windows-xp/Source/XPSP1/NT/admin/admt/pwdsvc/pwdrpc.cpp

/*---------------------------------------------------------------------------
  File: PwdRpc.cpp

  Comments:  RPC interface for Password Migration Lsa Notification Package
             and other internal functions.

  REVISION LOG ENTRY
  Revision By: Paul Thompson
  Revised on 09/04/00

 ---------------------------------------------------------------------------
*/


#include "Pwd.h"
#include <lmcons.h>
#include <comdef.h>
#include <malloc.h>
#include "PwdSvc.h"
#include "McsDmMsg.h"
#include "AdmtCrypt2.h"
#include "pwdfuncs.h"
#include "TReg.hpp"
#include "IsAdmin.hpp"
#include "ResStr.h"
#include "TxtSid.h"
#include "resource.h"
#include <MsPwdMig.h>

/* global definitions */
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define STATUS_NULL_LM_PASSWORD          ((NTSTATUS)0x4000000DL)
#define LM_BUFFER_LENGTH    (LM20_PWLEN + 1)
typedef NTSTATUS (CALLBACK * LSAIWRITEAUDITEVENT)(PSE_ADT_PARAMETER_ARRAY, ULONG);

/* global variables */
CRITICAL_SECTION	csADMTCriticalSection; //critical sectio to protect concurrent first-time access
SAMPR_HANDLE		hgDomainHandle = NULL; //domain handle used in password calls
LM_OWF_PASSWORD		NullLmOwfPassword; //NULL representation of an LM Owf Password
NT_OWF_PASSWORD		NullNtOwfPassword; //NULL representation of an NT Owf Password
HCRYPTPROV g_hProvider = 0;
HCRYPTKEY g_hSessionKey = 0;
HANDLE	hEventSource;
HMODULE hLsaDLL = NULL;
LSAIWRITEAUDITEVENT LsaIWriteAuditEvent = NULL;
PWCHAR	pDomain = NULL;
BOOL LsapCrashOnAuditFail = TRUE;
int nOSVer = 4;
BOOL bWhistlerDC = FALSE;


/* Checks if this machine is running Whistler OS or something even newer and the OS major verison number, sets global variables accordingly */
void GetOS()
{
/* local constants */
   const int	WINDOWS_2000_BUILD_NUMBER = 2195;

/* local variables */
   TRegKey		verKey, regComputer;
   DWORD		rc = 0;
   WCHAR		sBuildNum[MAX_PATH];

/* function body */
	  //connect to the DC's HKLM registry key
   rc = regComputer.Connect(HKEY_LOCAL_MACHINE, NULL);
   if (rc == ERROR_SUCCESS)
   {
         //see if this machine is running Windows XP or newer by checking the
		 //build number in the registry.  If not, then we don't need to check
		 //for the new security option
      rc = verKey.OpenRead(L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",&regComputer);
	  if (rc == ERROR_SUCCESS)
	  {
			//get the CurrentBuildNumber string
	     rc = verKey.ValueGetStr(L"CurrentBuildNumber", sBuildNum, MAX_PATH);
		 if (rc == ERROR_SUCCESS) 
		 {
			int nBuild = _wtoi(sBuildNum);
		    if (nBuild <= WINDOWS_2000_BUILD_NUMBER)
               bWhistlerDC = FALSE;
			else
               bWhistlerDC = TRUE;
		 }
			//get the Version Number
	     rc = verKey.ValueGetStr(L"CurrentVersion", sBuildNum, MAX_PATH);
		 if (rc == ERROR_SUCCESS) 
			nOSVer = _wtoi(sBuildNum);
	  }
   }
   return;
}


_bstr_t GetString(DWORD dwID)
{
/* local variables */
	HINSTANCE		m_hInstance = NULL;
	WCHAR			sBuffer[1000];
	int				len;
	_bstr_t			bstrRet;
	
/* function body */
	m_hInstance = LoadLibrary(L"PwMig.dll");

    len = LoadString(m_hInstance, dwID, sBuffer, 1000);
	bstrRet = sBuffer;
	if (m_hInstance)
		FreeLibrary(m_hInstance);
	return bstrRet;
}


/***************************
 * Event Logging Functions *
 ***************************/

 
/*++

Routine Description:

    Implements current policy of how to deal with a failed audit.

Arguments:

    None.

Return Value:

    None.

--*/
void LsapAuditFailed(NTSTATUS AuditStatus)
{
/* local variables */
    NTSTATUS	Status;
    ULONG		Response;
    ULONG_PTR	HardErrorParam;
    BOOLEAN		PrivWasEnabled;
	TRegKey		verKey, regComputer;
	DWORD		rc = 0;
	WCHAR		sBuildNum[MAX_PATH];
	DWORD		crashVal;
	BOOL		bRaiseError = FALSE;


/* function body */
		//connect to this machine's HKLM registry key
	rc = regComputer.Connect(HKEY_LOCAL_MACHINE, NULL);
	if (rc == ERROR_SUCCESS)
	{
         //open the LSA key and see if crash on audit failed is turned on
		rc = verKey.Open(L"SYSTEM\\CurrentControlSet\\Control\\Lsa",&regComputer);
		if (rc == ERROR_SUCCESS)
		{
				//get the CrashOnAuditFail value
			rc = verKey.ValueGetDWORD(CRASH_ON_AUDIT_FAIL_VALUE, &crashVal);
			if (rc == ERROR_SUCCESS) 
			{ 
				   //if crash on audit fail is set, turn off the flag
				if (crashVal == LSAP_CRASH_ON_AUDIT_FAIL)
				{
					bRaiseError = TRUE; //set flag to raise hard error
					rc = verKey.ValueSetDWORD(CRASH_ON_AUDIT_FAIL_VALUE, LSAP_ALLOW_ADIMIN_LOGONS_ONLY);
					if (rc == ERROR_SUCCESS)
					{
							//flush the key to disk
						do 
						{
							Status = NtFlushKey(verKey.KeyGet());
						} while ((Status == STATUS_INSUFFICIENT_RESOURCES) || (Status == STATUS_NO_MEMORY));
						ASSERT(NT_SUCCESS(Status));
					}
				}
			}
		}
	}

		//if needed,  raise a hard error
	if (bRaiseError)
	{
		HardErrorParam = AuditStatus;

			// enable the shutdown privilege so that we can bugcheck
		Status = RtlAdjustPrivilege(SE_SHUTDOWN_PRIVILEGE, TRUE, FALSE, &PrivWasEnabled);

		Status = NtRaiseHardError(
						 STATUS_AUDIT_FAILED,
						 1,
						 0,
						 &HardErrorParam,
						 OptionShutdownSystem,
						 &Response);
	}
	return;
}


/*Routine Description:

    Find out if auditing is enabled for a certain event category and
    event success/failure case.

Arguments:

    AuditCategory - Category of event to be audited.
        e.g. AuditCategoryPolicyChange

    AuditEventType - status type of event
        e.g. EVENTLOG_AUDIT_SUCCESS or EVENTLOG_AUDIT_FAILURE

Return Value:

    TRUE or FALSE
*/
BOOL LsapAdtIsAuditingEnabledForCategory(POLICY_AUDIT_EVENT_TYPE AuditCategory,
										 UINT AuditEventType)
{
   BOOL						 bSuccess = FALSE;
   LSA_OBJECT_ATTRIBUTES     ObjectAttributes;
   NTSTATUS                  status = 0;
   LSA_HANDLE                hPolicy;
    
   ASSERT((AuditEventType == EVENTLOG_AUDIT_SUCCESS) ||
          (AuditEventType == EVENTLOG_AUDIT_FAILURE));

      //attempt to open the policy.
   ZeroMemory(&ObjectAttributes, sizeof(ObjectAttributes));//object attributes are reserved, so initalize to zeroes.
   status = LsaOpenPolicy(	NULL,
							&ObjectAttributes,
							POLICY_ALL_ACCESS, 
							&hPolicy);  //recieves the policy handle

   if (NT_SUCCESS(status))
   {
         //ask for audit event policy information
      PPOLICY_AUDIT_EVENTS_INFO   info;
      status = LsaQueryInformationPolicy(hPolicy, PolicyAuditEventsInformation, (PVOID *)&info);
      if (NT_SUCCESS(status))
      {
		    //if auditing is enabled, see if enable for this type
		 if (info->AuditingMode)
		 {
			POLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions;
			EventAuditingOptions = info->EventAuditingOptions[AuditCategory];

			bSuccess = (AuditEventType == EVENTLOG_AUDIT_SUCCESS) ?
						(BOOL) (EventAuditingOptions & POLICY_AUDIT_EVENT_SUCCESS):
						(BOOL) (EventAuditingOptions & POLICY_AUDIT_EVENT_FAILURE);
		 }

		 LsaFreeMemory((PVOID) info); //free policy info structure
      }
      
      LsaClose(hPolicy); //Freeing the policy object handle
   }
    
   return bSuccess;
}


/*++

Routine Description:

    This routine impersonates our client, opens the thread token, and
    extracts the User Sid.  It puts the Sid in memory allocated via
    LsapAllocateLsaHeap, which must be freed by the caller.

Arguments:

    None.

Return Value:

    Returns a pointer to heap memory containing a copy of the Sid, or
    NULL.

--*/
NTSTATUS LsapQueryClientInfo(PTOKEN_USER *UserSid, PLUID AuthenticationId)
{
	NTSTATUS Status = STATUS_SUCCESS;
    HANDLE TokenHandle;
    ULONG ReturnLength;
    TOKEN_STATISTICS TokenStats;

	   //impersonate the caller
    Status = I_RpcMapWin32Status(RpcImpersonateClient(NULL));

    if (!NT_SUCCESS(Status))
        return( Status );

	   //open the thread token
    Status = NtOpenThreadToken(
                     NtCurrentThread(),
                     TOKEN_QUERY,
                     TRUE,                    // OpenAsSelf
                     &TokenHandle);

    if (!NT_SUCCESS(Status))
	{
		I_RpcMapWin32Status(RpcRevertToSelf());
        return( Status );
	}

	   //revert to self
    Status = I_RpcMapWin32Status(RpcRevertToSelf());
	ASSERT(NT_SUCCESS(Status));

	   //get the size of the token information
    Status = NtQueryInformationToken (
                 TokenHandle,
                 TokenUser,
                 NULL,
                 0,
                 &ReturnLength);

    if (Status != STATUS_BUFFER_TOO_SMALL) 
	{
        NtClose(TokenHandle);
        return( Status );
    }

	   //allocate memory to hold the token info
    *UserSid = (PTOKEN_USER)malloc(ReturnLength);

    if (*UserSid == NULL) 
	{
        NtClose(TokenHandle);
        return( STATUS_INSUFFICIENT_RESOURCES );
    }

	   //get the token info
    Status = NtQueryInformationToken (
                 TokenHandle,
                 TokenUser,
                 *UserSid,
                 ReturnLength,
                 &ReturnLength);


    if (!NT_SUCCESS(Status)) 
	{
        NtClose(TokenHandle);
        free(*UserSid);
        *UserSid = NULL;
        return( Status );
    }

	   //get the authentication ID
	ReturnLength = 0;
    Status = NtQueryInformationToken (
                 TokenHandle,
                 TokenStatistics,
                 (PVOID)&TokenStats,
                 sizeof(TOKEN_STATISTICS),
                 &ReturnLength);

    NtClose(TokenHandle);

    if (!NT_SUCCESS(Status)) 
	{
        free(*UserSid);
        *UserSid = NULL;
        return( Status );
    }

    *AuthenticationId = TokenStats.AuthenticationId;

	return Status;
}


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 23 APR 2001                                                 *
 *                                                                   *
 *     This function is responsible for generating a                 *
 * SE_AUDITID_PASSWORD_HASH_ACCESS event in the security log. This   *
 * function is called to generate that message when a user password  *
 * hash is retrieved by the ADMT password filter DLL.                *
 * All these event logging functions are copied and modified from LSA*
 * code written by others.                                           *
 *                                                                   *
 * Parameters:                                                       *
 * EventType - EVENTLOG_AUDIT_SUCCESS or EVENTLOG_AUDIT_FAILURE      *
 * pszTargetUserName - name of user whose password is being retrieved*
 * pszTargetUserDomain - domain of user whose password is being      *
 *                       retrieved                                   *
 *                                                                   *
 * Return Value:                                                     *
 * HRESULT - Standard Return Result                                  *
 *                                                                   *
 *********************************************************************/

//BEGIN LsaAuditPasswordAccessEvent
HRESULT LsaAuditPasswordAccessEvent(USHORT EventType, 
									PCWSTR pszTargetUserName,
									PCWSTR pszTargetUserDomain)
{
/* local constants */
	const int W2K_VERSION_NUMBER = 5;

/* local variables */
	HRESULT hr = S_OK;   
    NTSTATUS Status = STATUS_SUCCESS;
    LUID ClientAuthenticationId;
    PTOKEN_USER TokenUserInformation=NULL;
    SE_ADT_PARAMETER_ARRAY AuditParameters = { 0 };
    PSE_ADT_PARAMETER_ARRAY_ENTRY Parameter;
    UNICODE_STRING TargetUser;
    UNICODE_STRING TargetDomain;
    UNICODE_STRING SubsystemName;
    UNICODE_STRING Explanation;
	_bstr_t sExplainText;

/* function body */
		//if parameters are invalid, return
    if ( !((EventType == EVENTLOG_AUDIT_SUCCESS) ||
           (EventType == EVENTLOG_AUDIT_FAILURE))   ||
         !pszTargetUserName  || !pszTargetUserDomain ||
         !*pszTargetUserName || !*pszTargetUserDomain )
    {
		return (HRESULT_FROM_WIN32(LsaNtStatusToWinError(STATUS_INVALID_PARAMETER)));
    }

		//if auditing is not enabled, return asap
    if (!LsapAdtIsAuditingEnabledForCategory(AuditCategoryAccountManagement, EventType))
		return S_OK;

    // get caller info from the thread token
    Status = LsapQueryClientInfo( &TokenUserInformation, &ClientAuthenticationId );
    if (!NT_SUCCESS( Status ))
    {
        LsapAuditFailed(Status);
		return (HRESULT_FROM_WIN32(LsaNtStatusToWinError(Status)));
    }

	   //If Whistler, init parameters and write event
	if (bWhistlerDC)
	{
			//init UNICODE_STRINGS
		RtlInitUnicodeString(&TargetUser, pszTargetUserName);
		RtlInitUnicodeString(&TargetDomain, pszTargetUserDomain);
		RtlInitUnicodeString(&SubsystemName, L"Security");

			//set the audit paramter header information
		RtlZeroMemory((PVOID) &AuditParameters, sizeof(AuditParameters));
//		AuditParameters.CategoryId     = SE_CATEGID_ACCOUNT_MANAGEMENT;
		AuditParameters.CategoryId     = AuditCategoryAccountManagement;
		AuditParameters.AuditId        = SE_AUDITID_PASSWORD_HASH_ACCESS;
		AuditParameters.Type           = EventType;

			//now set the audit parameters for this OS.  Parameters are added to the structure using macros 
			//defined in LsaParamMacros.h
		AuditParameters.ParameterCount = 0;
		LsapSetParmTypeSid(AuditParameters, AuditParameters.ParameterCount, TokenUserInformation->User.Sid);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &SubsystemName);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &TargetUser);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &TargetDomain);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeLogonId(AuditParameters, AuditParameters.ParameterCount, ClientAuthenticationId);
		AuditParameters.ParameterCount++;

			//Write to the security log
	    Status = LsaIWriteAuditEvent(&AuditParameters, 0);
	    if (!NT_SUCCESS(Status))
		      LsapAuditFailed(Status);

		//do not free the TargetUser string since it is still being used
		//do not free the TargetDomain string since it is a global variable
		RtlFreeUnicodeString(&SubsystemName);
	}//end if Whistler

	   //else if W2K, init parameters and write event
	else if ((!bWhistlerDC) && (nOSVer == W2K_VERSION_NUMBER))
	{
			//init UNICODE_STRINGS
		RtlInitUnicodeString(&TargetUser, pszTargetUserName);
		RtlInitUnicodeString(&TargetDomain, pszTargetUserDomain);
		RtlInitUnicodeString(&SubsystemName, L"Security");
			//if not Whistler the audit message will be vague as to its intent, therefore we will add some 
			//explanation text
		sExplainText = GetString(IDS_EVENT_PWD_HASH_W2K_EXPLAIN);
		RtlInitUnicodeString(&Explanation, (WCHAR*)sExplainText);

			//set the audit paramter header information
		RtlZeroMemory((PVOID) &AuditParameters, sizeof(AuditParameters));
//		AuditParameters.CategoryId     = SE_CATEGID_ACCOUNT_MANAGEMENT;
		AuditParameters.CategoryId     = AuditCategoryAccountManagement;
		AuditParameters.AuditId        = SE_AUDITID_PASSWORD_HASH_ACCESS;
		AuditParameters.Type           = EventType;

			//now set the audit parameters for this OS.  Parameters are added to the structure using macros 
			//defined in LsaParamMacros.h
		AuditParameters.ParameterCount = 0;
		LsapSetParmTypeSid(AuditParameters, AuditParameters.ParameterCount, TokenUserInformation->User.Sid);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &SubsystemName);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &TargetUser);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &TargetDomain);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeLogonId(AuditParameters, AuditParameters.ParameterCount, ClientAuthenticationId);
		AuditParameters.ParameterCount++;
		LsapSetParmTypeString(AuditParameters, AuditParameters.ParameterCount, &Explanation);
		AuditParameters.ParameterCount++;

			//Write to the security log
	    Status = LsaIWriteAuditEvent(&AuditParameters, 0);
	    if (!NT_SUCCESS(Status))
		      LsapAuditFailed(Status);

		//do not free the TargetUser string since it is still being used
		//do not free the TargetDomain string since it is a global variable
		RtlFreeUnicodeString(&SubsystemName);
		RtlFreeUnicodeString(&Explanation);
	}//end if Whistler


    if (TokenUserInformation != NULL) 
        free(TokenUserInformation);
		      
	return (HRESULT_FROM_WIN32(LsaNtStatusToWinError(Status)));
}


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 8 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for retrieving the caller's sid. *
 * We will use this prior to logging an event log.                   *
 *                                                                   *
 *********************************************************************/

//BEGIN GetCallerSid
DWORD GetCallerSid(PSID *pCallerSid)
{
/* local variables */
   DWORD                     rc, rc2;
   HANDLE                    hToken = NULL;
   TOKEN_USER                tUser[10];
   ULONG                     len;
   
/* function body */
   rc = (DWORD)RpcImpersonateClient(NULL);
   if (!rc)
   {
      if ( OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &hToken) )
	  {
         if ( GetTokenInformation(hToken,TokenUser,tUser,10*(sizeof TOKEN_USER),&len) )
            *pCallerSid = (SID*)tUser[0].User.Sid;
         else
            rc = GetLastError();

         CloseHandle(hToken);
	  }
      else
         rc = GetLastError();

      rc2 = (DWORD)RpcRevertToSelf();
	  if (rc2)
	     rc = rc2;
   }

   return rc;
}
//END GetCallerSid


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 19 SEPT 2000                                                *
 *                                                                   *
 *     This function is responsible for logging major events in Event*
 * Viewer.                                                           *
 *                                                                   *
 *********************************************************************/

//BEGIN LogEvent
void LogPwdEvent(const WCHAR* srcName, bool bAuditSuccess)
{
/* local variables */
   USHORT					wType;
   DWORD					rc = 0;
   BOOL						rcBool;

/* function body */
   if (bAuditSuccess)
	  wType = EVENTLOG_AUDIT_SUCCESS;
   else
	  wType = EVENTLOG_AUDIT_FAILURE;

      //if NT4.0, write to the Security Event Log as you would any log
   if (nOSVer == 4)
   {
      PSID	pCallerSid = NULL;
	  GetCallerSid(&pCallerSid); //get the caller's SID
      if ((pCallerSid) && (hEventSource))
	  {
		 LPTSTR pStringArray[1];
		 WCHAR  msg[2000];
		 WCHAR  txtSid[MAX_PATH];
         DWORD  lenTxt = MAX_PATH;

		    //prepare the msg to display
         if (!GetTextualSid(pCallerSid,txtSid,&lenTxt))
			 wcscpy(txtSid, L"");
		 swprintf(msg, GetString(IDS_EVENT_PWD_HASH_RETRIEVAL), srcName, pDomain, txtSid);
		 pStringArray[0] = msg;

			//log the event
	     rcBool = ReportEventW(hEventSource,            // handle of event source
                            wType,                      // event type
							SE_CATEGID_ACCOUNT_MANAGEMENT,// event category
							SE_AUDITID_PASSWORD_HASH_ACCESS,// event ID
							NULL,                       // current user's SID
							1,                          // strings in lpszStrings
							0,                          // no bytes of raw data
							(LPCTSTR *)pStringArray,    // array of error strings
							NULL );                     // no raw data
         if ( !rcBool )
            rc = GetLastError();
	  }
   }
   else  //else write the event by requesting LSA to do it for us
   {
	     //if not already done, late bind to LsaIWriteAuditEvent since it is not present on an NT 4.0 box
	  if (!LsaIWriteAuditEvent)
	  {
	     hLsaDLL = LoadLibrary(L"LsaSrv.dll");
         if ( hLsaDLL )
            LsaIWriteAuditEvent = (LSAIWRITEAUDITEVENT)GetProcAddress(hLsaDLL, "LsaIWriteAuditEvent");
	  }

	  if (LsaIWriteAuditEvent)
         LsaAuditPasswordAccessEvent(wType, srcName, pDomain);
   }
}
//END LogEvent

/*******************************
 * Event Logging Functions End *
 *******************************/

/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 8 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for obtaining the account domain *
 * sid.  This sid will be later used to Open the domain via SAM.     *
 *                                                                   *
 *********************************************************************/

//BEGIN GetDomainSid
NTSTATUS GetDomainSid(PSID * pDomainSid)
{
/* local variables */
   LSA_OBJECT_ATTRIBUTES     ObjectAttributes;
   NTSTATUS                  status = 0;
   LSA_HANDLE                hPolicy;
   HRESULT                   hr = 0;

/* function body */
      //object attributes are reserved, so initalize to zeroes.
   ZeroMemory(&ObjectAttributes, sizeof(ObjectAttributes));
   

      //attempt to open the policy.
   status = LsaOpenPolicy(
                NULL,
                &ObjectAttributes,
                POLICY_ALL_ACCESS, 
                &hPolicy  //recieves the policy handle
                );

   if (NT_SUCCESS(status))
   {
         //ask for account domain policy information
      PPOLICY_ACCOUNT_DOMAIN_INFO   info;
      status = LsaQueryInformationPolicy(hPolicy, PolicyAccountDomainInformation, (PVOID *)&info);
      if (NT_SUCCESS(status))
      {
            //save the domain sid
         DWORD sidLen = GetLengthSid(info->DomainSid);
         *pDomainSid = new BYTE[sidLen];
		 if (*pDomainSid)
	        CopySid(sidLen, *pDomainSid, info->DomainSid);
		 else
		    status = STATUS_INSUFFICIENT_RESOURCES;

		    //save the domain name
		 USHORT uLen = info->DomainName.Length / sizeof(WCHAR);
		 pDomain = new WCHAR[uLen + sizeof(WCHAR)];
		 if (pDomain)
		 {
		    wcsncpy(pDomain, info->DomainName.Buffer, uLen);
			pDomain[uLen] = L'\0';
		 }

            //free policy info structure
         LsaFreeMemory((PVOID) info);
      }
      
      //Freeing the policy object handle
      LsaClose(hPolicy);
   }

   return status;
}
//END GetDomainSid


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 8 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for obtaining a domain handle    *
 * used repeatedly by our interface function CopyPassword.           *
 *     For optimization, this function should only be called once per*
 * the life of this dll.                                             *
 *      This function also gets an Event Handle to the event log.    *
 *                                                                   *
 *********************************************************************/

//BEGIN GetDomainHandle
NTSTATUS GetDomainHandle(SAMPR_HANDLE *pDomainHandle)
{
/* local variables */
   PSID           pDomainSid;
   NTSTATUS       status;
   SAMPR_HANDLE   hServerHandle;
   SAMPR_HANDLE   hDomainHandle;

/* function body */
      //get the account domain sid
   status = GetDomainSid(&pDomainSid);

   if (NT_SUCCESS(status))
   {
	     //connect to the Sam and get a server handle
      status = SamIConnect(NULL, 
						   &hServerHandle, 
						   POLICY_ALL_ACCESS, 
						   TRUE);
      if (NT_SUCCESS(status))
	  {
		    //get the account domain handle
         status = SamrOpenDomain(hServerHandle,
								 POLICY_ALL_ACCESS,
								 (PRPC_SID)pDomainSid,
								 &hDomainHandle);
		 if (NT_SUCCESS(status))
		    *pDomainHandle = hDomainHandle;
		    //close the SamIConnect server handle
		 SamrCloseHandle(&hServerHandle);
	  }
      FreeSid(pDomainSid);
   }

   return status;
}
//END GetDomainHandle


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 8 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for retrieving the global domain *
 * handle.  If we don't have the handle yet, it calls the externally *
 * defined GetDomainHandle funtion to get the handle.  The handle    *
 * retrieval code is placed in a critical section.  Subsequent       *
 * calls to this functin merely return the handle.                   *
 *     I will also use this function to fill the global NULL         *
 * LmOwfPassword structure for possible use.  This should be done    *
 * one time only.                                                    *
 *                                                                   *
 *********************************************************************/

//BEGIN RetrieveDomainHandle
HRESULT RetrieveDomainHandle(SAMPR_HANDLE *pDomainHandle)
{
/* local constants */
  const WCHAR * svcName = L"Security";

/* local variables */
  NTSTATUS			status = 0;
  HRESULT			hr = ERROR_SUCCESS;

/* function body */
  __try
  {
	    //enter the critical section
     EnterCriticalSection(&csADMTCriticalSection);

	    //if not yet retrieved, get the global handle and fill the NULL
	    //LmOwfPassword structure
	 if (hgDomainHandle == NULL)
	 {
		   //get the domain handle
		status = GetDomainHandle(&hgDomainHandle);
	    if (NT_SUCCESS(status))
		   pDomainHandle = &hgDomainHandle;

		GetOS(); //set global variable as to whether this DC's OS

		   //if NT4.0 OS on this DC, then set the event handle for logging events
		if (nOSVer == 4)
		{
		   NTSTATUS Status;
		   BOOLEAN PrivWasEnabled;
			  //make sure we have audit and debug privileges
		   RtlAdjustPrivilege( SE_SECURITY_PRIVILEGE, TRUE, FALSE, &PrivWasEnabled );
		   RtlAdjustPrivilege( SE_DEBUG_PRIVILEGE, TRUE, FALSE, &PrivWasEnabled );
		   RtlAdjustPrivilege( SE_AUDIT_PRIVILEGE, TRUE, FALSE, &PrivWasEnabled );
		   //register this dll with the eventlog, get a handle, and store globally
		   hEventSource = RegisterEventSourceW(NULL, svcName);
		   if (!hEventSource)
			   DWORD rc = GetLastError();
		}


           //fill a global NULL LmOwfPassword in case we need it later
        WCHAR			sNtPwd[MAX_PATH] = L"";
        UNICODE_STRING	UnicodePwd;
        ANSI_STRING     LmPassword;
		CHAR			sBuf[LM_BUFFER_LENGTH];
        
        RtlInitUnicodeString(&UnicodePwd, sNtPwd);

           //fill LmOwf NULL password
        LmPassword.Buffer = (PCHAR)&sBuf;
        LmPassword.MaximumLength = LmPassword.Length = LM_BUFFER_LENGTH;
        RtlZeroMemory( LmPassword.Buffer, LM_BUFFER_LENGTH );

        status = RtlUpcaseUnicodeStringToOemString( &LmPassword, &UnicodePwd, FALSE );
        if ( !NT_SUCCESS(status) ) 
		{
              //the password is longer than the max LM password length
           status = STATUS_NULL_LM_PASSWORD;
           RtlZeroMemory( LmPassword.Buffer, LM_BUFFER_LENGTH );
           RtlCalculateLmOwfPassword((PLM_PASSWORD)&LmPassword, &NullLmOwfPassword);
		}
		else
		{
           RtlCalculateLmOwfPassword((PLM_PASSWORD)&LmPassword, &NullLmOwfPassword);
	       RtlFreeOemString(&LmPassword);
		}

		   //fill NtOwf NULL password
        RtlCalculateNtOwfPassword((PNT_PASSWORD)&UnicodePwd, &NullNtOwfPassword);

        RtlFreeUnicodeString(&UnicodePwd);
	 }
  }
  __finally
  {
        // Release ownership and delete of the critical section
     LeaveCriticalSection(&csADMTCriticalSection);
  }

      //convert any error to a win error
  if (!NT_SUCCESS(status))
     hr = LsaNtStatusToWinError(status);

  return hr;
}
//END RetrieveDomainHandle


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 11 SEPT 2000                                                *
 *                                                                   *
 *     This function is responsible for retrieving the passwords for *
 * the given user's source domain account.  We use SAM APIs to       *
 * retrieve the LmOwf and NtOwf formats of the password.             *
 *                                                                   *
 *********************************************************************/

//BEGIN RetrieveEncrytedSourcePasswords
HRESULT RetrieveEncrytedSourcePasswords(const WCHAR* srcName, 
										 PLM_OWF_PASSWORD pSrcLmOwfPwd,
										 PNT_OWF_PASSWORD pSrcNtOwfPwd)
{
/* local variables */
   NTSTATUS				status = 0;
   HRESULT				hr = ERROR_SUCCESS;
   SAMPR_HANDLE			hUserHandle = NULL;
   ULONG				ulCount = 1;
   ULONG				userID;
   RPC_UNICODE_STRING	sNames[1];
   SAMPR_ULONG_ARRAY	ulIDs;
   SAMPR_ULONG_ARRAY	ulUse;
   PSAMPR_USER_INFO_BUFFER pInfoBuf = NULL;
   WCHAR			*   pName;

/* function body */
   pName = new WCHAR[wcslen(srcName)+1];
   if (!pName)
      return HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);

      //get the user's ID
   sNames[0].Length = sNames[0].MaximumLength = (USHORT)((wcslen(srcName)) * sizeof(WCHAR));
   wcscpy(pName, srcName);
   sNames[0].Buffer = pName;
   ulIDs.Element = NULL;
   ulUse.Element = NULL;
   status = SamrLookupNamesInDomain(hgDomainHandle,
								    ulCount,
									sNames,
									&ulIDs,
									&ulUse);
   delete [] pName;
   if (!NT_SUCCESS(status))
      return HRESULT_FROM_WIN32(LsaNtStatusToWinError(status));

   userID = *(ulIDs.Element);

      //get a user handle
   status = SamrOpenUser(hgDomainHandle,
						 POLICY_ALL_ACCESS,
						 userID,
						 &hUserHandle);
   if (!NT_SUCCESS(status))
   {
	  SamIFree_SAMPR_ULONG_ARRAY(&ulIDs);
	  SamIFree_SAMPR_ULONG_ARRAY(&ulUse);
      return HRESULT_FROM_WIN32(LsaNtStatusToWinError(status));
   }

      //get the user's password
   status = SamrQueryInformationUser(hUserHandle,
									 UserInternal3Information,
									 &pInfoBuf);
   if (NT_SUCCESS(status)) //if success, get LmOwf and NtOwf versions of the password
   {
	  if (pInfoBuf->Internal3.I1.NtPasswordPresent)
         memcpy(pSrcNtOwfPwd, pInfoBuf->Internal3.I1.NtOwfPassword.Buffer, sizeof(NT_OWF_PASSWORD));
	  else
         memcpy(pSrcNtOwfPwd, &NullNtOwfPassword, sizeof(NT_OWF_PASSWORD));
	  if (pInfoBuf->Internal3.I1.LmPasswordPresent)
         memcpy(pSrcLmOwfPwd, pInfoBuf->Internal3.I1.LmOwfPassword.Buffer, sizeof(LM_OWF_PASSWORD));
	  else //else we need to use the global NULL LmOwfPassword
         memcpy(pSrcLmOwfPwd, &NullLmOwfPassword, sizeof(LM_OWF_PASSWORD));
      SamIFree_SAMPR_USER_INFO_BUFFER (pInfoBuf, UserInternal3Information);
      LogPwdEvent(srcName, true);
   }
   else
      LogPwdEvent(srcName, false);


   SamIFree_SAMPR_ULONG_ARRAY(&ulIDs);
   SamIFree_SAMPR_ULONG_ARRAY(&ulUse);
   SamrCloseHandle(&hUserHandle);

   if (!NT_SUCCESS(status))
      hr = HRESULT_FROM_WIN32(LsaNtStatusToWinError(status));

   return hr;
}
//END RetrieveEncrytedSourcePasswords


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 11 SEPT 2000                                                *
 *                                                                   *
 *     This function is responsible for using the MSCHAP dll to      *
 * change the given target user's password.                          *
 *                                                                   *
 *********************************************************************/

//BEGIN SetTargetPassword
HRESULT SetTargetPassword(handle_t hBinding, const WCHAR* tgtServer, 
						  const WCHAR* tgtName, WCHAR* currentPwd, 
						  LM_OWF_PASSWORD newLmOwfPwd, NT_OWF_PASSWORD newNtOwfPwd)
{
/* local variables */ 
   NTSTATUS				status;
   HRESULT				hr = ERROR_SUCCESS;
   RPC_STATUS           rcpStatus;
   UNICODE_STRING       UnicodePwd;
   OEM_STRING			oemString;
   LM_OWF_PASSWORD		OldLmOwfPassword;
   NT_OWF_PASSWORD		OldNtOwfPassword;
   BOOLEAN				LmOldPresent = TRUE;
   int					nConvert;
   char					oldLmPwd[MAX_PATH];
   WCHAR			  * pTemp;


/* function body */
   pTemp = new WCHAR[wcslen(currentPwd)+1];
   if (!pTemp)
      return HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);

      //convert the old LmOwf password
   wcscpy(pTemp, currentPwd);
   _wcsupr(pTemp);
   RtlInitUnicodeString(&UnicodePwd, pTemp);
   status = RtlUpcaseUnicodeStringToOemString(&oemString, &UnicodePwd, TRUE);
   delete [] pTemp;
   if (NT_SUCCESS(status))
   {
	  if (status == STATUS_NULL_LM_PASSWORD)
	     LmOldPresent = FALSE;
	  else
	  {
	     strcpy(oldLmPwd, oemString.Buffer);
         status = RtlCalculateLmOwfPassword((PLM_PASSWORD)oldLmPwd, &OldLmOwfPassword);
	  }
	  RtlFreeOemString(&oemString);
   }

      //convert the old NtOwf password
//   RtlFreeUnicodeString(&UnicodePwd);
   RtlInitUnicodeString(&UnicodePwd, currentPwd);
   status = RtlCalculateNtOwfPassword(&UnicodePwd, &OldNtOwfPassword);
//   RtlFreeUnicodeString(&UnicodePwd);
   if (!NT_SUCCESS(status)) //if failed, leave
	  return HRESULT_FROM_WIN32(LsaNtStatusToWinError(status));

      //impersonate the caller when setting the password
   rcpStatus = RpcImpersonateClient(hBinding);

      //change the Password!
   status = MSChapSrvChangePassword(const_cast<WCHAR*>(tgtServer),
									const_cast<WCHAR*>(tgtName),
									LmOldPresent,
									&OldLmOwfPassword,
									&newLmOwfPwd,
									&OldNtOwfPassword,
									&newNtOwfPwd);

   if (rcpStatus == RPC_S_OK)
   {
      rcpStatus = RpcRevertToSelf();
      hr = HRESULT_FROM_WIN32(rcpStatus);
   }

   if (!NT_SUCCESS(status))
      hr = HRESULT_FROM_WIN32(LsaNtStatusToWinError(status));

   return hr;
}
//END SetTargetPassword


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 8 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for checking to make sure that   *
 * the calling client has the proper access on this machine and      *
 * domain to change someone's password.  We use a helper function to *
 * do the actual check.                                              *
 *                                                                   *
 *********************************************************************/

//BEGIN AuthenticateClient
DWORD 
   AuthenticateClient(
      handle_t               hBinding        // in - binding for client call
   )
{
/* local variables */
   DWORD                     rc;
   DWORD                     rc2;
   
/* function body */
   rc = (DWORD)RpcImpersonateClient(hBinding);
   if (!rc)
   {
      rc = IsAdminLocal();
      rc2 = (DWORD)RpcRevertToSelf();
	  if (rc2)
	     rc = rc2;
   }
   return rc;
}
//END AuthenticateClient


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 6 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for migrating the given user's   *
 * password from the source domain, in which this dll is running, to *
 * the given migrated target domain account.  We will retrieve the   *
 * old user's current password and set the new user's password to    *
 * match.                                                            *
 *                                                                   *
 *********************************************************************/

//BEGIN CopyPassword
DWORD __stdcall 
   CopyPassword( 
      /* [in] */         handle_t              hBinding,
      /* [string][in] */ const WCHAR __RPC_FAR *tgtServer,
      /* [string][in] */ const WCHAR __RPC_FAR *srcName,
      /* [string][in] */ const WCHAR __RPC_FAR *tgtName,
      /* [in] */         unsigned long          dwPwd,
      /* [size_is][in] */const char __RPC_FAR  *currentPwd
   )
{
   HRESULT                   hr = ERROR_SUCCESS;
   SAMPR_HANDLE              hDomain = NULL;
   LM_OWF_PASSWORD			 NewLmOwfPassword;
   NT_OWF_PASSWORD			 NewNtOwfPassword;
   NTSTATUS				     status;
   DWORD					 rc=0;
   PSID						 pCallerSid = NULL;
   _variant_t				 varPwd;
   _bstr_t					 bstrPwd;

      // validate parameters
   if ((tgtServer == NULL) || (srcName == NULL) || (tgtName == NULL) || 
	   (currentPwd == NULL) || (dwPwd <= 0))
   {
      return E_INVALIDARG;
   }

      //validate the buffer and the reported size
   if (IsBadReadPtr(currentPwd, dwPwd))
      return E_INVALIDARG;

      //make sure the client is an admin on the local machine, otherwise, forget it
   rc = AuthenticateClient(hBinding);
   if ( rc )
      return HRESULT_FROM_WIN32(rc); 

   try
   {
		  //convert the incoming byte array into a variant
	   varPwd = SetVariantWithBinaryArray(const_cast<char*>(currentPwd), dwPwd);
	   if ((varPwd.vt != (VT_UI1|VT_ARRAY)) || (varPwd.parray == NULL))
		  return E_INVALIDARG;

         //try to decrypt the password
		bstrPwd = AdmtDecrypt(g_hSessionKey, varPwd);
		if (!bstrPwd)
		   return GetLastError();
   }
   catch (_com_error& ce)
   {
	  return ce.Error();
   }
   catch (...)
   {
	  return E_FAIL;
   }

      //get the domain handle
   hr = RetrieveDomainHandle(&hDomain);
   if (hr == ERROR_SUCCESS)
   {
         //get the user's password from the source domain
      hr = RetrieveEncrytedSourcePasswords(srcName, &NewLmOwfPassword, &NewNtOwfPassword);
	  if (hr == ERROR_SUCCESS)
	  {
	        //set the target user's password to the source user's
	     hr = SetTargetPassword(hBinding, tgtServer, tgtName, (WCHAR*)bstrPwd, 
			                    NewLmOwfPassword, NewNtOwfPassword);
	  }
   }

   return hr;
}
//END CopyPassword


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 6 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for checking a registry value to *
 * make sure that the ADMT password migration Lsa notification       *
 * package is installed, running, and ready to migrate passwords.    *
 *                                                                   *
 *********************************************************************/

//BEGIN CheckConfig
DWORD __stdcall
   CheckConfig(
      /* [in] */         handle_t               hBinding,
      /* [in] */         unsigned long          dwSession,
      /* [size_is][in] */const char __RPC_FAR  *aSession,
      /* [in] */         unsigned long          dwPwd,
      /* [size_is][in] */const char __RPC_FAR  *aTestPwd,
      /* [out] */        WCHAR __RPC_FAR        tempPwd[PASSWORD_BUFFER_SIZE]
   )
{
   DWORD                     rc;
   DWORD				     rval;
   DWORD                     type;         // type of value
   DWORD                     len = sizeof rval; // value length
   HKEY						 hKey;
   _variant_t			     varPwd;
   _variant_t			     varSession;
   _bstr_t					 bstrPwd = L"";
   
      // validate parameters
   if ((aSession == NULL) || (aTestPwd == NULL) || (tempPwd == NULL) || 
	   (dwSession <= 0) || (dwPwd <= 0))
   {
      return E_INVALIDARG;
   }

      //validate the buffer and the reported size
   if ((IsBadReadPtr(aSession, dwSession)) || (IsBadReadPtr(aTestPwd, dwPwd)) || 
	   (IsBadWritePtr((LPVOID)tempPwd, PASSWORD_BUFFER_SIZE * sizeof(WCHAR))))
   {
      return E_INVALIDARG;
   }

      //make sure the client is an admin on the local machine, otherwise, forget it
   rc = AuthenticateClient(hBinding);
   if ( rc )
      return HRESULT_FROM_WIN32(rc); 

      //make sure the registry value is set for password migration
   rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
                     L"System\\CurrentControlSet\\Control\\Lsa",
                     0,
                     KEY_READ,
                     &hKey);
   if (rc == ERROR_SUCCESS)
   {
      rc = RegQueryValueEx(hKey, L"AllowPasswordExport", NULL, &type, (BYTE *)&rval, &len);
	  RegCloseKey(hKey);
      if ((rc == ERROR_SUCCESS) && (type == REG_DWORD) && (rval == 1))
         rc = ERROR_SUCCESS;
	  else
	     return PM_E_PASSWORD_MIGRATION_NOT_ENABLED;
   }

  try
   {
		//convert the incoming byte arrays into variants
		varSession = SetVariantWithBinaryArray(const_cast<char*>(aSession), dwSession);
		varPwd = SetVariantWithBinaryArray(const_cast<char*>(aTestPwd), dwPwd);
		if ((varSession.vt != (VT_UI1|VT_ARRAY)) || (varSession.parray == NULL) || 
			(varPwd.vt != (VT_UI1|VT_ARRAY)) || (varPwd.parray == NULL))
			return E_INVALIDARG;

		// acquire cryptographic service provider context

		if (g_hProvider == 0)
		{
			g_hProvider = AdmtAcquireContext();
		}

		// destroy any existing session key

		if (g_hSessionKey)
		{
			AdmtDestroyKey(g_hSessionKey);

			g_hSessionKey = 0;
		}

		// import new session key

		g_hSessionKey = AdmtImportSessionKey(g_hProvider, varSession);

		// decrypt password

		if (g_hSessionKey)
		{
			bstrPwd = AdmtDecrypt(g_hSessionKey, varPwd);
			if (!bstrPwd)
				return GetLastError();
		}
		else
			return GetLastError();
   
		  //send back the decrypted password
	   if (bstrPwd.length() > 0)
	   {
		  wcsncpy(tempPwd, bstrPwd, PASSWORD_BUFFER_SIZE);
		  tempPwd[PASSWORD_BUFFER_SIZE - 1] = L'\0';
	   }
	   else
	   {
		  tempPwd[0] = L'\0';
	   }
   }
   catch (_com_error& ce)
   {
	  return ce.Error();
   }
   catch (...)
   {
	  return E_FAIL;
   }

   return rc;
}
//END CheckConfig