.
    SamServerHandle - Returns the SAM connection handle if the caller wants it.
    DomainId - Receives a pointer to the domain ID.
        Caller must deallocate buffer using NetpMemoryFree.
Return Value:
    Error code for the operation.
--*/
{
    NET_API_STATUS NetStatus;
    NTSTATUS Status;

    SAM_HANDLE LocalSamHandle = NULL;

    ACCESS_MASK LSADesiredAccess;
    LSA_HANDLE  LSAPolicyHandle = NULL;
    OBJECT_ATTRIBUTES LSAObjectAttributes;

    UNICODE_STRING ServerNameString;


    //
    // Connect to the SAM server
    //
    RtlInitUnicodeString( &ServerNameString, ServerName );

    Status = SamConnect(
                &ServerNameString,
                &LocalSamHandle,
                SAM_SERVER_LOOKUP_DOMAIN,
                NULL);

    if ( !NT_SUCCESS(Status)) 
    {
        LocalSamHandle = NULL;
        NetStatus = NetpNtStatusToApiStatus( Status );
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("UaspGetDomainId: Cannot connect to Sam. err=0x%x\n"),NetStatus));
        goto Cleanup;
    }


    //
    // Open LSA to read account domain info.
    //
    
    if ( AccountDomainInfo != NULL) {
        //
        // set desired access mask.
        //
        LSADesiredAccess = POLICY_VIEW_LOCAL_INFORMATION;

        InitializeObjectAttributes( &LSAObjectAttributes,
                                      NULL,             // Name
                                      0,                // Attributes
                                      NULL,             // Root
                                      NULL );           // Security Descriptor

        Status = LsaOpenPolicy( &ServerNameString,
                                &LSAObjectAttributes,
                                LSADesiredAccess,
                                &LSAPolicyHandle );

        if( !NT_SUCCESS(Status) ) {
            NetStatus = NetpNtStatusToApiStatus( Status );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("UaspGetDomainId: Cannot open LSA Policy %lX\n"),NetStatus));
            goto Cleanup;
        }


        //
        // now read account domain info from LSA.
        //

        Status = LsaQueryInformationPolicy(
                        LSAPolicyHandle,
                        PolicyAccountDomainInformation,
                        (PVOID *) AccountDomainInfo );

        if( !NT_SUCCESS(Status) ) {
            NetStatus = NetpNtStatusToApiStatus( Status );
            iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("UaspGetDomainId: Cannot read LSA.Err=0x%x.\n"),NetStatus));
            goto Cleanup;
        }
    }

    //
    // Return the SAM connection handle to the caller if he wants it.
    // Otherwise, disconnect from SAM.
    //

    if ( ARGUMENT_PRESENT( SamServerHandle ) ) {
        *SamServerHandle = LocalSamHandle;
        LocalSamHandle = NULL;
    }

    NetStatus = NERR_Success;

    //
    // Cleanup locally used resources
    //
Cleanup:
    if ( LocalSamHandle != NULL ) {
        (VOID) SamCloseHandle( LocalSamHandle );
    }

    if( LSAPolicyHandle != NULL ) {
        LsaClose( LSAPolicyHandle );
    }

    return NetStatus;
} // UaspGetDomainId


NET_API_STATUS
SampCreateFullSid(
    IN PSID DomainSid,
    IN ULONG Rid,
    OUT PSID *AccountSid
    )
/*++
Routine Description:
    This function creates a domain account sid given a domain sid and
    the relative id of the account within the domain.
    The returned Sid may be freed with LocalFree.
--*/
{
    NET_API_STATUS NetStatus;
    NTSTATUS    IgnoreStatus;
    UCHAR       AccountSubAuthorityCount;
    ULONG       AccountSidLength;
    PULONG      RidLocation;

    //
    // Calculate the size of the new sid
    //
    AccountSubAuthorityCount = *RtlSubAuthorityCountSid(DomainSid) + (UCHAR)1;
    AccountSidLength = RtlLengthRequiredSid(AccountSubAuthorityCount);

    //
    // Allocate space for the account sid
    //
    *AccountSid = LocalAlloc(LMEM_ZEROINIT,AccountSidLength);
    if (*AccountSid == NULL) 
    {
        NetStatus = ERROR_NOT_ENOUGH_MEMORY;
    }
    else 
    {
        //
        // Copy the domain sid into the first part of the account sid
        //
        IgnoreStatus = RtlCopySid(AccountSidLength, *AccountSid, DomainSid);
        ASSERT(NT_SUCCESS(IgnoreStatus));

        //
        // Increment the account sid sub-authority count
        //
        *RtlSubAuthorityCountSid(*AccountSid) = AccountSubAuthorityCount;

        //
        // Add the rid as the final sub-authority
        //
        RidLocation = RtlSubAuthoritySid(*AccountSid, AccountSubAuthorityCount-1);
        *RidLocation = Rid;

        //iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("AccountSid=0x%x"),*AccountSid));

        NetStatus = NERR_Success;
    }

    return(NetStatus);
}



int GetGuestUserNameForDomain_FastWay(LPTSTR szDomainToLookUp,LPTSTR lpGuestUsrName)
{
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserNameForDomain_FastWay.start.domain=%s\n"),szDomainToLookUp));
    int iReturn = FALSE;
    NET_API_STATUS NetStatus;

    // for UaspGetDomainId()
    SAM_HANDLE SamServerHandle = NULL;
    PPOLICY_ACCOUNT_DOMAIN_INFO pAccountDomainInfo = NULL;

    PSID pAccountSid = NULL;
    PSID pDomainSid = NULL;

    // for LookupAccountSid()
    SID_NAME_USE sidNameUse = SidTypeUser;
    SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
    TCHAR szUserName[UNLEN+1];
    DWORD cbName = UNLEN+1;
    // must be big enough to hold something bigger than DNLen since LookupAccountSid may returnn something really big.
    TCHAR szReferencedDomainName[200];
    DWORD cbReferencedDomainName = sizeof(szReferencedDomainName);

    ASSERT(lpGuestUsrName);

    // make sure not to return back gobble-d-gook
    _tcscpy(lpGuestUsrName, _T(""));

    //
    // Get the Sid for the specified Domain
    //
    // szDomainToLookUp=NULL for local machine
    NetStatus = UaspGetDomainId( szDomainToLookUp,&SamServerHandle,&pAccountDomainInfo );
    if ( NetStatus != NERR_Success ) 
    {
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserNameForDomain:UaspGetDomainId failed.ret=0x%x."),NetStatus));
        goto GetGuestUserNameForDomain_FastWay_Exit;
    }
    pDomainSid = pAccountDomainInfo->DomainSid;
    //
    // Use the Domain Sid and the well known Guest RID to create the Real Guest Sid
    //
    // Well-known users ...
    // DOMAIN_USER_RID_ADMIN          (0x000001F4L)
    // DOMAIN_USER_RID_GUEST          (0x000001F5L)
    NetStatus = NERR_InternalError;
    NetStatus = SampCreateFullSid(pDomainSid, DOMAIN_USER_RID_GUEST, &pAccountSid);
    if ( NetStatus != NERR_Success ) 
    {
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserNameForDomain:SampCreateFullSid failed.ret=0x%x."),NetStatus));
        goto GetGuestUserNameForDomain_FastWay_Exit;
    }

    //
    // Check if the SID is valid
    //
    if (0 == IsValidSid(pAccountSid))
    {
        DWORD dwErr = GetLastError();
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserNameForDomain:IsValidSid FAILED.  GetLastError()= 0x%x\n"), dwErr));
        goto GetGuestUserNameForDomain_FastWay_Exit;
    }

    //
    // Retrieve the UserName for the specified SID
    //
    _tcscpy(szUserName, _T(""));
    _tcscpy(szReferencedDomainName, _T(""));
    // szDomainToLookUp=NULL for local machine
    if (!LookupAccountSid(szDomainToLookUp, pAccountSid, szUserName, &cbName, szReferencedDomainName, &cbReferencedDomainName, &sidNameUse))
    {
        DWORD dwErr = GetLastError();
        iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("GetGuestUserNameForDomain:LookupAccountSid FAILED.  GetLastError()= 0x%x\n"), dwErr));
        goto GetGuestUserNameForDomain_FastWay_Exit;
    }

    //iisDebugOut((LOG_TYPE_TRACE, _T("GetGuestUserNameForDomain:szDomainToLookUp=%s\n"),szDomainToLookUp));
    //iisDebugOut((LOG_TYPE_TRACE, _T("GetGuestUserNameForDomain:pAccountSid=0x%x\n"),pAccountSid));
    //iisDebugOut((LOG_TYPE_TRACE, _T("GetGuestUserNameForDomain:szUserName=%s\n"),szUserName));
    //iisDebugOut((LOG_TYPE_TRACE, _T("GetGuestUserNameForDomain:szReferencedDomainName=%s\n"),szReferencedDomainName));

    // Return the guest user name that we got.
    _tcscpy(lpGuestUsrName, szUserName);

    // Wow, after all that, we must have succeeded
    iReturn = TRUE;

GetGuestUserNameForDomain_FastWay_Exit:
    // Free the Domain info if we got some
    if (pAccountDomainInfo) {NetpMemoryFree(pAccountDomainInfo);}
    // Free the sid if we had allocated one
    if (pAccountSid) {LocalFree(pAccountSid);}
    iisDebugOut((LOG_TYPE_TRACE, _T("GetGuestUserNameForDomain_FastWay.end.domain=%s.ret=%d.\n"),szDomainToLookUp,iReturn));
    return iReturn;
}


void GetGuestUserName(LPTSTR lpOutGuestUsrName)
{
    // try to retrieve the guest username the fast way
    // meaning = lookup the domain sid, and the well known guest rid, to get the guest sid.
    // then look it up.  The reason for this function is that on large domains with mega users
    // the account can be quickly looked up.
    TCHAR szGuestUsrName[UNLEN+1];
    LPTSTR pszComputerName = NULL;
    if (!GetGuestUserNameForDomain_FastWay(pszComputerName,szGuestUsrName))
    {
        iisDebugOut((LOG_TYPE_WARN, _T("GetGuestUserNameForDomain_FastWay:Did not succeed use slow way. WARNING.")));

        // if the fast way failed for some reason, then let's do it
        // the slow way, since this way always used to work, only on large domains (1 mil users) 
        // it could take 24hrs (since this function actually enumerates thru the domain)
        GetGuestUserName_SlowWay(szGuestUsrName);
    }

    // Return back the username
    _tcscpy(lpOutGuestUsrName,szGuestUsrName);

    return;
}


int ChangeUserPassword(IN LPTSTR szUserName, IN LPTSTR szNewPassword)
{
    int iReturn = TRUE;
    USER_INFO_1003  pi1003; 
    NET_API_STATUS  nas; 

    TCHAR szRawComputerName[CNLEN + 10];
    DWORD dwLen = CNLEN + 10;
    TCHAR szComputerName[CNLEN + 10];
    TCHAR szCopyOfUserName[UNLEN+10];
    TCHAR szTempFullUserName[(CNLEN + 10) + (DNLEN+1)];
    LPTSTR pch = NULL;

    _tcscpy(szCopyOfUserName, szUserName);

    //iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("ChangeUserPassword().Start.name=%s,pass=%s"),szCopyOfUserName,szNewPassword));
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("ChangeUserPassword().Start.name=%s"),szCopyOfUserName));

    if ( !GetComputerName( szRawComputerName, &dwLen ))
        {goto ChangeUserPassword_Exit;}

    // Make a copy to be sure not to move the pointer around.
    SafeCopy(szTempFullUserName, szCopyOfUserName, sizeof(szTempFullUserName)/sizeof(TCHAR));
    // Check if there is a "\" in there.
    pch = _tcschr(szTempFullUserName, _T('\\'));
    if (pch) 
        {
            // szCopyOfUserName should now go from something like this:
            // mycomputer\myuser
            // to this myuser
            SafeCopy(szCopyOfUserName,pch+1, sizeof(szTempFullUserName)/sizeof(TCHAR));
            // trim off the '\' character to leave just the domain\computername so we can check against it.
            *pch = _T('\0');
            // compare the szTempFullUserName with the local computername.
            if (0 == _tcsicmp(szRawComputerName, szTempFullUserName))
            {
                // the computername\username has a hardcoded computername in it.
                // lets try to get only the username
                // look szCopyOfusername is already set
            }
            else
            {
                // the local computer machine name
                // and the specified username are different, so get out
                // and don't even try to change this user\password since
                // it's probably a domain\username

                // return true -- saying that we did in fact change the passoword.
                // we really didn't but we can't
                iReturn = TRUE;
                goto ChangeUserPassword_Exit;
            }
        }


    // Make sure the computername has a \\ in front of it
    if ( szRawComputerName[0] != _T('\\') )
        {SafeCopy(szComputerName,_T("\\\\"), sizeof(szComputerName)/sizeof(TCHAR));}
    SafeCat(szComputerName,szRawComputerName, sizeof(szComputerName)/sizeof(TCHAR));
    // 
    // administrative over-ride of existing password 
    // 
    // by this time szCopyOfUserName
    // should not look like mycomputername\username but it should look like username.
    pi1003.usri1003_password = szNewPassword;
     nas = NetUserSetInfo(
            szComputerName,   // computer name 
            szCopyOfUserName, // username 
            1003,             // info level 
            (LPBYTE)&pi1003,  // new info 
            NULL 
            ); 

    if(nas != NERR_Success) 
    {
        iReturn = FALSE;
        goto ChangeUserPassword_Exit;
    }

ChangeUserPassword_Exit:
    iisDebugOut((LOG_TYPE_TRACE_WIN32_API, _T("ChangeUserPassword().End.Ret=%d"),iReturn));
    return iReturn; 
} 


DWORD DoesUserHaveThisRight(LPCTSTR szAccountName,LPTSTR PrivilegeName,BOOL *fHaveThatRight)
{
    iisDebugOut((LOG_TYPE_TRACE, _T("DoesUserHaveBasicRights:Account=%s\n"), szAccountName));
    BOOL fEnabled = FALSE;
    NTSTATUS status;
	LSA_UNICODE_STRING UserRightString;
    LSA_HANDLE PolicyHandle = NULL;

    *fHaveThatRight = FALSE;

    // Create a LSA_UNICODE_STRING for the privilege name.
    InitLsaString(&UserRightString, PrivilegeName);

    // get the sid of szAccountName
    PSID pSID = NULL;
    BOOL bWellKnownSID = FALSE;

    status = GetPrincipalSID ((LPTSTR)szAccountName, &pSID, &bWellKnownSID);
    if (status != ERROR_SUCCESS) 
    {
        iisDebugOut((LOG_TYPE_ERROR, _T("DoesUserHaveBasicRights:GetPrincipalSID:Account=%s, err=%d.\n"), szAccountName, status));
        return status;
    }

    status = OpenPolicy(NULL, POLICY_ALL_ACCESS,&PolicyHandle);
    if ( status == NERR_Success )
    {
		UINT i;
        LSA_UNICODE_STRING *rgUserRights = NULL;
		ULONG cRights;
	
		status = LsaEnumerateAccountRights(
				 PolicyHandle,
				 pSID,
				 &rgUserRights,
				 &cRights);

		if (status==STATUS_OBJECT_NAME_NOT_FOUND)
        {
			// no rights/privileges for this account
            status = ERROR_SUCCESS;
			fEnabled = FALSE;
		}
		else if (!NT_SUCCESS(status)) 
        {
            iisDebugOut((LOG_TYPE_ERROR, _T("DoesUserHaveBasicRights:GetPrincipalSID:Failed to enumerate rights: status 0x%08lx\n"), status));
			goto DoesUserHaveBasicRights_Exit;
		}

		for(i=0; i < cRights; i++) 
        {
            if ( RtlEqualUnicodeString(&rgUserRights[i],&UserRightString,FALSE) ) 
            {
                fEnabled = TRUE;
                break;
            }
		}
		
        if (rgUserRights) 
        {
            LsaFreeMemory(rgUserRights);
        }
    }

DoesUserHaveBasicRights_Exit:

    if (PolicyHandle)
    {
        LsaClose(PolicyHandle);
    }
    if (pSID) 
    {
        if (bWellKnownSID)
        {
            FreeSid (pSID);
        }
        else
        {
            free (pSID);
        }
    }

    *fHaveThatRight = fEnabled;
    return status;
}

// function: DoesUserExist
//
// Check if a user exists
//
BOOL
DoesUserExist( LPCTSTR szAccountName, LPBOOL pbExists )
{
  PSID pSid = NULL;
  BOOL bWellKnownSID;
  BOOL bRet = FALSE;
  int  err;

  err = GetPrincipalSID ((LPTSTR)szAccountName, &pSid, &bWellKnownSID);

  if ( err == ERROR_SUCCESS )
  {
    *pbExists = TRUE;
    bRet = TRUE;

    if ( pSid ) 
    {
      // Free the Sid that was created
      if ( bWellKnownSID )
      {
        FreeSid (pSid);
      }
      else
      {
        free (pSid);
      }
    }
  }
  else
    if ( err == ERROR_NONE_MAPPED )
    {
      *pbExists = FALSE;
      bRet = TRUE;
    }

  return bRet;
}

HRESULT CreateGroup(LPCTSTR szGroupName, LPCTSTR szGroupComment, int iAction, int iFlagForSpecialGroup)
{
    HRESULT           hr = S_OK;
    NET_API_STATUS    dwRes;
    LOCALGROUP_INFO_1 MyLocalGroup;

    WCHAR wszLocalGroupName[_MAX_PATH];
    WCHAR wszLocalGroupComment[_MAX_PATH];

    memset(&MyLocalGroup, 0, sizeof(MyLocalGroup));

#if defined(UNICODE) || defined(_UNICODE)
    _tcscpy(wszLocalGroupName, szGroupName);
    _tcscpy(wszLocalGroupComment, szGroupComment);
#else
    MultiByteToWideChar( CP_ACP, 0, szGroupName, -1, wszLocalGroupName, _MAX_PATH);
    MultiByteToWideChar( CP_ACP, 0, szGroupComment, -1, wszLocalGroupComment, _MAX_PATH);
#endif

    MyLocalGroup.lgrpi1_name    = (LPWSTR)szGroupName;
    MyLocalGroup.lgrpi1_comment = (LPWSTR)szGroupComment;

    if (iAction)
    {
      // Add Group
      dwRes = ::NetLocalGroupAdd( NULL, 1, (LPBYTE)&MyLocalGroup, NULL );
      if(dwRes != NERR_Success       &&
         dwRes != NERR_GroupExists   &&
         dwRes != ERROR_ALIAS_EXISTS  )
      {
          hr = HRESULT_FROM_WIN32(dwRes);
      }

      // if it's for the special group
      // then make sure it has required right.
      if (iFlagForSpecialGroup)
      {
          UpdateUserRights(szGroupName,g_pstrRightsFor_IIS_WPG,sizeof(g_pstrRightsFor_IIS_WPG)/sizeof(LPTSTR), TRUE);
      }
    }
    else
    {
      // Remove Group
      BOOL bExists;

      if ( DoesUserExist( szGroupName, &bExists ) &&
           ( bExists == FALSE ) )
      {
        // Nothing necessary to do, so quit
        return S_OK;
      }

      if (iFlagForSpecialGroup)
      {
          UpdateUserRights(szGroupName,g_pstrRightsFor_IIS_WPG,sizeof(g_pstrRightsFor_IIS_WPG)/sizeof(LPTSTR), FALSE);
      }

      dwRes = ::NetLocalGroupDel( NULL, wszLocalGroupName);
      if(dwRes != NERR_Success       &&
         dwRes != NERR_GroupNotFound   &&
         dwRes != ERROR_NO_SUCH_ALIAS   )
      {
          hr = HRESULT_FROM_WIN32(dwRes);
      }
    }

    return hr;
}


int CreateGroupDC(LPTSTR szGroupName, LPCTSTR szGroupComment)
{
    int iReturn = FALSE;
    GROUP_INFO_1 GI1;
    ULONG   BadParm;
    WCHAR * pMachineName = NULL;
    ULONG   ulErr = ERROR_SUCCESS;
    WCHAR wszLocalGroupName[_MAX_PATH];
    WCHAR wszLocalGroupComment[_MAX_PATH];

    memset(&GI1, 0, sizeof(GROUP_INFO_1));

#if defined(UNICODE) || defined(_UNICODE)
    _tcscpy(wszLocalGroupName, szGroupName);
    _tcscpy(wszLocalGroupComment, szGroupComment);
#else
    MultiByteToWideChar( CP_ACP, 0, szGroupName, -1, wszLocalGroupName, _MAX_PATH);
    MultiByteToWideChar( CP_ACP, 0, szGroupComment, -1, wszLocalGroupComment, _MAX_PATH);
#endif


    GI1.grpi1_name      = wszLocalGroupName;
    GI1.grpi1_comment   = wszLocalGroupComment;


    iisDebugOut((LOG_TYPE_TRACE, _T("CreateGroup:NetGroupAdd\n")));
    ulErr = NetGroupAdd(NULL,1,(PBYTE)&GI1,&BadParm);
    iisDebugOut((LOG_TYPE_TRACE, _T("CreateGroup:NetGroupAdd,ret=0x%x\n"),ulErr));
	switch (ulErr) 
	    {
        case NERR_Success:
            iisDebugOut((LOG_TYPE_TRACE, _T("CreateGroup:NetGroupAdd,success\n"),ulErr));
            iReturn = TRUE;
            break;
        case NERR_GroupExists:
            iReturn = TRUE;
    		break;
        case NERR_InvalidComputer:
            iReturn = FALSE;
		    break;
        case NERR_NotPrimary:
            {
                // it is a backup dc
                int err;
                iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():Start.\n")));
                err = NetGetDCName( NULL, NULL, (LPBYTE *)&pMachineName );
                iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGetDCName():End.Ret=0x%x\n"),err));
                if (err != NERR_Success)
                {
                    MyMessageBox(NULL, _T("CreateUser:NetGetDCName"), err, MB_OK | MB_SETFOREGROUND);
                }
                else 
                {
                    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGroupAdd().Start.")));
                    ulErr = NetGroupAdd(pMachineName,1,(PBYTE)&GI1,&BadParm);
                    iisDebugOut((LOG_TYPE_TRACE, _T("NETAPI32.dll:NetGroupAdd().End.")));
                    if (NERR_Success == ulErr || NERR_GroupExists == ulErr)
                    {
                        iReturn = TRUE;
                    }
                }
            }
            break;
        case ERROR_ACCESS_DENIED:
            iReturn = FALSE;
		    break;
        default:
            iReturn = FALSE;
		    break;
	    }

    return iReturn;
}


/*
    Check if wszGroup name is present on the local computer
    Returns true if exists
*/
BOOL LocalGroupExists( IN LPCWSTR wszGroupName )
{
    BOOL    bRes    = FALSE;
    LPBYTE  pbtData = NULL;

    if ( ::NetLocalGroupGetInfo( NULL, wszGroupName, 1, &pbtData ) == NERR_Success )
    {
        bRes = TRUE;
    }
    
    if ( pbtData != NULL ) ::NetApiBufferFree( pbtData );

    iisDebugOut((LOG_TYPE_TRACE, _T("LocalGroupExists( '%s' ) returned %s"), wszGroupName, bRes ? _T("Yes") : _T("No") ));

    return bRes;        
}


#endif //_CHICAGO_