windows-xp/Source/XPSP1/NT/ds/win32/ntcrypto/autoenrl/pautoenr/autoenro.cpp

//+-------------------------------------------------------------------------
//
//  Microsoft Windows
//
//  Copyright (C) Microsoft Corporation, 1997 - 2000
//
//  File:       autoenro.cpp
//
//--------------------------------------------------------------------------
#include <windows.h>
#include <winuser.h>
#include <wincrypt.h>
#include <cryptui.h>
#include <lmcons.h>
#include <lmapibuf.h>
#include <dsgetdc.h>
#include <oleauto.h>
#define SECURITY_WIN32
#include <rpc.h>
#include <security.h>
#include <winldap.h>
#include <dsrole.h>
#include <shobjidl.h>
#include <shellapi.h>
#include <commctrl.h>
#include <winscard.h>
#include <Rpcdce.h>

#include <certca.h>
#include <certsrv.h>
#include <autoenr.h>
#include <autoenro.h>
#include <autolog.h>
#include <resource.h>
#include <xenroll.h>

//*******************************************************************************
//
//
//     Global Defines and Data Structures
//
//
//*******************************************************************************


HINSTANCE   g_hmodThisDll = NULL;   // Handle to this DLL itself.

#if DBG
DWORD g_AutoenrollDebugLevel = AE_ERROR; //| AE_WARNING | AE_INFO | AE_TRACE;
#endif

//when we look at supersede relationship, we based on the following order
DWORD   g_rgdwSupersedeOrder[]={CERT_REQUEST_STATUS_OBTAINED,
                                CERT_REQUEST_STATUS_ACTIVE,
                                CERT_REQUEST_STATUS_PENDING,
                                CERT_REQUEST_STATUS_SUPERSEDE_ACTIVE};

DWORD   g_dwSupersedeOrder=sizeof(g_rgdwSupersedeOrder)/sizeof(g_rgdwSupersedeOrder[0]);


//the list of certificate store to update
AE_STORE_INFO   g_rgStoreInfo[]={
    L"ROOT",    L"ldap://%s/CN=Certification Authorities,CN=Public Key Services,CN=Services,%s?cACertificate?one?objectCategory=certificationAuthority",
    L"NTAuth",  L"ldap://%s/CN=Public Key Services,CN=Services,%s?cACertificate?one?cn=NTAuthCertificates",
    L"CA",      L"ldap://%s/CN=AIA,CN=Public Key Services,CN=Services,%s?crossCertificatePair,cACertificate?one?objectCategory=certificationAuthority"
};

DWORD   g_dwStoreInfo=sizeof(g_rgStoreInfo)/sizeof(g_rgStoreInfo[0]);

typedef   IEnroll4 * (WINAPI *PFNPIEnroll4GetNoCOM)();

static WCHAR * s_wszLocation = L"CN=Public Key Services,CN=Services,";

//Enhanced key usage for DS email replication
#ifndef CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE
#define CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE  0x00000400
#endif


//*******************************************************************************
//
//
//     Implementation of IQueryContinue for use autoenrollment notification
//
//
//*******************************************************************************
//--------------------------------------------------------------------------
//  CQueryContinue 
//--------------------------------------------------------------------------
CQueryContinue::CQueryContinue()
{
    m_cRef=1;
    m_pIUserNotification=NULL;
    m_hTimer=NULL;
}

//--------------------------------------------------------------------------
//  ~CQueryContinue 
//--------------------------------------------------------------------------
CQueryContinue::~CQueryContinue()
{


}

//--------------------------------------------------------------------------
//  CQueryContinue 
//--------------------------------------------------------------------------
HRESULT CQueryContinue::QueryInterface(REFIID riid, void **ppv)
{
    if(IsEqualIID(riid, IID_IUnknown) || IsEqualIID(riid, IID_IQueryContinue))
    {
        *ppv=(LPVOID)this;
        AddRef();
        return S_OK;
    }

    return E_NOINTERFACE;
}

//--------------------------------------------------------------------------
//  AddRef
//--------------------------------------------------------------------------
STDMETHODIMP_(ULONG) CQueryContinue::AddRef()
{
    return InterlockedIncrement(&m_cRef);
}

//--------------------------------------------------------------------------
//  Release 
//--------------------------------------------------------------------------
STDMETHODIMP_(ULONG) CQueryContinue::Release()
{
    if (InterlockedDecrement(&m_cRef))
        return m_cRef;

    delete this;
    return 0;
}

//--------------------------------------------------------------------------
//  CQueryContinue 
//--------------------------------------------------------------------------
HRESULT CQueryContinue::QueryContinue()
{
    //disable the balloon
    if(m_pIUserNotification)
        m_pIUserNotification->SetBalloonInfo(NULL, NULL, NIIF_INFO);

    //wait for the timer to be activated
    if(m_hTimer)
    {
        if(WAIT_OBJECT_0 == WaitForSingleObject(m_hTimer, 0))
          return S_FALSE;
    }
  
    return S_OK;
}
   

//--------------------------------------------------------------------------
//  DoBalloon() 
//--------------------------------------------------------------------------
HRESULT CQueryContinue::DoBalloon()
{

    HRESULT             hr=E_FAIL;
    WCHAR               wszTitle[MAX_DN_SIZE];
    WCHAR               wszText[MAX_DN_SIZE];
    HICON               hIcon=NULL;
    LARGE_INTEGER       DueTime;

   if(S_OK != (hr=CoCreateInstance(CLSID_UserNotification,
                                   NULL,
				   CLSCTX_ALL,
				   IID_IUserNotification,
				   (void **)&m_pIUserNotification)))
		goto Ret;

    if(NULL==m_pIUserNotification)
    {
        hr=E_FAIL;
        goto Ret;
    }

    //create a waitable timer with default security setting
    m_hTimer=CreateWaitableTimer(NULL, TRUE, NULL);

    if(NULL==m_hTimer)
    {
        hr=E_FAIL;
        goto Ret;
    }

    //set the timer
    DueTime.QuadPart = Int32x32To64(-10000, AUTO_ENROLLMENT_BALLOON_LENGTH * 1000);

    if(!SetWaitableTimer(m_hTimer, &DueTime, 0, NULL, 0, FALSE))
    {
        hr=E_FAIL;
        goto Ret;
    }


    if(S_OK != (hr=m_pIUserNotification->SetBalloonRetry(AUTO_ENROLLMENT_SHOW_TIME * 1000,
                                        AUTO_ENROLLMENT_INTERVAL * 1000,
                                        AUTO_ENROLLMENT_RETRIAL)))
        goto Ret;

    if((!LoadStringW(g_hmodThisDll,IDS_ICON_TIP, wszText, MAX_DN_SIZE)) ||
       (NULL==(hIcon=LoadIcon(g_hmodThisDll, MAKEINTRESOURCE(IDI_AUTOENROLL_ICON)))))
    {
       hr=E_FAIL;
       goto Ret;
    }

    if(S_OK != (hr=m_pIUserNotification->SetIconInfo(hIcon, wszText)))
        goto Ret;


    if((!LoadStringW(g_hmodThisDll,IDS_BALLOON_TITLE, wszTitle, MAX_DN_SIZE)) ||
       (!LoadStringW(g_hmodThisDll,IDS_BALLOON_TEXT, wszText, MAX_DN_SIZE)))
    {
       hr=E_FAIL;
       goto Ret;
    }

    if(S_OK !=(hr=m_pIUserNotification->SetBalloonInfo(wszTitle, wszText, NIIF_INFO)))
        goto Ret;

    //user did not click on the icon or we time out
    hr= m_pIUserNotification->Show(this, AUTO_ENROLLMENT_QUERY_INTERVAL * 1000);

Ret:
    if(m_hTimer)
    {
        CloseHandle(m_hTimer);
        m_hTimer=NULL;
    }


    if(m_pIUserNotification)
    {
        m_pIUserNotification->Release();
        m_pIUserNotification=NULL;
    }

    return hr;
}

//*******************************************************************************
//
//
//     Functions for autoenrollment
//
//
//*******************************************************************************

//--------------------------------------------------------------------------
//
// Name:    FindCertificateInOtherStore
//
//--------------------------------------------------------------------------
PCCERT_CONTEXT FindCertificateInOtherStore(
    IN HCERTSTORE hOtherStore,
    IN PCCERT_CONTEXT pCert
    )
{
    BYTE rgbHash[SHA1_HASH_LENGTH];
    CRYPT_DATA_BLOB HashBlob;

    HashBlob.pbData = rgbHash;
    HashBlob.cbData = SHA1_HASH_LENGTH;
    if (!CertGetCertificateContextProperty(
            pCert,
            CERT_SHA1_HASH_PROP_ID,
            rgbHash,
            &HashBlob.cbData
            ) || SHA1_HASH_LENGTH != HashBlob.cbData)
        return NULL;

    return CertFindCertificateInStore(
            hOtherStore,
            ENCODING_TYPE,      // dwCertEncodingType
            0,                  // dwFindFlags
            CERT_FIND_SHA1_HASH,
            (const void *) &HashBlob,
            NULL                //pPrevCertContext
            );
}

//--------------------------------------------------------------------------
//
//  AEUpdateCertificateStore
//
// Description: This function enumerates all of the certificate in the DS based
// LdapPath, and moves them into the corresponding local machine store.
//
//--------------------------------------------------------------------------
HRESULT WINAPI  AEUpdateCertificateStore(LDAP   *pld,
                                        LPWSTR  pwszConfig,
                                        LPWSTR  pwszDCName,
                                        LPWSTR  pwszStoreName,
                                        LPWSTR  pwszLdapPath)
{
    HRESULT                 hr = S_OK;
    PCCERT_CONTEXT          pContext = NULL,
                            pOtherCert = NULL;

    LPWSTR                  pwszLdapStore = NULL;
    HCERTSTORE              hEnterpriseStore = NULL,
                            hLocalStore = NULL;

    if((NULL==pld) || (NULL==pwszConfig) || (NULL==pwszDCName) || (NULL==pwszStoreName) || (NULL==pwszLdapPath))
    {
        hr = E_INVALIDARG;
        goto error;
    }

    pwszLdapStore = (LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR)*(wcslen(pwszConfig)+wcslen(pwszDCName)+wcslen(pwszLdapPath)));
    if(pwszLdapStore == NULL)
    {
        hr = E_OUTOFMEMORY;
        goto error;
    }

    wsprintf(pwszLdapStore, 
             pwszLdapPath,
             pwszDCName,
             pwszConfig);

    
    hLocalStore = CertOpenStore( CERT_STORE_PROV_SYSTEM_REGISTRY_W, 
                                0, 
                                0, 
                                CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE, 
                                pwszStoreName);
    if(hLocalStore == NULL)
    {
        hr = HRESULT_FROM_WIN32(GetLastError());
        AE_DEBUG((AE_ERROR, L"Unable to open ROOT store (%lx)\n\r", hr));
        goto error;
    }

    hEnterpriseStore = CertOpenStore(CERT_STORE_PROV_LDAP, 
                  0,
                  0,
                  CERT_STORE_READONLY_FLAG | CERT_LDAP_STORE_SIGN_FLAG |
                      CERT_LDAP_STORE_AREC_EXCLUSIVE_FLAG,
                  pwszLdapStore);
    
    if(hEnterpriseStore == NULL)
    {
        DWORD err = GetLastError();

        if((err == ERROR_FILE_NOT_FOUND))
        {
            // There was no store, so there are no certs
            hr = S_OK;
            goto error;
        }


        hr = HRESULT_FROM_WIN32(err);

        AE_DEBUG((AE_ERROR, L"Unable to open ROOT store (%lx)\n\r", hr));
        goto error;
    }


    while(pContext = CertEnumCertificatesInStore(hEnterpriseStore, pContext))
    {
        if (pOtherCert = FindCertificateInOtherStore(hLocalStore, pContext)) {
            CertFreeCertificateContext(pOtherCert);
        } 
        else
        {
            CertAddCertificateContextToStore(hLocalStore,
                                         pContext,
                                         CERT_STORE_ADD_ALWAYS,
                                         NULL);
        }
    }

    while(pContext = CertEnumCertificatesInStore(hLocalStore, pContext))
    {
        if (pOtherCert = FindCertificateInOtherStore(hEnterpriseStore, pContext)) {
            CertFreeCertificateContext(pOtherCert);
        } 
        else
        {
            CertDeleteCertificateFromStore(CertDuplicateCertificateContext(pContext));
        }
    }


error:

    if(hr != S_OK)
    {
        AELogAutoEnrollmentEvent(
                            STATUS_SEVERITY_ERROR,  //this event will always be logged
                            TRUE,
                            hr,
                            EVENT_FAIL_DOWNLOAD_CERT,
                            TRUE,
                            NULL,
                            3,
                            pwszStoreName,
                            pwszConfig,
                            pwszLdapPath);

    }

    if(pwszLdapStore)
    {
        LocalFree(pwszLdapStore);
    }

    if(hEnterpriseStore)
    {
        CertCloseStore(hEnterpriseStore,0);
    }

    if(hLocalStore)
    {
        CertCloseStore(hLocalStore,0);
    }

    return hr;
}

//--------------------------------------------------------------------------
//
//  AENeedToUpdateDSCache
//
//--------------------------------------------------------------------------
BOOL AENeedToUpdateDSCache(LDAP *pld, LPWSTR pwszDCInvocationID, LPWSTR pwszConfig, AE_DS_INFO *pAEDSInfo)
{
    BOOL                fNeedToUpdate=TRUE;
    DWORD               dwRegObject=0;
    ULARGE_INTEGER      maxRegUSN;
    ULARGE_INTEGER      maxDsUSN;
    DWORD               dwType=0;
    DWORD               dwSize=0;
    DWORD               dwDisp=0;
    struct l_timeval    timeout;
    LPWSTR              rgwszAttrs[] = {AUTO_ENROLLMENT_USN_ATTR, NULL};
    LDAPMessage         *Entry=NULL;

    LPWSTR              *awszValue = NULL;
    HKEY                hDSKey=NULL;
    HKEY                hDCKey=NULL;
    LDAPMessage         *SearchResult = NULL;
    LPWSTR              pwszContainer=NULL;


    if((NULL==pld) || (NULL==pwszDCInvocationID) || (NULL==pwszConfig) || (NULL==pAEDSInfo))
        goto error;

    //init
    memset(pAEDSInfo, 0, sizeof(AE_DS_INFO));

    //compute the # of objects and maxUSN from the directory
    pwszContainer=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (1 + wcslen(pwszConfig) + wcslen(s_wszLocation)));
    if(NULL == pwszContainer)
        goto error;
        
    wcscpy(pwszContainer, s_wszLocation);
    wcscat(pwszContainer, pwszConfig);

    timeout.tv_sec = 300;
    timeout.tv_usec = 0;
    
	if(LDAP_SUCCESS != ldap_search_stW(
		      pld, 
		      pwszContainer,
		      LDAP_SCOPE_SUBTREE,
		      L"(objectCategory=certificationAuthority)",
		      rgwszAttrs,
		      0,
		      &timeout,
		      &SearchResult))
        goto error;

    //get the # of objects
    pAEDSInfo->dwObjects = ldap_count_entries(pld, SearchResult);

    for(Entry = ldap_first_entry(pld, SearchResult);  Entry != NULL; Entry = ldap_next_entry(pld, Entry))
    {

        awszValue = ldap_get_values(pld, Entry, AUTO_ENROLLMENT_USN_ATTR);

        if(NULL==awszValue)
            goto error;

        if(NULL==awszValue[0])
            goto error;

        maxDsUSN.QuadPart=0;

        maxDsUSN.QuadPart=_wtoi64(awszValue[0]);

        //if any error happens, maxDsUSN will be 0.
        if(0 == maxDsUSN.QuadPart)
            goto error;

        if((pAEDSInfo->maxUSN).QuadPart < maxDsUSN.QuadPart)
             (pAEDSInfo->maxUSN).QuadPart = maxDsUSN.QuadPart;

        ldap_value_free(awszValue);
        awszValue=NULL;
    }

    //signal that we have retrieved correct data from the directory
    pAEDSInfo->fValidData=TRUE;

   //find if we have cached any information about the DC of interest
    if(ERROR_SUCCESS != RegCreateKeyEx(HKEY_LOCAL_MACHINE,
                         AUTO_ENROLLMENT_DS_KEY,
                         0,
                         TEXT(""),
                         REG_OPTION_NON_VOLATILE,
                         KEY_ALL_ACCESS,
                         NULL,
                         &hDSKey,
                         &dwDisp))        
        goto error;


    if(ERROR_SUCCESS != RegOpenKeyEx(
                        hDSKey,
                        pwszDCInvocationID,
                        0,
                        KEY_ALL_ACCESS,
                        &hDCKey))
        goto error;


    dwSize=sizeof(dwRegObject);

    if(ERROR_SUCCESS != RegQueryValueEx(
                        hDCKey,
                        AUTO_ENROLLMENT_DS_OBJECT,  
                        NULL,
                        &dwType,
                        (PBYTE)(&dwRegObject),    
                        &dwSize))
        goto error;

    if(REG_DWORD != dwType)
        goto error;


    dwSize=sizeof(maxRegUSN);

    if(ERROR_SUCCESS != RegQueryValueEx(
                        hDCKey,
                        AUTO_ENROLLMENT_DS_USN,  
                        NULL,
                        &dwType,
                        (PBYTE)(&(maxRegUSN)),    
                        &dwSize))
        goto error;

    if(REG_BINARY != dwType)
        goto error;


    //compare the registry data with the data from directory
    if(dwRegObject != (pAEDSInfo->dwObjects))
        goto error;

    if(maxRegUSN.QuadPart != ((pAEDSInfo->maxUSN).QuadPart))
        goto error;

    fNeedToUpdate=FALSE;

error:
    
    if(awszValue)
        ldap_value_free(awszValue);

    if(pwszContainer)
        LocalFree(pwszContainer);

    if(hDCKey)
        RegCloseKey(hDCKey);

    if(hDSKey)
        RegCloseKey(hDSKey);

    if(SearchResult)
        ldap_msgfree(SearchResult);

    //remove the temporary data
    if(pAEDSInfo)
    {
        if(FALSE == fNeedToUpdate)
            memset(pAEDSInfo, 0, sizeof(AE_DS_INFO));
    }


    return fNeedToUpdate;
}

//--------------------------------------------------------------------------
//
//  AEUpdateDSCache
//
//--------------------------------------------------------------------------
BOOL AEUpdateDSCache(LPWSTR pwszDCInvocationID, AE_DS_INFO *pAEDSInfo)
{

    BOOL    fResult=FALSE;
    DWORD   dwDisp=0;

    HKEY    hDSKey=NULL;
    HKEY    hDCKey=NULL;

    if((NULL==pwszDCInvocationID) || (NULL==pAEDSInfo))
        goto error;

    if(ERROR_SUCCESS != RegCreateKeyEx(HKEY_LOCAL_MACHINE,
                         AUTO_ENROLLMENT_DS_KEY,
                         0,
                         TEXT(""),
                         REG_OPTION_NON_VOLATILE,
                         KEY_ALL_ACCESS,
                         NULL,
                         &hDSKey,
                         &dwDisp))
        goto error;


    //create the key named by the DC
    if(ERROR_SUCCESS != RegCreateKeyEx(hDSKey,
                         pwszDCInvocationID,
                         0,
                         TEXT(""),
                         REG_OPTION_NON_VOLATILE,
                         KEY_ALL_ACCESS,
                         NULL,
                         &hDCKey,
                         &dwDisp))
        goto error;

    //set the # of objects value
    if(ERROR_SUCCESS != RegSetValueEx(hDCKey,
                    AUTO_ENROLLMENT_DS_OBJECT,
                    NULL,
                    REG_DWORD,
                    (PBYTE)&(pAEDSInfo->dwObjects),
                    sizeof(pAEDSInfo->dwObjects)))
        goto error;

    //set the max uSN value
    if(ERROR_SUCCESS != RegSetValueEx(hDCKey,
                    AUTO_ENROLLMENT_DS_USN,
                    NULL,
                    REG_BINARY,
                    (PBYTE)&(pAEDSInfo->maxUSN),
                    sizeof(pAEDSInfo->maxUSN)))
        goto error;

    fResult=TRUE;

error:

    if(hDCKey)
        RegCloseKey(hDCKey);

    if(hDSKey)
        RegCloseKey(hDSKey);


    return fResult;
}


//--------------------------------------------------------------------------
//
//  AERetrieveInvocationID
//
//--------------------------------------------------------------------------
BOOL  AERetrieveInvocationID(LDAP *pld, LPWSTR *ppwszID)
{  
    BOOL                fResult=FALSE;
    struct l_timeval    timeout;
    LPWSTR              rgwszDSAttrs[] = {L"dsServiceName", NULL};
    LPWSTR              rgwszIDAttr[] = {L"invocationId", NULL};
    LDAPMessage         *Entry=NULL;

    LPWSTR              *awszValues = NULL;
    LDAPMessage         *SearchResults = NULL;
    struct berval       **apUUID = NULL;
    LDAPMessage         *SearchIDResult = NULL;
    BYTE                *pbUUID=NULL;



    if((NULL==pld) || (NULL==ppwszID))
        goto error;

    *ppwszID=NULL;

    //retrieve the dsSerivceName attribute
    timeout.tv_sec = 300;
    timeout.tv_usec = 0;

	if(LDAP_SUCCESS != ldap_search_stW(
		      pld, 
		      NULL,                     //NULL DN for dsServiceName
		      LDAP_SCOPE_BASE,
		      L"(objectCategory=*)",
		      rgwszDSAttrs,
		      0,
		      &timeout,
		      &SearchResults))
        goto error;


    Entry = ldap_first_entry(pld, SearchResults);

    if(NULL == Entry)
        goto error;

    awszValues = ldap_get_values(pld, Entry, rgwszDSAttrs[0]);

    if(NULL==awszValues)
        goto error;

    if(NULL==awszValues[0])
        goto error;

    //retrieve the invocationId attribute
    timeout.tv_sec = 300;
    timeout.tv_usec = 0;

	if(LDAP_SUCCESS != ldap_search_stW(
		      pld, 
		      awszValues[0],                     
		      LDAP_SCOPE_BASE,
		      L"(objectCategory=*)",
		      rgwszIDAttr,
		      0,
		      &timeout,
		      &SearchIDResult))
        goto error;


    Entry = ldap_first_entry(pld, SearchIDResult);

    if(NULL == Entry)
        goto error;

	apUUID = ldap_get_values_len(pld, Entry, rgwszIDAttr[0]);

    if(NULL == apUUID)
        goto error;

    if(NULL == (*apUUID))
        goto error;

    pbUUID = (BYTE *)LocalAlloc(LPTR, (*apUUID)->bv_len);

    if(NULL == (pbUUID))
        goto error;

    memcpy(pbUUID, (*apUUID)->bv_val, (*apUUID)->bv_len);

    if(RPC_S_OK != UuidToStringW((UUID *)pbUUID, ppwszID))
        goto error;

    fResult=TRUE;

error:

    if(pbUUID)
        LocalFree(pbUUID);

    if(apUUID)
        ldap_value_free_len(apUUID);

    if(SearchIDResult)
        ldap_msgfree(SearchIDResult);

    if(awszValues)
        ldap_value_free(awszValues);

    if(SearchResults)
        ldap_msgfree(SearchResults);

    return fResult;
}

//--------------------------------------------------------------------------
//
//  AEDownloadStore
//
//--------------------------------------------------------------------------
BOOL WINAPI AEDownloadStore(LDAP *pld, LPWSTR pwszDCName)
{
    BOOL        fResult = TRUE;
    DWORD       dwIndex = 0;
    AE_DS_INFO  AEDSInfo;

    LPWSTR      wszConfig = NULL;
    LPWSTR      pwszDCInvocationID = NULL;

    memset(&AEDSInfo, 0, sizeof(AEDSInfo));

    if(S_OK  != AEGetConfigDN(pld, &wszConfig))
    {
        fResult=FALSE;
        goto error;
    }

    //get the pwszDCInvocationID.  NULL means AENeedToUpdateDSCache will return TRUE
    AERetrieveInvocationID(pld, &pwszDCInvocationID);

    if(AENeedToUpdateDSCache(pld, pwszDCInvocationID, wszConfig, &AEDSInfo))
    {
        for(dwIndex =0; dwIndex < g_dwStoreInfo; dwIndex++)
        {
            fResult = fResult && (S_OK == AEUpdateCertificateStore(
                                            pld, 
                                            wszConfig,
                                            pwszDCName,
                                            g_rgStoreInfo[dwIndex].pwszStoreName,
                                            g_rgStoreInfo[dwIndex].pwszLdapPath));
        }

        //only update the new DS cached information if we have a successful download
        if((fResult) && (TRUE == AEDSInfo.fValidData) && (pwszDCInvocationID))
            AEUpdateDSCache(pwszDCInvocationID, &AEDSInfo);
    }


error:

    if(pwszDCInvocationID)
        RpcStringFreeW(&pwszDCInvocationID);

    if(wszConfig)
    {
        LocalFree(wszConfig);
    }

    return fResult;
}


//--------------------------------------------------------------------------
//
//  AESetWakeUpFlag
//
//  We set the flag to tell winlogon if autoenrollment should be waken up
//  during each policy check
//
//--------------------------------------------------------------------------
BOOL WINAPI AESetWakeUpFlag(BOOL    fMachine,   BOOL fWakeUp)
{
    BOOL    fResult = FALSE;
    DWORD   dwDisp = 0;
    DWORD   dwFlags = 0;

    HKEY    hAEKey = NULL;
    
    if(ERROR_SUCCESS != RegCreateKeyEx(
                    fMachine ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER,
                    AUTO_ENROLLMENT_FLAG_KEY,
                    0,
                    L"",
                    REG_OPTION_NON_VOLATILE,
                    KEY_ALL_ACCESS,
                    NULL,
                    &hAEKey,
                    &dwDisp))
        goto Ret;

    if(fWakeUp)
        dwFlags = AUTO_ENROLLMENT_WAKE_UP_REQUIRED;

    if(ERROR_SUCCESS != RegSetValueEx(
                    hAEKey,
                    AUTO_ENROLLMENT_FLAG,
                    0,
                    REG_DWORD,
                    (PBYTE)&dwFlags,
                    sizeof(dwFlags)))
        goto Ret;


    fResult=TRUE;

Ret:
    if(hAEKey)
        RegCloseKey(hAEKey);

    return fResult;
}


//--------------------------------------------------------------------------
//
//  AESetWakeUpTimer
//
//  Set the timer to wake us up in 8 hrs
//
//--------------------------------------------------------------------------
BOOL WINAPI AESetWakeUpTimer(BOOL fMachine, LARGE_INTEGER *pPreTime, LARGE_INTEGER *pPostTime)
{
    HRESULT hr;
    HKEY hKey;
    HKEY hCurrent;
    DWORD dwType, dwSize, dwResult;
    LONG lTimeout;
    LARGE_INTEGER DueTime;
    WCHAR * wszTimerName;
    LARGE_INTEGER EnrollmentTime;

    // must be cleaned up
    HANDLE hTimer=NULL;

    // Build a timer event to ping us in about 8 hours if we don't get notified sooner.
    lTimeout=AE_DEFAULT_REFRESH_RATE;

    // Query for the refresh timer value
    if (ERROR_SUCCESS==RegOpenKeyEx((fMachine?HKEY_LOCAL_MACHINE:HKEY_CURRENT_USER), SYSTEM_POLICIES_KEY, 0, KEY_READ, &hKey)) {
        dwSize=sizeof(lTimeout);
        RegQueryValueEx(hKey, TEXT("AutoEnrollmentRefreshTime"), NULL, &dwType, (LPBYTE) &lTimeout, &dwSize);
        RegCloseKey(hKey);
    }

    // Limit the timeout to once every 240 hours (10 days)
    if (lTimeout>=240) {
        lTimeout=240;
    } else if (lTimeout<0) {
        lTimeout=0;
    }

    // Convert hours to milliseconds
    lTimeout=lTimeout*60*60*1000;

    // Special case 0 milliseconds to be 7 seconds
    if (lTimeout==0) {
        lTimeout=7000;
    }

    // convert to 10^-7s. not yet negative values are relative
    DueTime.QuadPart=Int32x32To64(-10000, lTimeout);

    // if user has hold on the UI for too long and the cycle passed the 8 hours.
    // we set the time for 1 hour
    EnrollmentTime.QuadPart=pPostTime->QuadPart - pPreTime->QuadPart;

    if(EnrollmentTime.QuadPart > 0)
    {
        if((-(DueTime.QuadPart)) > EnrollmentTime.QuadPart)
        {
            DueTime.QuadPart = DueTime.QuadPart + EnrollmentTime.QuadPart;
        }
        else
        {
            // Convert hours to milliseconds
            lTimeout=AE_DEFAULT_POSTPONE*60*60*1000;
            DueTime.QuadPart = Int32x32To64(-10000, lTimeout);
        }
    }


    // find the timer
    if (fMachine) {
        wszTimerName=L"Global\\" MACHINE_AUTOENROLLMENT_TIMER_NAME;
    } else {
        wszTimerName=USER_AUTOENROLLMENT_TIMER_NAME;
    }
    hTimer=OpenWaitableTimer(TIMER_MODIFY_STATE, false, wszTimerName);
    if (NULL==hTimer) {
        hr=HRESULT_FROM_WIN32(GetLastError());
        AE_DEBUG((AE_ERROR, L"OpenWaitableTimer(%s) failed with 0x%08X.\n", wszTimerName, hr));
        goto error;
    }

    // set the timer
    if (!SetWaitableTimer (hTimer, &DueTime, 0, NULL, 0, FALSE)) {
        hr=HRESULT_FROM_WIN32(GetLastError());
        AE_DEBUG((AE_ERROR, L"SetWaitableTimer  failed with 0x%08X.\n", hr));
        goto error;
    }

    AE_DEBUG((AE_INFO, L"Set wakeup timer.\n"));

    hr=S_OK;
error:
    if (NULL!=hTimer) {
        CloseHandle(hTimer);
    }
    return (S_OK==hr);
}


//--------------------------------------------------------------------------
//
//  AEGetPendingRequestProperty
//
//--------------------------------------------------------------------------
BOOL    AEGetPendingRequestProperty(IEnroll4    *pIEnroll4, 
                                    DWORD       dwIndex, 
                                    DWORD       dwProp, 
                                    LPVOID      pProp)
{
    CRYPT_DATA_BLOB *pBlob=NULL;
    BOOL            fResult=FALSE;

    if((NULL==pIEnroll4) || (NULL==pProp))
        return FALSE;

    switch(dwProp)
    {
        case XEPR_REQUESTID:   
        case XEPR_DATE:           
        case XEPR_VERSION:
                fResult = (S_OK == pIEnroll4->enumPendingRequestWStr(dwIndex, dwProp, pProp));
            break;
            
            
        case XEPR_CANAME:                     
        case XEPR_CAFRIENDLYNAME: 
        case XEPR_CADNS:          
        case XEPR_V1TEMPLATENAME: 
        case XEPR_V2TEMPLATEOID:  
        case XEPR_HASH:
                
                pBlob=(CRYPT_DATA_BLOB *)pProp;

                pBlob->cbData=0;
                pBlob->pbData=NULL;

                if(S_OK != pIEnroll4->enumPendingRequestWStr(dwIndex, dwProp, pProp))
                    goto Ret;

                if(0 == pBlob->cbData)
                    goto Ret;

                pBlob->pbData=(BYTE *)LocalAlloc(LPTR, pBlob->cbData);
                if(NULL == pBlob->pbData)
                    goto Ret;

                fResult = (S_OK == pIEnroll4->enumPendingRequestWStr(dwIndex, dwProp, pProp));

            break;

        default:
            break;
    }

Ret:
    if(FALSE==fResult)
    {
        if(pBlob)
        {
            if(pBlob->pbData)
                LocalFree(pBlob->pbData);

            memset(pBlob, 0, sizeof(CRYPT_DATA_BLOB));
        }
    }

    return fResult;
}
//--------------------------------------------------------------------------
//
//  AERetrieveRequestProperty
//
//--------------------------------------------------------------------------
BOOL    AERetrieveRequestProperty(IEnroll4          *pIEnroll4, 
                                  DWORD             dwIndex, 
                                  DWORD             *pdwCount, 
                                  DWORD             *pdwMax, 
                                  CRYPT_DATA_BLOB   **prgblobHash)
{
    BOOL                fResult=FALSE;
    CRYPT_DATA_BLOB     *pblobHash=NULL;

    if((NULL==pIEnroll4) || (NULL==pdwCount) || (NULL==pdwMax) || (NULL==prgblobHash) ||
        (NULL==*prgblobHash))
        goto Ret;

    //need to alloc more memory
    if((*pdwCount) >= (*pdwMax))
    {
        pblobHash=*prgblobHash;

        *prgblobHash=(CRYPT_DATA_BLOB *)LocalAlloc(LPTR, 
                                    ((*pdwMax) + PENDING_ALLOC_SIZE) * sizeof(CRYPT_DATA_BLOB));
        if(NULL==(*prgblobHash))
        {
            *prgblobHash=pblobHash;
            pblobHash=NULL;
            goto Ret;
        }

        memset(*prgblobHash, 0, ((*pdwMax) + PENDING_ALLOC_SIZE) * sizeof(CRYPT_DATA_BLOB));

        //copy the old memmory
        memcpy(*prgblobHash, pblobHash, (*pdwMax) * sizeof(CRYPT_DATA_BLOB));

        *pdwMax=(*pdwMax) + PENDING_ALLOC_SIZE;
    }


    if(!AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_HASH, 
                                    &((*prgblobHash)[*pdwCount])))
        goto Ret;

    (*pdwCount)=(*pdwCount) + 1;

    fResult=TRUE;

Ret:

    if(pblobHash)
        LocalFree(pblobHash);

    return fResult;
}


//--------------------------------------------------------------------------
//
//  AERemovePendingRequest
//
//--------------------------------------------------------------------------
BOOL    AERemovePendingRequest(IEnroll4         *pIEnroll4, 
                               DWORD            dwCount, 
                               CRYPT_DATA_BLOB  *rgblobHash)
{
    DWORD   dwIndex=0;
    BOOL    fResult=TRUE;

    if((NULL==pIEnroll4) || (NULL==rgblobHash))
        return FALSE;

    for(dwIndex=0; dwIndex < dwCount; dwIndex++)
    {
        if(S_OK != (pIEnroll4->removePendingRequestWStr(rgblobHash[dwIndex])))
            fResult=FALSE;
    }

    return fResult;
}

//--------------------------------------------------------------------------
//
//  AEFreePendingRequests
//
//--------------------------------------------------------------------------
BOOL    AEFreePendingRequests(DWORD dwCount, CRYPT_DATA_BLOB    *rgblobHash)
{
    DWORD   dwIndex=0;

    if(rgblobHash)
    {
        for(dwIndex=0; dwIndex < dwCount; dwIndex++)
        {
            if(rgblobHash[dwIndex].pbData)
                LocalFree(rgblobHash[dwIndex].pbData);
        }

        LocalFree(rgblobHash);
    }

    return TRUE;
}


//--------------------------------------------------------------------------
//
//  AEValidVersionCert
//  
//      Verify the certificate returned from CA has the latest version info.
//  If so, copy the certificate to the hIssuedStore for potentical publishing
// 
//--------------------------------------------------------------------------
BOOL    AEValidVersionCert(AE_CERTTYPE_INFO *pCertType, IEnroll4  *pIEnroll4, CRYPT_DATA_BLOB  *pBlobPKCS7)
{
    BOOL                fValid=FALSE;   

    PCCERT_CONTEXT      pCertContext=NULL;
    AE_TEMPLATE_INFO    AETemplateInfo;

    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    if((NULL==pCertType) || (NULL==pIEnroll4) || (NULL==pBlobPKCS7))
        goto Ret;

    if(NULL==(pBlobPKCS7->pbData))
        goto Ret;

    if(S_OK != pIEnroll4->getCertContextFromResponseBlob(pBlobPKCS7, &pCertContext))
        goto Ret;

    if(!AERetrieveTemplateInfo(pCertContext, &AETemplateInfo))
        goto Ret;
                      

    if(AETemplateInfo.pwszOid)
    {
        if(AETemplateInfo.dwVersion >= (pCertType->dwVersion))
            fValid=TRUE;
    }
    else
    {
        //V1 template
        if(NULL == AETemplateInfo.pwszName)
            goto Ret;

        fValid=TRUE;
    }

    if(pCertContext && (TRUE == fValid))
    {
        CertAddCertificateContextToStore(pCertType->hIssuedStore, 
                                        pCertContext,
                                        CERT_STORE_ADD_USE_EXISTING,
                                        NULL);
    }

Ret:
    if(pCertContext)
        CertFreeCertificateContext(pCertContext);

    AEFreeTemplateInfo(&AETemplateInfo);

    return fValid;
}


//--------------------------------------------------------------------------
//
//  AECopyPendingBlob
//  
//      Copy the issued PKCS7 and request hash.
// 
//--------------------------------------------------------------------------
BOOL    AECopyPendingBlob(CRYPT_DATA_BLOB   *pBlobPKCS7,
                          IEnroll4          *pIEnroll4, 
                          DWORD             dwXenrollIndex, 
                          AE_CERTTYPE_INFO  *pCertType)
{
    BOOL            fResult=FALSE;
    DWORD           dwIndex=0;

    AE_PEND_INFO    *pPendInfo=NULL;

    if((NULL==pBlobPKCS7)||(NULL==pIEnroll4)||(NULL==pCertType))
        goto Ret;

    if(NULL==(pBlobPKCS7->pbData))
        goto Ret;

    dwIndex=pCertType->dwPendCount;

    //increase the memory array
    if(0 != dwIndex)
    {
        pPendInfo=pCertType->rgPendInfo;

        pCertType->rgPendInfo=(AE_PEND_INFO *)LocalAlloc(LPTR, 
                                    (dwIndex + 1) * sizeof(AE_PEND_INFO));

        if(NULL==(pCertType->rgPendInfo))
        {
            pCertType->rgPendInfo=pPendInfo;
            pPendInfo=NULL;
            goto Ret;
        }

        memset(pCertType->rgPendInfo, 0, (dwIndex + 1) * sizeof(AE_PEND_INFO));

        //copy the old memmory
        memcpy(pCertType->rgPendInfo, pPendInfo, (dwIndex) * sizeof(AE_PEND_INFO));
    }
    else
    {
        pCertType->rgPendInfo=(AE_PEND_INFO *)LocalAlloc(LPTR, sizeof(AE_PEND_INFO));

        if(NULL==(pCertType->rgPendInfo))
            goto Ret;

        memset(pCertType->rgPendInfo, 0, sizeof(AE_PEND_INFO));
    }

    
    //copy the issued PKCS7 blob
    (pCertType->rgPendInfo)[dwIndex].blobPKCS7.pbData=(BYTE *)LocalAlloc(
                                            LPTR,
                                            pBlobPKCS7->cbData);

    if(NULL == ((pCertType->rgPendInfo)[dwIndex].blobPKCS7.pbData))
        goto Ret;
                  
    memcpy((pCertType->rgPendInfo)[dwIndex].blobPKCS7.pbData,
            pBlobPKCS7->pbData,
            pBlobPKCS7->cbData);

    (pCertType->rgPendInfo)[dwIndex].blobPKCS7.cbData=pBlobPKCS7->cbData;

    //copy the hash of the request
    if(!AEGetPendingRequestProperty(pIEnroll4, dwXenrollIndex, XEPR_HASH, 
                                    &((pCertType->rgPendInfo)[dwIndex].blobHash)))
    {
        LocalFree((pCertType->rgPendInfo)[dwIndex].blobPKCS7.pbData);
        (pCertType->rgPendInfo)[dwIndex].blobPKCS7.pbData=NULL;
        (pCertType->rgPendInfo)[dwIndex].blobPKCS7.cbData=0;
        goto Ret;
    }

    (pCertType->dwPendCount)++;

    fResult=TRUE;

Ret:
    if(pPendInfo)
        LocalFree(pPendInfo);

    return fResult;
}
//--------------------------------------------------------------------------
//
//  AEProcessUIPendingRequest
//  
//      In this function, we install the issued pending certificate request
//  that will require UI.
// 
//--------------------------------------------------------------------------
BOOL WINAPI AEProcessUIPendingRequest(AE_GENERAL_INFO *pAE_General_Info)
{
    DWORD                   dwIndex=0;
    DWORD                   dwPendIndex=0;
    AE_CERTTYPE_INFO        *pCertTypeInfo=pAE_General_Info->rgCertTypeInfo;
    AE_CERTTYPE_INFO        *pCertType=NULL;
    BOOL                    fInit=FALSE;
    PFNPIEnroll4GetNoCOM    pfnPIEnroll4GetNoCOM=NULL;
    HMODULE                 hXenroll=NULL;
    HRESULT                 hr=E_FAIL;

    IEnroll4                *pIEnroll4=NULL;

    if(NULL==pAE_General_Info)
        goto Ret;

    //has to be in the UI mode
    if(FALSE == pAE_General_Info->fUIProcess)
        goto Ret;

    if(NULL==pCertTypeInfo)
        goto Ret;

    hXenroll=pAE_General_Info->hXenroll;

    if(NULL==hXenroll)
        goto Ret;

    if(NULL==(pfnPIEnroll4GetNoCOM=(PFNPIEnroll4GetNoCOM)GetProcAddress(
                        hXenroll,
                        "PIEnroll4GetNoCOM")))
        goto Ret;


    if(FAILED(CoInitialize(NULL)))
	    goto Ret;

    fInit=TRUE;

    if(NULL==(pIEnroll4=pfnPIEnroll4GetNoCOM()))
        goto Ret;

    //Set the request store flag based on fMachine
    if(pAE_General_Info->fMachine)
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_LOCAL_MACHINE))
            goto Ret;
    }
    else
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_CURRENT_USER))
            goto Ret;
    }

    //initialize the enumerator
    if(S_OK != pIEnroll4->enumPendingRequestWStr(XEPR_ENUM_FIRST, 0, NULL))
        goto Ret;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        pCertType = &(pCertTypeInfo[dwIndex]);

        if(pCertType->dwPendCount)
        {
            for(dwPendIndex=0; dwPendIndex < pCertType->dwPendCount; dwPendIndex++)
            {
                //check if cancel button is clicked
                if(AECancelled(pAE_General_Info->hCancelEvent))
                    break;

                //report the current enrollment action
                AEUIProgressReport(TRUE, pCertType, pAE_General_Info->hwndDlg, pAE_General_Info->hCancelEvent);

   		        //install the certificate
                if(S_OK == (hr = pIEnroll4->acceptResponseBlob(
                    &((pCertType->rgPendInfo)[dwPendIndex].blobPKCS7))))
                {
                    //mark the status to obtained if required
                    //this is a valid certificate
                    if(AEValidVersionCert(pCertType, pIEnroll4, &((pCertType->rgPendInfo)[dwPendIndex].blobPKCS7)))
                        pCertType->dwStatus = CERT_REQUEST_STATUS_OBTAINED;

                    //the certificate is successfully issued and installed
                    //remove the request from the request store
                    pIEnroll4->removePendingRequestWStr((pCertType->rgPendInfo)[dwPendIndex].blobHash);

                    AELogAutoEnrollmentEvent(
                        pAE_General_Info->dwLogLevel,
                        FALSE, 
                        S_OK, 
                        EVENT_PENDING_INSTALLED, 
                        pAE_General_Info->fMachine, 
                        pAE_General_Info->hToken, 
                        1,
                        pCertType->awszDisplay[0]);

                }
                else
                {
                    //doing this for summary page
                    if((SCARD_E_CANCELLED != hr) && (SCARD_W_CANCELLED_BY_USER != hr))
                        pCertType->idsSummary=IDS_SUMMARY_INSTALL;

                    AELogAutoEnrollmentEvent(
                        pAE_General_Info->dwLogLevel,
                        TRUE, 
                        hr, 
                        EVENT_PENDING_FAILED, 
                        pAE_General_Info->fMachine, 
                        pAE_General_Info->hToken, 
                        1,
                        pCertType->awszDisplay[0]);
                }

                //advance progress
                AEUIProgressAdvance(pAE_General_Info);
            }
        }
    }

Ret:
    if(pIEnroll4)
        pIEnroll4->Release();

    if(fInit)
        CoUninitialize();
    
    return TRUE;
}   
   

//--------------------------------------------------------------------------
//
//  AEProcessPendingRequest -- UIless call.
//  
//      In this function, we check each pending requests in the request store.
//  We install the certificate is the request has been issued by the CA, and 
//  mark the certificate type status to obtained if the certificate is issued
//  and of correct version
//
//      We remove any requests that are stale based on the # of days defined
//  in the registry.  If no value is defined in the registry, use 
//  AE_PENDING_REQUEST_ACTIVE_PERIOD (60 days).
//
//      Also, if there is no more pending requests active in the request store,
//  we set the registry value to indicate that winlogon should not wake us up.
// 
//--------------------------------------------------------------------------
BOOL WINAPI AEProcessPendingRequest(AE_GENERAL_INFO *pAE_General_Info)
{
    DWORD                   dwRequestID=0;
    LONG                    dwDisposition=0;
    DWORD                   dwIndex=0;
    DWORD                   dwCount=0;
    DWORD                   dwMax=PENDING_ALLOC_SIZE;
    AE_CERTTYPE_INFO        *pCertType=NULL;
    PFNPIEnroll4GetNoCOM    pfnPIEnroll4GetNoCOM=NULL;
    BOOL                    fInit=FALSE;
    AE_TEMPLATE_INFO        AETemplateInfo;
    CRYPT_DATA_BLOB         blobPKCS7;
    HMODULE                 hXenroll=NULL;
    VARIANT                 varCMC; 
	HRESULT					hr=E_FAIL;
  

    IEnroll4                *pIEnroll4=NULL;
    ICertRequest2           *pICertRequest=NULL;
	BSTR	                bstrCert=NULL;
    LPWSTR                  pwszCAConfig=NULL;
    BSTR                    bstrConfig=NULL;
    CRYPT_DATA_BLOB         *rgblobHash=NULL;
    CRYPT_DATA_BLOB         blobCAName;
    CRYPT_DATA_BLOB         blobCALocation;
    CRYPT_DATA_BLOB         blobName;


    if(NULL==pAE_General_Info)
        goto Ret;

    //init the dwUIPendCount to 0
    pAE_General_Info->dwUIPendCount=0;

    //has to be in the UIless mode
    if(TRUE == pAE_General_Info->fUIProcess)
        goto Ret;

    hXenroll=pAE_General_Info->hXenroll;

    if(NULL==hXenroll)
        goto Ret;

    if(NULL==(pfnPIEnroll4GetNoCOM=(PFNPIEnroll4GetNoCOM)GetProcAddress(
                        hXenroll,
                        "PIEnroll4GetNoCOM")))
        goto Ret;


    if(FAILED(CoInitialize(NULL)))
	    goto Ret;

    fInit=TRUE;

    if(NULL==(pIEnroll4=pfnPIEnroll4GetNoCOM()))
        goto Ret;


	if(S_OK != CoCreateInstance(CLSID_CCertRequest,
									NULL,
									CLSCTX_INPROC_SERVER,
									IID_ICertRequest2,
									(void **)&pICertRequest))
		goto Ret;

    //Set the request store flag based on fMachine
    if(pAE_General_Info->fMachine)
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_LOCAL_MACHINE))
            goto Ret;
    }
    else
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_CURRENT_USER))
            goto Ret;
    }

    memset(&blobCAName, 0, sizeof(blobCAName));
    memset(&blobCALocation, 0, sizeof(blobCALocation));
    memset(&blobName, 0, sizeof(blobName));
    memset(&AETemplateInfo, 0, sizeof(AETemplateInfo));

    rgblobHash=(CRYPT_DATA_BLOB *)LocalAlloc(LPTR, dwMax * sizeof(CRYPT_DATA_BLOB));
    if(NULL==rgblobHash)
        goto Ret;

    memset(rgblobHash, 0, dwMax * sizeof(CRYPT_DATA_BLOB));

    //initialize the enumerator
    if(S_OK != pIEnroll4->enumPendingRequestWStr(XEPR_ENUM_FIRST, 0, NULL))
        goto Ret;

    //initlialize the variant
    VariantInit(&varCMC); 

    while(AEGetPendingRequestProperty(
                    pIEnroll4,
                    dwIndex,
                    XEPR_REQUESTID,
                    &dwRequestID))
    {

        //query the status of the requests to the CA
        if(!AEGetPendingRequestProperty(
                    pIEnroll4,
                    dwIndex,
                    XEPR_CANAME,
                    &blobCAName))
            goto Next;

        if(!AEGetPendingRequestProperty(
                    pIEnroll4,
                    dwIndex,
                    XEPR_CADNS,
                    &blobCALocation))
            goto Next;

        //build the config string
        pwszCAConfig=(LPWSTR)LocalAlloc(LPTR, 
            sizeof(WCHAR) * (wcslen((LPWSTR)(blobCALocation.pbData)) + wcslen((LPWSTR)(blobCAName.pbData)) + wcslen(L"\\") + 1));

        if(NULL==pwszCAConfig)
            goto Next;

        wcscpy(pwszCAConfig, (LPWSTR)(blobCALocation.pbData));
        wcscat(pwszCAConfig, L"\\");
        wcscat(pwszCAConfig, (LPWSTR)(blobCAName.pbData));

        //conver to bstr
        bstrConfig=SysAllocString(pwszCAConfig);
        if(NULL==bstrConfig)
            goto Next;

        //find the template information
        //get the version and the template name of the request
        if(AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_V2TEMPLATEOID, &blobName))
        {
            AETemplateInfo.pwszOid=(LPWSTR)blobName.pbData;
        }
        else
        {
            if(!AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_V1TEMPLATENAME, &blobName))
                goto Next;

            AETemplateInfo.pwszName=(LPWSTR)blobName.pbData;
        }

        //find the template
        if(NULL==(pCertType=AEFindTemplateInRequestTree(
                        &AETemplateInfo, pAE_General_Info)))
            goto Next;


        if(S_OK != pICertRequest->RetrievePending(
                            dwRequestID,
							bstrConfig,
							&dwDisposition))
            goto Next;

 	    switch(dwDisposition)
	    {
		    case CR_DISP_ISSUED:
				    if(S_OK != pICertRequest->GetFullResponseProperty(
                                            FR_PROP_FULLRESPONSE, 0, PROPTYPE_BINARY, CR_OUT_BINARY,
										    &varCMC))
                    {
                        goto Next;
                    }

                    // Check to make sure we've gotten a BSTR back: 
                    if (VT_BSTR != varCMC.vt) 
                    {
	                    goto Next; 
                    }

                    bstrCert = varCMC.bstrVal; 

                    // Marshal the cert into a CRYPT_DATA_BLOB:
				    blobPKCS7.cbData = (DWORD)SysStringByteLen(bstrCert);
				    blobPKCS7.pbData = (BYTE *)bstrCert;

                    // we will keep the PKCS7 blob for installation
                    if(CT_FLAG_USER_INTERACTION_REQUIRED & (pCertType->dwEnrollmentFlag))
                    {
                        //signal that we should pop up the UI balloon
                        (pAE_General_Info->dwUIPendCount)++;

                        //copy the PKCS7 blob from the cert server
                        AECopyPendingBlob(&blobPKCS7,
                                            pIEnroll4, 
                                            dwIndex, 
                                            pCertType);
                    }
                    else
                    {
   				        //install the certificate
                        if(S_OK != (hr = pIEnroll4->acceptResponseBlob(&blobPKCS7)))
						{
							AELogAutoEnrollmentEvent(
								pAE_General_Info->dwLogLevel,
								TRUE, 
								hr, 
								EVENT_PENDING_FAILED, 
								pAE_General_Info->fMachine, 
								pAE_General_Info->hToken, 
								1,
								pCertType->awszDisplay[0]);

                            goto Next;
						}

                        //mark the status to obtained if required
                        //this is a valid certificate
                        if(AEValidVersionCert(pCertType, pIEnroll4, &blobPKCS7))
                            pCertType->dwStatus = CERT_REQUEST_STATUS_OBTAINED;

                        //the certificate is successfully issued and installed
                        //remove the request from the request store
                        AERetrieveRequestProperty(pIEnroll4, dwIndex, &dwCount, &dwMax, &rgblobHash);
                    }

                    AELogAutoEnrollmentEvent(
                        pAE_General_Info->dwLogLevel,
                        FALSE, 
                        S_OK, 
                        EVENT_PENDING_ISSUED, 
                        pAE_General_Info->fMachine, 
                        pAE_General_Info->hToken, 
                        2,
                        pCertType->awszDisplay[0],
                        pwszCAConfig);
			    break;

		    case CR_DISP_UNDER_SUBMISSION:

                    AELogAutoEnrollmentEvent(
                        pAE_General_Info->dwLogLevel,
                        FALSE, 
                        S_OK, 
                        EVENT_PENDING_PEND, 
                        pAE_General_Info->fMachine, 
                        pAE_General_Info->hToken, 
                        2,
                        pCertType->awszDisplay[0],
                        pwszCAConfig);


			    break;

		    case CR_DISP_INCOMPLETE:
		    case CR_DISP_ERROR:   
		    case CR_DISP_DENIED:   
		    case CR_DISP_ISSUED_OUT_OF_BAND:	  //we consider it a failure in this case
		    case CR_DISP_REVOKED:
		    default:
                    //requests failed.  remove the request from the request store
                    AERetrieveRequestProperty(pIEnroll4, dwIndex, &dwCount, &dwMax, &rgblobHash);

					if(S_OK == pICertRequest->GetLastStatus(&hr))
					{
						AELogAutoEnrollmentEvent(
							pAE_General_Info->dwLogLevel,
							TRUE, 
							hr, 
							EVENT_PENDING_DENIED, 
							pAE_General_Info->fMachine, 
							pAE_General_Info->hToken,
							2,
							pwszCAConfig,
							pCertType->awszDisplay[0]);
					}

			    break;
	    }
   
Next:
        if(pwszCAConfig)
            LocalFree(pwszCAConfig);
        pwszCAConfig=NULL;

        if(bstrConfig)
            SysFreeString(bstrConfig);
        bstrConfig=NULL;

	    if(bstrCert)
		    SysFreeString(bstrCert);
        bstrCert=NULL;

        if(blobCAName.pbData)
            LocalFree(blobCAName.pbData);
        memset(&blobCAName, 0, sizeof(blobCAName));

        if(blobCALocation.pbData)
            LocalFree(blobCALocation.pbData);
        memset(&blobCALocation, 0, sizeof(blobCALocation));

        if(blobName.pbData)
            LocalFree(blobName.pbData);
        memset(&blobName, 0, sizeof(blobName));

        memset(&AETemplateInfo, 0, sizeof(AETemplateInfo));

        VariantInit(&varCMC); 

        dwIndex++;
    }

    //remove the requests based the hash
    AERemovePendingRequest(pIEnroll4, dwCount, rgblobHash);

Ret:

    AEFreePendingRequests(dwCount, rgblobHash);

    if(pICertRequest)
        pICertRequest->Release();

    if(pIEnroll4)
        pIEnroll4->Release();

    if(fInit)
        CoUninitialize();
    
    return TRUE;
}
   
//--------------------------------------------------------------------------
//
//  AEIsLocalSystem
//
//--------------------------------------------------------------------------

BOOL
AEIsLocalSystem(BOOL *pfIsLocalSystem)
{
    HANDLE                      hToken = 0;
    SID_IDENTIFIER_AUTHORITY    siaNtAuthority = SECURITY_NT_AUTHORITY;
    BOOL                        fRet = FALSE;
    BOOL                        fRevertToSelf = FALSE;

    PSID                        psidLocalSystem = NULL;

    *pfIsLocalSystem = FALSE;

    if (!OpenThreadToken(
                 GetCurrentThread(),
                 TOKEN_QUERY,
                 TRUE,
                 &hToken))
    {
        if (ERROR_NO_TOKEN != GetLastError())
            goto Ret;

        //we need to impersonateself and get the thread token again
        if(!ImpersonateSelf(SecurityImpersonation))
            goto Ret;

        fRevertToSelf = TRUE;

        if (!OpenThreadToken(
                     GetCurrentThread(),
                     TOKEN_QUERY,
                     TRUE,
                     &hToken))
            goto Ret;
    }

    //build the well known local system SID (s-1-5-18)
    if (!AllocateAndInitializeSid(
                    &siaNtAuthority,
                    1,
                    SECURITY_LOCAL_SYSTEM_RID,
                    0, 0, 0, 0, 0, 0, 0,
                    &psidLocalSystem
                    ))
        goto Ret;

    fRet = CheckTokenMembership(
                    hToken,
                    psidLocalSystem,
                    pfIsLocalSystem);

Ret:

    if(fRevertToSelf)
        RevertToSelf();

    if(psidLocalSystem)
        FreeSid(psidLocalSystem);

    if (hToken)
        CloseHandle(hToken);

    return fRet;
}


//--------------------------------------------------------------------------
//
//  AEInSafeBoot
//
//  copied from the service controller code
//--------------------------------------------------------------------------
BOOL WINAPI AEInSafeBoot()
{
    DWORD   dwSafeBoot = 0;
    DWORD   cbSafeBoot = sizeof(dwSafeBoot);
    DWORD   dwType = 0;

    HKEY    hKeySafeBoot = NULL;

    if(ERROR_SUCCESS == RegOpenKeyW(
                              HKEY_LOCAL_MACHINE,
                              L"system\\currentcontrolset\\control\\safeboot\\option",
                              &hKeySafeBoot))
    {
        // we did in fact boot under safeboot control
        if(ERROR_SUCCESS != RegQueryValueExW(
                                    hKeySafeBoot,
                                    L"OptionValue",
                                    NULL,
                                    &dwType,
                                    (LPBYTE)&dwSafeBoot,
                                    &cbSafeBoot))
        {
            dwSafeBoot = 0;
        }

        if(hKeySafeBoot)
            RegCloseKey(hKeySafeBoot);
    }

    return (0 != dwSafeBoot);
}


//--------------------------------------------------------------------------
//
//  AEIsDomainMember
//
//--------------------------------------------------------------------------
BOOL WINAPI AEIsDomainMember()
{
    DWORD dwErr;
    BOOL bIsDomainMember=FALSE;

    // must be cleaned up
    DSROLE_PRIMARY_DOMAIN_INFO_BASIC * pDomInfo=NULL;

    dwErr=DsRoleGetPrimaryDomainInformation(NULL, DsRolePrimaryDomainInfoBasic, (BYTE **)&pDomInfo);
    if (ERROR_SUCCESS==dwErr) {
        if (DsRole_RoleStandaloneWorkstation!=pDomInfo->MachineRole 
            && DsRole_RoleStandaloneServer!=pDomInfo->MachineRole) {
            bIsDomainMember=TRUE;
        }
    }

    if (NULL!=pDomInfo) {
        DsRoleFreeMemory(pDomInfo);
    }

    return bIsDomainMember;
}


//-----------------------------------------------------------------------
//
//  AEGetPolicyFlag
//
//-----------------------------------------------------------------------
BOOL    AEGetPolicyFlag(BOOL   fMachine, DWORD  *pdwPolicy)
{
    DWORD   dwPolicy = 0;
    DWORD   cbPolicy = sizeof(dwPolicy);
    DWORD   dwType = 0;

    HKEY    hKey = NULL;

    if(ERROR_SUCCESS ==  RegOpenKeyW(
                                fMachine ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER,
                                AUTO_ENROLLMENT_KEY,
                                &hKey))
    {
        if(ERROR_SUCCESS != RegQueryValueExW(
                                    hKey,
                                    AUTO_ENROLLMENT_POLICY,
                                    NULL,
                                    &dwType,
                                    (LPBYTE)&dwPolicy,
                                    &cbPolicy))
	    {
            dwPolicy = 0;
        }

        if(hKey)
            RegCloseKey(hKey);

    }

    *pdwPolicy=dwPolicy;

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AERetrieveLogLevel
//
//-----------------------------------------------------------------------
BOOL AERetrieveLogLevel(BOOL    fMachine, DWORD *pdwLogLevel)
{
    DWORD   dwLogLevel = STATUS_SEVERITY_ERROR;   //we default to highest logging level
    DWORD   cbLogLevel = sizeof(dwLogLevel);
    DWORD   dwType = 0;

    HKEY    hKey = NULL;

    if(ERROR_SUCCESS ==  RegOpenKeyW(
                                fMachine ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER,
                                AUTO_ENROLLMENT_EVENT_LEVEL_KEY,
                                &hKey))
    {
        if(ERROR_SUCCESS != RegQueryValueExW(
                                    hKey,
                                    AUTO_ENROLLMENT_EVENT_LEVEL,
                                    NULL,
                                    &dwType,
                                    (LPBYTE)&dwLogLevel,
                                    &cbLogLevel))
	    {
            dwLogLevel = STATUS_SEVERITY_ERROR;
        }

        if(hKey)
            RegCloseKey(hKey);

    }

    *pdwLogLevel=dwLogLevel;

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AERetrieveTemplateInfo
//
//-----------------------------------------------------------------------
BOOL    AERetrieveTemplateInfo(PCCERT_CONTEXT           pCertCurrent, 
                                AE_TEMPLATE_INFO        *pTemplateInfo)
{
    BOOL                fResult = FALSE;
    PCERT_EXTENSION     pExt = NULL;
    DWORD               cbData=0;

    CERT_NAME_VALUE     *pbName = NULL;
    CERT_TEMPLATE_EXT   *pbTemplate = NULL;

    if((NULL==pCertCurrent) || (NULL==pTemplateInfo))
        goto Ret;

    memset(pTemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    //try to find V2 template extension first
    if(pExt = CertFindExtension(szOID_CERTIFICATE_TEMPLATE,
                                pCertCurrent->pCertInfo->cExtension,
                                pCertCurrent->pCertInfo->rgExtension))
    {
        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_CERTIFICATE_TEMPLATE,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              NULL,
                              &cbData))
            goto Ret;

        pbTemplate = (CERT_TEMPLATE_EXT *)LocalAlloc(LPTR, cbData);

        if(NULL==pbTemplate)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_CERTIFICATE_TEMPLATE,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbTemplate,
                              &cbData))
            goto Ret;

        //copy the version
        pTemplateInfo->dwVersion=pbTemplate->dwMajorVersion;

        //copy the extension oid
        if(NULL==pbTemplate->pszObjId)
            goto Ret;

        if(0 == (cbData = MultiByteToWideChar(CP_ACP, 
                                  0,
                                  pbTemplate->pszObjId,
                                  -1,
                                  NULL,
                                  0)))
            goto Ret;

        if(NULL==(pTemplateInfo->pwszOid=(LPWSTR)LocalAlloc(LPTR, cbData * sizeof(WCHAR))))
            goto Ret;

        if(0 == MultiByteToWideChar(CP_ACP, 
                                  0,
                                  pbTemplate->pszObjId,
                                  -1,
                                  pTemplateInfo->pwszOid,
                                  cbData))
            goto Ret;

    }
    else
    {

        //try V1 template extension
        if(NULL == (pExt = CertFindExtension(
                                    szOID_ENROLL_CERTTYPE_EXTENSION,
                                    pCertCurrent->pCertInfo->cExtension,
                                    pCertCurrent->pCertInfo->rgExtension)))
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              X509_UNICODE_ANY_STRING,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              NULL,
                              &cbData))
            goto Ret;

        pbName = (CERT_NAME_VALUE *)LocalAlloc(LPTR, cbData);

        if(NULL==pbName)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              X509_UNICODE_ANY_STRING,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbName,
                              &cbData))
            goto Ret;

        if(!AEAllocAndCopy((LPWSTR)(pbName->Value.pbData),
                            &(pTemplateInfo->pwszName)))
            goto Ret;
    }


    fResult = TRUE;

Ret:

    if(pbTemplate)
        LocalFree(pbTemplate);

    if(pbName)
        LocalFree(pbName);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AEFreeTemplateInfo
//
//-----------------------------------------------------------------------
BOOL    AEFreeTemplateInfo(AE_TEMPLATE_INFO *pAETemplateInfo)
{
    if(pAETemplateInfo->pwszName)
        LocalFree(pAETemplateInfo->pwszName);

    if(pAETemplateInfo->pwszOid)
        LocalFree(pAETemplateInfo->pwszOid);

    memset(pAETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AEFindTemplateInRequestTree
//
//-----------------------------------------------------------------------
AE_CERTTYPE_INFO *AEFindTemplateInRequestTree(AE_TEMPLATE_INFO  *pTemplateInfo,
                                              AE_GENERAL_INFO   *pAE_General_Info)
{
    DWORD               dwIndex = 0;
    AE_CERTTYPE_INFO    *rgCertTypeInfo=NULL;
    AE_CERTTYPE_INFO    *pCertType=NULL;
    
    if(NULL == (rgCertTypeInfo=pAE_General_Info->rgCertTypeInfo))
        return NULL;

    if( (NULL == pTemplateInfo->pwszName) && (NULL == pTemplateInfo->pwszOid))
        return NULL;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if(pTemplateInfo->pwszOid)
        {
            //we are guaranteed to have an OID if the schema is greater than or equal to 2
            if(rgCertTypeInfo[dwIndex].dwSchemaVersion >= CERTTYPE_SCHEMA_VERSION_2)
            {
                if(0 == wcscmp(pTemplateInfo->pwszOid, (rgCertTypeInfo[dwIndex].awszOID)[0]))
                {
                    pCertType = &(rgCertTypeInfo[dwIndex]);
                    break;
                }
            }
        }
        else
        {
            //we are guaranteed to have a name
            if(0 == wcscmp(pTemplateInfo->pwszName, (rgCertTypeInfo[dwIndex].awszName)[0]))
            {
                pCertType = &(rgCertTypeInfo[dwIndex]);
                break;
            }
        }
    }

    return pCertType;
}

//-----------------------------------------------------------------------
//
//  AEIsLogonDCCertificate
//
//
//-----------------------------------------------------------------------
BOOL AEIsLogonDCCertificate(PCCERT_CONTEXT pCertContext)
{
    BOOL                fDCCert=FALSE;
    PCERT_EXTENSION     pExt = NULL;
    DWORD               cbData = 0;
    DWORD               dwIndex = 0;
    BOOL                fFound = FALSE;

    CERT_ENHKEY_USAGE   *pbKeyUsage=NULL;
    AE_TEMPLATE_INFO    AETemplateInfo;

    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));


    if(NULL==pCertContext)
        return FALSE;


    if(!AERetrieveTemplateInfo(pCertContext, &AETemplateInfo))
        goto Ret;
                      

    if(AETemplateInfo.pwszName)
    {
        //this is a V1 template.  Search for the hard coded DC template name
        if(0 == _wcsicmp(wszCERTTYPE_DC, AETemplateInfo.pwszName))
            fDCCert=TRUE;
    }
    else
    {
        //this is a V2 template.  Search for the smart card logon OID
        if(NULL==(pExt=CertFindExtension(szOID_ENHANCED_KEY_USAGE,
                                    pCertContext->pCertInfo->cExtension,
                                    pCertContext->pCertInfo->rgExtension)))
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_ENHANCED_KEY_USAGE,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              NULL,
                              &cbData))
            goto Ret;

        pbKeyUsage=(CERT_ENHKEY_USAGE *)LocalAlloc(LPTR, cbData);
        if(NULL==pbKeyUsage)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_ENHANCED_KEY_USAGE,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbKeyUsage,
                              &cbData))
            goto Ret;

        for(dwIndex=0; dwIndex < pbKeyUsage->cUsageIdentifier; dwIndex++)
        {
            if(0==_stricmp(szOID_KP_SMARTCARD_LOGON,(pbKeyUsage->rgpszUsageIdentifier)[dwIndex]))
            {
                fDCCert=TRUE;
                break;
            }
        }
    }


Ret:

    if(pbKeyUsage)
        LocalFree(pbKeyUsage);

    AEFreeTemplateInfo(&AETemplateInfo);

    return fDCCert;

}
//-----------------------------------------------------------------------
//
//  AEValidateCertificateInfo
//
//      This function verifies if the certificate needs to be renewed or 
//  re-enrolled based on:
//  
//      1. Presence of the private key
//      2. Chaining of the certificate
//      3. If the certificate is close to expiration
//
//-----------------------------------------------------------------------
BOOL    AEValidateCertificateInfo(AE_GENERAL_INFO   *pAE_General_Info,
                                  AE_CERTTYPE_INFO  *pCertType,
                                  BOOL              fCheckForPrivateKey,
                                  PCCERT_CONTEXT    pCertCurrent, 
                                  AE_CERT_INFO      *pAECertInfo)
{
    BOOL                        fResult = TRUE;
    DWORD                       cbData = 0;
    CERT_CHAIN_PARA             ChainParams;
    CERT_CHAIN_POLICY_PARA      ChainPolicy;
    CERT_CHAIN_POLICY_STATUS    PolicyStatus;
    LARGE_INTEGER               ftTime;
    HRESULT                     hrChainStatus = S_OK;
    LARGE_INTEGER               ftHalfLife;

    PCCERT_CHAIN_CONTEXT        pChainContext = NULL;

    if((NULL==pCertCurrent) || (NULL==pAECertInfo)  || (NULL==pAE_General_Info))
    {
        SetLastError(E_INVALIDARG);
        fResult = FALSE;
        goto Ret;
    }

    //assume the certificate is bad
    pAECertInfo->fValid = FALSE;
    pAECertInfo->fRenewal = FALSE;

    //////////////////////////////////////////////////
    //
    //check for the private key information
    //
    //////////////////////////////////////////////////
    if(fCheckForPrivateKey)
    {
        if(!CertGetCertificateContextProperty(
                pCertCurrent,
                CERT_KEY_PROV_INFO_PROP_ID,
                NULL,
                &cbData))
            goto Ret;
    }

    /////////////////////////////////////////////////////////
    //
    //check for chaining, revoke status and expiration of the certificate
    //
    /////////////////////////////////////////////////////////

    memset(&ChainParams, 0, sizeof(ChainParams));
    ChainParams.cbSize = sizeof(ChainParams);
    ChainParams.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;

    ChainParams.RequestedUsage.Usage.cUsageIdentifier = 0;
    ChainParams.RequestedUsage.Usage.rgpszUsageIdentifier = NULL;

    // Build a small time skew into the chain building in order to deal
    // with servers that may skew slightly fast.
    GetSystemTimeAsFileTime((LPFILETIME)&ftTime);
    ftTime.QuadPart += Int32x32To64(FILETIME_TICKS_PER_SECOND, AE_DEFAULT_SKEW);

    // Build a cert chain for the current status of the cert..
    if(!CertGetCertificateChain(pAE_General_Info->fMachine?HCCE_LOCAL_MACHINE:HCCE_CURRENT_USER,
                                pCertCurrent,
                                (LPFILETIME)&ftTime,
                                NULL,
                                &ChainParams,
                                CERT_CHAIN_REVOCATION_CHECK_CHAIN,
                                NULL,
                                &pChainContext))
    {
        AE_DEBUG((AE_WARNING, L"Could not build certificate chain (%lx)\n\r", GetLastError()));
        goto Ret;
    }
    
    //validate the certificate chain

    //special case for domain controller certificate.
    //it should not have any revocation error, even for status unknown case

    //check against the base policy
    memset(&ChainPolicy, 0, sizeof(ChainPolicy));
    ChainPolicy.cbSize = sizeof(ChainPolicy);
    ChainPolicy.dwFlags = 0;  // ignore nothing
    ChainPolicy.pvExtraPolicyPara = NULL;

    memset(&PolicyStatus, 0, sizeof(PolicyStatus));
    PolicyStatus.cbSize = sizeof(PolicyStatus);
    PolicyStatus.dwError = 0;
    PolicyStatus.lChainIndex = -1;
    PolicyStatus.lElementIndex = -1;
    PolicyStatus.pvExtraPolicyStatus = NULL;

    if(!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE,
                                          pChainContext,
                                          &ChainPolicy,
                                          &PolicyStatus))
    {
        AE_DEBUG((AE_WARNING, L"Base Chain Policy failed (%lx) - must get new cert\n\r", GetLastError()));
        goto Ret;
    }

    hrChainStatus = PolicyStatus.dwError;

    if((S_OK ==  hrChainStatus) ||
       (CRYPT_E_NO_REVOCATION_CHECK ==  hrChainStatus) ||
       (CRYPT_E_REVOCATION_OFFLINE ==  hrChainStatus))
    {
        // The cert is still currently acceptable by trust standards, so we can renew it
        pAECertInfo->fRenewal = TRUE;
    }
    else
    {
        goto Ret;
    }

    if(pChainContext)
    {
        CertFreeCertificateChain(pChainContext);
        pChainContext = NULL;
    }

    /////////////////////////////////////////////////////////////////////
    //
    // Check if the certificate is close to expire
    //
    ///////////////////////////////////////////////////////////////////////
    if(NULL==pCertType)
        goto Ret;

    // Nudge the evaluation of the cert chain by the expiration
    // offset so we know if is expired by that time in the future.
    GetSystemTimeAsFileTime((LPFILETIME)&ftTime);

    // Build the certificate chain for trust operations
    memset(&ChainParams, 0, sizeof(ChainParams));
    ChainParams.cbSize = sizeof(ChainParams);
    ChainParams.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;

    ChainParams.RequestedUsage.Usage.cUsageIdentifier = 0;
    ChainParams.RequestedUsage.Usage.rgpszUsageIdentifier = NULL;

    //get the half lifetime of the certificate
    ftHalfLife.QuadPart = (((LARGE_INTEGER UNALIGNED *)&(pCertCurrent->pCertInfo->NotAfter))->QuadPart - 
                               ((LARGE_INTEGER UNALIGNED *)&(pCertCurrent->pCertInfo->NotBefore))->QuadPart)/2;

    //check if the old cert is time nesting invalid
    if(ftHalfLife.QuadPart < 0)
        goto Ret;

    //check if the offset was specified in a relative value
    if(pCertType->ftExpirationOffset.QuadPart < 0)
    {
        if(ftHalfLife.QuadPart > (- pCertType->ftExpirationOffset.QuadPart))
        {
            ftTime.QuadPart -= pCertType->ftExpirationOffset.QuadPart;
        }
        else
        {
            ftTime.QuadPart += ftHalfLife.QuadPart;
        }
    }
    else
    {
        //the offset was specified in an absolute value
        if(0 < pCertType->ftExpirationOffset.QuadPart) 
            ftTime = pCertType->ftExpirationOffset;
        else
            //use the half time mark if the offset is 0
            ftTime.QuadPart += ftHalfLife.QuadPart;
    }

    //check the certificate chain at a future time
    if(!CertGetCertificateChain(pAE_General_Info->fMachine?HCCE_LOCAL_MACHINE:HCCE_CURRENT_USER,
                                    pCertCurrent,
                                    (LPFILETIME)&ftTime,
                                    NULL,               //no additional store
                                    &ChainParams,
                                    0,                  //no revocation check
                                    NULL,               //Reserved
                                    &pChainContext))
    {
        AE_DEBUG((AE_WARNING, L"Could not build certificate chain (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    // Verify expiration of the certificate
    memset(&ChainPolicy, 0, sizeof(ChainPolicy));
    ChainPolicy.cbSize = sizeof(ChainPolicy);
    ChainPolicy.dwFlags = 0;  // ignore nothing
    ChainPolicy.pvExtraPolicyPara = NULL;

    memset(&PolicyStatus, 0, sizeof(PolicyStatus));
    PolicyStatus.cbSize = sizeof(PolicyStatus);
    PolicyStatus.dwError = 0;
    PolicyStatus.lChainIndex = -1;
    PolicyStatus.lElementIndex = -1;
    PolicyStatus.pvExtraPolicyStatus = NULL;

    if(!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_BASE,
                                          pChainContext,
                                          &ChainPolicy,
                                          &PolicyStatus))
    {
        AE_DEBUG((AE_WARNING, L"Base Chain Policy failed (%lx) - must get new cert\n\r", GetLastError()));
        goto Ret;
    }

    hrChainStatus = PolicyStatus.dwError;

    if((S_OK != hrChainStatus) &&
       (CRYPT_E_NO_REVOCATION_CHECK != hrChainStatus) &&
       (CRYPT_E_REVOCATION_OFFLINE != hrChainStatus))
    {
        // The cert is close to expire. we must re-renewal
        goto Ret;
    }

    //the certificate is good
    pAECertInfo->fValid = TRUE;

    fResult = TRUE;

Ret:
    if(pChainContext)
        CertFreeCertificateChain(pChainContext);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AESameOID
//
//      Check if the two OIDs are the same
//-----------------------------------------------------------------------
BOOL AESameOID(LPWSTR pwszOID, LPSTR pszOID)
{
    DWORD   cbChar=0;
    BOOL    fSame=FALSE;

    LPSTR   pszNewOID=NULL;

    if((NULL==pwszOID) || (NULL==pszOID))
        return FALSE;

    cbChar= WideCharToMultiByte(
                CP_ACP,                // codepage
                0,                      // dwFlags
                pwszOID,
                -1,
                NULL,
                0,
                NULL,
                NULL);

    if(0 == cbChar)
        goto Ret;

    if(NULL==(pszNewOID=(LPSTR)LocalAlloc(LPTR, cbChar)))
        goto Ret;

    cbChar= WideCharToMultiByte(
                CP_ACP,                // codepage
                0,                      // dwFlags
                pwszOID,
                -1,
                pszNewOID,
                cbChar,
                NULL,
                NULL);

    if(0 == cbChar)
        goto Ret;


    if(0 == _stricmp(pszNewOID, pszOID))
        fSame=TRUE;

Ret:

    if(pszNewOID)
        LocalFree(pszNewOID);

    return fSame;
}


//-----------------------------------------------------------------------
//
//  AEValidRAPolicyWithProperty
//
//      Check if the certificate matches the RA signature requirement
//  of the certificate type
//-----------------------------------------------------------------------
BOOL    AEValidRAPolicyWithProperty(PCCERT_CONTEXT pCertContext, 
                                    LPWSTR          *rgwszPolicy,
                                    LPWSTR          *rgwszAppPolicy)
{
    PCERT_EXTENSION     pExt = NULL;
    DWORD               cbData = 0;
    DWORD               dwIndex = 0;
    DWORD               dwFindIndex=0;
    BOOL                fFound = FALSE;
    BOOL                fValid = FALSE;

    CERT_ENHKEY_USAGE   *pbKeyUsage=NULL;
    CERT_POLICIES_INFO  *pbAppPolicy=NULL;
    CERT_POLICIES_INFO  *pbPolicy=NULL;

    //find the EKUs
    if(pExt=CertFindExtension(szOID_ENHANCED_KEY_USAGE,
                                pCertContext->pCertInfo->cExtension,
                                pCertContext->pCertInfo->rgExtension))
    {
        cbData=0;
        if(!CryptDecodeObject(X509_ASN_ENCODING,
                          szOID_ENHANCED_KEY_USAGE,
                          pExt->Value.pbData,
                          pExt->Value.cbData,
                          0,
                          NULL,
                          &cbData))
        goto Ret;

        pbKeyUsage=(CERT_ENHKEY_USAGE *)LocalAlloc(LPTR, cbData);
        if(NULL==pbKeyUsage)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_ENHANCED_KEY_USAGE,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbKeyUsage,
                              &cbData))
            goto Ret;
    }

    //get the cert issurance policy
    if(pExt=CertFindExtension(szOID_CERT_POLICIES,
                                pCertContext->pCertInfo->cExtension,
                                pCertContext->pCertInfo->rgExtension))
    {
        cbData=0;
        if(!CryptDecodeObject(X509_ASN_ENCODING,
                          szOID_CERT_POLICIES,
                          pExt->Value.pbData,
                          pExt->Value.cbData,
                          0,
                          NULL,
                          &cbData))
        goto Ret;

        pbPolicy=(CERT_POLICIES_INFO *)LocalAlloc(LPTR, cbData);
        if(NULL==pbPolicy)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_CERT_POLICIES,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbPolicy,
                              &cbData))
            goto Ret;
    }
   
    
    //get the cert application policy
    if(pExt=CertFindExtension(szOID_APPLICATION_CERT_POLICIES,
                                pCertContext->pCertInfo->cExtension,
                                pCertContext->pCertInfo->rgExtension))
    {
        cbData=0;
        if(!CryptDecodeObject(X509_ASN_ENCODING,
                          szOID_CERT_POLICIES,
                          pExt->Value.pbData,
                          pExt->Value.cbData,
                          0,
                          NULL,
                          &cbData))
        goto Ret;

        pbAppPolicy=(CERT_POLICIES_INFO *)LocalAlloc(LPTR, cbData);
        if(NULL==pbAppPolicy)
            goto Ret;

        if(!CryptDecodeObject(X509_ASN_ENCODING,
                              szOID_CERT_POLICIES,
                              pExt->Value.pbData,
                              pExt->Value.cbData,
                              0,
                              pbAppPolicy,
                              &cbData))
            goto Ret;
    }
    

    if(rgwszPolicy)
    {
        if(rgwszPolicy[0])
        {
            if(NULL==pbPolicy)
                goto Ret;

            dwIndex=0;
            while(rgwszPolicy[dwIndex])
            {
                fFound=FALSE;

                for(dwFindIndex=0; dwFindIndex < pbPolicy->cPolicyInfo; dwFindIndex++)
                {
                    if(AESameOID(rgwszPolicy[dwIndex], (pbPolicy->rgPolicyInfo)[dwFindIndex].pszPolicyIdentifier))
                    {
                        fFound=TRUE;
                        break;
                    }
                }

                if(FALSE == fFound)
                    goto Ret;

                dwIndex++;
            }
        }
    }

    if(rgwszAppPolicy)
    {
        if(rgwszAppPolicy[0])
        {
            if((NULL==pbAppPolicy) && (NULL==pbKeyUsage))
                goto Ret;

            dwIndex=0;
            while(rgwszAppPolicy[dwIndex])
            {
                fFound=FALSE;

                if(pbAppPolicy)
                {
                    for(dwFindIndex=0; dwFindIndex < pbAppPolicy->cPolicyInfo; dwFindIndex++)
                    {
                        if(AESameOID(rgwszAppPolicy[dwIndex], (pbAppPolicy->rgPolicyInfo)[dwFindIndex].pszPolicyIdentifier))
                        {
                            fFound=TRUE;
                            break;
                        }
                    }
                }

                if((FALSE == fFound) && (pbKeyUsage))
                {
                    for(dwFindIndex=0; dwFindIndex < pbKeyUsage->cUsageIdentifier; dwFindIndex++)
                    {
                        if(AESameOID(rgwszAppPolicy[dwIndex],(pbKeyUsage->rgpszUsageIdentifier)[dwFindIndex]))
                        {
                            fFound=TRUE;
                            break;
                        }
                    }
                }

                if(FALSE == fFound)
                    goto Ret;

                dwIndex++;
            }
        }
    }

    fValid=TRUE;

Ret:
    if(pbKeyUsage)
        LocalFree(pbKeyUsage);

    if(pbPolicy)
        LocalFree(pbPolicy);

    if(pbAppPolicy)
        LocalFree(pbAppPolicy);

    return fValid;
}


//-----------------------------------------------------------------------
//
//  AEValidRAPolicy
//
//      Check if the certificate matches the RA signature requirement
//  of the certificate type
//-----------------------------------------------------------------------
BOOL    AEValidRAPolicy(PCCERT_CONTEXT pCertContext, AE_CERTTYPE_INFO *pCertType)
{
    BOOL                fValid=FALSE;

    LPWSTR              *rgwszPolicy=NULL;
    LPWSTR              *rgwszAppPolicy=NULL;

    if((NULL==pCertType) || (NULL==pCertContext))
        return FALSE;

    //get the certificate type properties
    CAGetCertTypePropertyEx(pCertType->hCertType,
                            CERTTYPE_PROP_RA_POLICY,
                            &rgwszPolicy);


    CAGetCertTypePropertyEx(pCertType->hCertType,
                            CERTTYPE_PROP_RA_APPLICATION_POLICY,
                            &rgwszAppPolicy);

    fValid = AEValidRAPolicyWithProperty(pCertContext, rgwszPolicy, rgwszAppPolicy);


    if(rgwszPolicy)
        CAFreeCertTypeProperty(pCertType->hCertType, rgwszPolicy);

    if(rgwszAppPolicy)
        CAFreeCertTypeProperty(pCertType->hCertType, rgwszAppPolicy);

    return fValid;

}

//-----------------------------------------------------------------------
//
//  AESomeCSPSupported
//
//-----------------------------------------------------------------------
BOOL    AESomeCSPSupported(HCERTTYPE     hCertType)
{
    BOOL            fResult=FALSE;
    DWORD           dwIndex=0;
    DWORD           dwCSPIndex=0;
    DWORD           dwProviderType=0;
    DWORD           cbSize=0;

    LPWSTR          *awszCSP=NULL;
    LPWSTR          pwszProviderName=NULL;
    HCRYPTPROV      hProv=NULL;


    if(NULL==hCertType)
        goto Ret;

    //no CSPs means all CSPs are fine
    if((S_OK != CAGetCertTypePropertyEx(
                    hCertType,
                    CERTTYPE_PROP_CSP_LIST,
                    &awszCSP)) || (NULL == awszCSP))
    {
        fResult=TRUE;
        goto Ret;
    }

    //no CSP means all CSPs are fine
    if(NULL == awszCSP[0])
    {
        fResult=TRUE;
        goto Ret;
    }

    for(dwIndex=0; NULL != awszCSP[dwIndex]; dwIndex++)
    {
        for (dwCSPIndex = 0; 
	        CryptEnumProvidersW(dwCSPIndex, 0, 0, &dwProviderType, NULL, &cbSize);
	        dwCSPIndex++)
        {	
	        pwszProviderName = (LPWSTR)LocalAlloc(LPTR, cbSize);

	        if(NULL == pwszProviderName)
	            goto Ret;
	    
	        //get the provider name and type
	        if(!CryptEnumProvidersW(dwCSPIndex,
	            0,
	            0,
	            &dwProviderType,
	            pwszProviderName,
	            &cbSize))
	            goto Ret; 

            if(0 == _wcsicmp(pwszProviderName, awszCSP[dwIndex]))
            {
                //find the CSP.  See if it is present in the box
                if(CryptAcquireContextW(
                            &hProv,
                            NULL,
                            awszCSP[dwIndex],
                            dwProviderType,
                            CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
                {

                    CryptReleaseContext(hProv, 0);
                    hProv=NULL;

                    fResult=TRUE;
                    break;
                }
            }

            //keep the CSP enumeration
            if(pwszProviderName)
                LocalFree(pwszProviderName);

            pwszProviderName=NULL;
            cbSize=0;
            dwProviderType=0;
        }

        //detect if a valid CSP if found
        if(TRUE == fResult)
        {
            break;
        }

        cbSize=0;
        dwProviderType=0;
    }

Ret:
    if(pwszProviderName)
        LocalFree(pwszProviderName);

    if(hProv)
        CryptReleaseContext(hProv, 0);

    if(awszCSP)
        CAFreeCertTypeProperty(hCertType, awszCSP);

    return fResult;

}


//-----------------------------------------------------------------------
//
//  AESmartcardOnlyTemplate
//
//-----------------------------------------------------------------------
BOOL    AESmartcardOnlyTemplate(HCERTTYPE   hCertType)
{
    BOOL            fResult=FALSE;
    DWORD           dwIndex=0;
    DWORD           dwImpType=0;
    DWORD           cbData=0;
    DWORD           dwSCCount=0;

    LPWSTR          *awszCSP=NULL;
    HCRYPTPROV      hProv = NULL;

    if(NULL==hCertType)
        goto Ret;

    if(S_OK != CAGetCertTypePropertyEx(
                    hCertType,
                    CERTTYPE_PROP_CSP_LIST,
                    &awszCSP))
        goto Ret;

    if(NULL==awszCSP)
        goto Ret;

    for(dwIndex=0; NULL != awszCSP[dwIndex]; dwIndex++)
    {
        dwImpType=0;

        //all smart card CSPs are RSA_FULL. 
        if(CryptAcquireContextW(
                    &hProv,
                    NULL,
                    awszCSP[dwIndex],
                    PROV_RSA_FULL,
                    CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
        {

            cbData = sizeof(dwImpType);
         
            if(CryptGetProvParam(hProv,
                    PP_IMPTYPE,
                    (BYTE *)(&dwImpType),
                    &cbData,
                    0))
            {
                if((CRYPT_IMPL_REMOVABLE & dwImpType) && (CRYPT_IMPL_MIXED & dwImpType))
                    dwSCCount++;
            }

            CryptReleaseContext(hProv, 0);
            hProv=NULL;
        }
    }

    //smart card CSP only if all CSPs are for smart card only
    if((0 != dwIndex) && (dwIndex==dwSCCount))
        fResult=TRUE;

Ret:
    if(hProv)
        CryptReleaseContext(hProv, 0);

    if(awszCSP)
        CAFreeCertTypeProperty(hCertType, awszCSP);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AEUserProtectionForTemplate
//
//-----------------------------------------------------------------------
BOOL   AEUserProtectionForTemplate(AE_GENERAL_INFO *pAE_General_Info, PCERT_CONTEXT pCertContext)
{
    BOOL                fUserProtection=FALSE;
    AE_CERTTYPE_INFO    *pCertType=NULL;

    AE_TEMPLATE_INFO    AETemplateInfo;


    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    if((NULL == pAE_General_Info) || (NULL == pCertContext))
        goto Ret;

    //get the template information for the certificate
    if(!AERetrieveTemplateInfo(pCertContext, &AETemplateInfo))
        goto Ret;

    pCertType=AEFindTemplateInRequestTree(&AETemplateInfo, pAE_General_Info);

    if(NULL==pCertType)
        goto Ret;

    if(CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED & (pCertType->dwPrivateKeyFlag))
        fUserProtection=TRUE;

Ret:

    AEFreeTemplateInfo(&AETemplateInfo);

    return fUserProtection;
}

//-----------------------------------------------------------------------
//
//  AEUISetForTemplate
//
//-----------------------------------------------------------------------
BOOL    AEUISetForTemplate(AE_GENERAL_INFO *pAE_General_Info, PCERT_CONTEXT pCertContext)
{
    BOOL                fUI=FALSE;
    AE_CERTTYPE_INFO    *pCertType=NULL;

    AE_TEMPLATE_INFO    AETemplateInfo;


    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    if((NULL == pAE_General_Info) || (NULL == pCertContext))
        goto Ret;

    //get the template information for the certificate
    if(!AERetrieveTemplateInfo(pCertContext, &AETemplateInfo))
        goto Ret;

    pCertType=AEFindTemplateInRequestTree(&AETemplateInfo, pAE_General_Info);

    if(NULL==pCertType)
        goto Ret;

    if(CT_FLAG_USER_INTERACTION_REQUIRED & (pCertType->dwEnrollmentFlag))
        fUI=TRUE;

Ret:

    AEFreeTemplateInfo(&AETemplateInfo);

    return fUI;
}

//-----------------------------------------------------------------------
//
//  AECanEnrollCertType
//
//-----------------------------------------------------------------------
BOOL    AECanEnrollCertType(HANDLE  hToken, AE_CERTTYPE_INFO *pCertType, AE_GENERAL_INFO *pAE_General_Info, BOOL *pfUserProtection)
{
    DWORD               dwValue = 0;
    PCCERT_CONTEXT      pCertCurrent=NULL;
    AE_CERT_INFO        AECertInfo;

    memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));

	*pfUserProtection=FALSE;

    //check enrollment ACL
    if(S_OK != CACertTypeAccessCheckEx(
                        pCertType->hCertType,
                        hToken,
                        CERTTYPE_ACCESS_CHECK_ENROLL | CERTTYPE_ACCESS_CHECK_NO_MAPPING))
        return FALSE;


    //check the subject requirements
    if(S_OK != CAGetCertTypeFlagsEx(
                        pCertType->hCertType,
                        CERTTYPE_SUBJECT_NAME_FLAG,
                        &dwValue))
        return FALSE;

    if((CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT & dwValue) || 
       (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME & dwValue))
        return FALSE;

    //check if we are doing smart card CSPs and there is no reader installed
    if(FALSE == (pAE_General_Info->fSmartcardSystem))
    {
        if(AESmartcardOnlyTemplate(pCertType->hCertType))
            return FALSE;
    }

    //check if all CSPs on the template is not supported 
    {
        if(!AESomeCSPSupported(pCertType->hCertType))
            return FALSE;
    }


    //we might not get the RA property for V1 template
    dwValue = 0;

    //check the RA support
    if(S_OK != CAGetCertTypePropertyEx(
                pCertType->hCertType,
                CERTTYPE_PROP_RA_SIGNATURE,
                &dwValue))
        return TRUE;

    if(0==dwValue)
        return TRUE;

    //self-template RA
    if((CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT & (pCertType->dwEnrollmentFlag)) &&
        ((pCertType->fRenewal) && (pCertType->pOldCert))
       )
    {
        //the request has to be RAed
        pCertType->fNeedRA=TRUE;
        return TRUE;
    }

    //autoenrollment only deal with one RA signature.  
    //it is sufficient for autoenrollment RA scenarios
    if(1!=dwValue)
        return FALSE;

    //the certificate template requires one and only one RA signature

    //cross-template RA
    //enumerate all certificate in store
    while(pCertCurrent = CertEnumCertificatesInStore(pAE_General_Info->hMyStore, pCertCurrent))
    {
        //check if we need to enroll/renewal for the certificate
        AEValidateCertificateInfo(pAE_General_Info, 
                                NULL,
                                TRUE,               //valid private key
                                pCertCurrent, 
                                &AECertInfo);

        //the certificate is good enough for RA signature purpose
        if(AECertInfo.fRenewal)
        {
            if(AEValidRAPolicy(pCertCurrent, pCertType))
            {
				if(AEUserProtectionForTemplate(pAE_General_Info, (PCERT_CONTEXT)pCertCurrent))
				{
					if(pAE_General_Info->fMachine)
					{
						*pfUserProtection=TRUE;
						continue;
					}
					else
					{
						if(0==(CT_FLAG_USER_INTERACTION_REQUIRED & (pCertType->dwEnrollmentFlag)))
						{
							*pfUserProtection=TRUE;
							continue;
						}
					}
				}

                pCertType->fRenewal=TRUE;

                if(pCertType->pOldCert)
                {
                    CertFreeCertificateContext(pCertType->pOldCert);
                    pCertType->pOldCert=NULL;
                }

                //we will free the certificate context later
                pCertType->pOldCert=(PCERT_CONTEXT)pCertCurrent;

                //we mark UI required if the RAing certificate template requires UI
                if(AEUISetForTemplate(pAE_General_Info, pCertType->pOldCert))
                    pCertType->fUIActive=TRUE;

                //we mark the requests has to be RAed.
                pCertType->fNeedRA=TRUE;

                //we mark that we are doing cross RAing.
                pCertType->fCrossRA=TRUE;

				*pfUserProtection=FALSE;

                return TRUE;
            }
        }

        memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
    }


    return FALSE;
}
//-----------------------------------------------------------------------
//
//  AEMarkAutoenrollment
//
//-----------------------------------------------------------------------
BOOL    AEMarkAutoenrollment(AE_GENERAL_INFO *pAE_General_Info)
{
    DWORD   dwIndex = 0;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if(CT_FLAG_AUTO_ENROLLMENT & ((pAE_General_Info->rgCertTypeInfo)[dwIndex].dwEnrollmentFlag))
        {
            //check the autoenrollment ACL
            if(S_OK != CACertTypeAccessCheckEx(
                            (pAE_General_Info->rgCertTypeInfo)[dwIndex].hCertType,
                            pAE_General_Info->hToken,
                            CERTTYPE_ACCESS_CHECK_AUTO_ENROLL | CERTTYPE_ACCESS_CHECK_NO_MAPPING))
                continue;


            //mark the template nees to be auto-enrolled
            (pAE_General_Info->rgCertTypeInfo)[dwIndex].dwStatus=CERT_REQUEST_STATUS_ACTIVE;
            (pAE_General_Info->rgCertTypeInfo)[dwIndex].fCheckMyStore=TRUE;
        }
    }

    return TRUE;
}

//-----------------------------------------------------------------------
//
//    IsACRSStoreEmpty
//
//
//-----------------------------------------------------------------------
BOOL IsACRSStoreEmpty(BOOL fMachine)
{
    DWORD                       dwOpenStoreFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_READONLY_FLAG;
    LPSTR                       pszCTLUsageOID = NULL;
    BOOL                        fEmpty = TRUE;
    CERT_PHYSICAL_STORE_INFO    PhysicalStoreInfo;
    CTL_FIND_USAGE_PARA         CTLFindUsage;

    PCCTL_CONTEXT               pCTLContext = NULL;
    HCERTSTORE                  hStoreACRS=NULL;

    memset(&PhysicalStoreInfo, 0, sizeof(PhysicalStoreInfo));
    memset(&CTLFindUsage, 0, sizeof(CTLFindUsage));


    // if the auto enrollment is for a user then we need to shut off inheritance
    // from the local machine store so that we don't try and enroll for certs
    // which are meant to be for the machine
    if (FALSE == fMachine)
    {
		dwOpenStoreFlags = CERT_SYSTEM_STORE_CURRENT_USER | CERT_STORE_READONLY_FLAG;

        PhysicalStoreInfo.cbSize = sizeof(PhysicalStoreInfo);
        PhysicalStoreInfo.dwFlags = CERT_PHYSICAL_STORE_OPEN_DISABLE_FLAG;

        if (!CertRegisterPhysicalStore(ACRS_STORE, 
                                       CERT_SYSTEM_STORE_CURRENT_USER,
                                       CERT_PHYSICAL_STORE_LOCAL_MACHINE_NAME, 
                                       &PhysicalStoreInfo,
                                       NULL))
        {
            AE_DEBUG((AE_ERROR, L"Could not register ACRS store: (%lx)\n\r", GetLastError()));
            goto Ret;
        }
    }

    // open the ACRS store and fine the CTL based on the auto enrollment usage
    if (NULL == (hStoreACRS = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
                                          ENCODING_TYPE, 
                                          NULL, 
                                          dwOpenStoreFlags, 
                                          ACRS_STORE)))
    {
        AE_DEBUG((AE_ERROR, L"Could not open ACRS store: (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    //find the template name specified in the CTLContext
    CTLFindUsage.cbSize = sizeof(CTLFindUsage);
    CTLFindUsage.SubjectUsage.cUsageIdentifier = 1;
    pszCTLUsageOID = szOID_AUTO_ENROLL_CTL_USAGE;
    CTLFindUsage.SubjectUsage.rgpszUsageIdentifier = &pszCTLUsageOID;

    while(pCTLContext = CertFindCTLInStore(hStoreACRS,
                                           X509_ASN_ENCODING,
                                           CTL_FIND_SAME_USAGE_FLAG,
                                           CTL_FIND_USAGE,
                                           &CTLFindUsage,
                                           pCTLContext))
    {
        fEmpty=FALSE;
        break;
    }


Ret:

    if(pCTLContext)
        CertFreeCTLContext(pCTLContext);

    if(hStoreACRS)
        CertCloseStore(hStoreACRS, 0);

    return fEmpty;
}


//-----------------------------------------------------------------------
//
//  AEMarkAEObject
//
//      Mark the active status based on ACRS store
//
//      INFORMATION:
//      we do not honor the CA specified in the autoenrollment object anymore.  All CAs
//      in the enterprise should be treated equal; and once the CA is renewed, it certificate
//      will be changed anyway.
//-----------------------------------------------------------------------
BOOL    AEMarkAEObject(AE_GENERAL_INFO  *pAE_General_Info)
{
    DWORD                       dwOpenStoreFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_READONLY_FLAG;
    PCCTL_CONTEXT               pCTLContext = NULL;
    LPSTR                       pszCTLUsageOID = NULL;
    LPWSTR                      wszCertTypeName = NULL;
    AE_CERTTYPE_INFO            *pCertType=NULL;
    CERT_PHYSICAL_STORE_INFO    PhysicalStoreInfo;
    CTL_FIND_USAGE_PARA         CTLFindUsage;
    AE_TEMPLATE_INFO            AETemplateInfo;

    HCERTSTORE                  hStoreACRS=NULL;

    memset(&PhysicalStoreInfo, 0, sizeof(PhysicalStoreInfo));
    memset(&CTLFindUsage, 0, sizeof(CTLFindUsage));
    memset(&AETemplateInfo, 0, sizeof(AETemplateInfo));


    // if the auto enrollment is for a user then we need to shut off inheritance
    // from the local machine store so that we don't try and enroll for certs
    // which are meant to be for the machine
    if (FALSE == (pAE_General_Info->fMachine))
    {
		dwOpenStoreFlags = CERT_SYSTEM_STORE_CURRENT_USER | CERT_STORE_READONLY_FLAG;

        PhysicalStoreInfo.cbSize = sizeof(PhysicalStoreInfo);
        PhysicalStoreInfo.dwFlags = CERT_PHYSICAL_STORE_OPEN_DISABLE_FLAG;

        if (!CertRegisterPhysicalStore(ACRS_STORE, 
                                       CERT_SYSTEM_STORE_CURRENT_USER,
                                       CERT_PHYSICAL_STORE_LOCAL_MACHINE_NAME, 
                                       &PhysicalStoreInfo,
                                       NULL))
        {
            AE_DEBUG((AE_ERROR, L"Could not register ACRS store: (%lx)\n\r", GetLastError()));
            goto Ret;
        }
    }

    // open the ACRS store and fine the CTL based on the auto enrollment usage
    if (NULL == (hStoreACRS = CertOpenStore(CERT_STORE_PROV_SYSTEM_W,
                                          ENCODING_TYPE, 
                                          NULL, 
                                          dwOpenStoreFlags, 
                                          ACRS_STORE)))
    {
        AE_DEBUG((AE_ERROR, L"Could not open ACRS store: (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    //find the template name specified in the CTLContext
    CTLFindUsage.cbSize = sizeof(CTLFindUsage);
    CTLFindUsage.SubjectUsage.cUsageIdentifier = 1;
    pszCTLUsageOID = szOID_AUTO_ENROLL_CTL_USAGE;
    CTLFindUsage.SubjectUsage.rgpszUsageIdentifier = &pszCTLUsageOID;

    while(pCTLContext = CertFindCTLInStore(hStoreACRS,
                                           X509_ASN_ENCODING,
                                           CTL_FIND_SAME_USAGE_FLAG,
                                           CTL_FIND_USAGE,
                                           &CTLFindUsage,
                                           pCTLContext))
    {
        if(NULL== (pCTLContext->pCtlInfo->ListIdentifier.pbData))
            continue;

        wszCertTypeName = wcschr((LPWSTR)pCTLContext->pCtlInfo->ListIdentifier.pbData, L'|');
        if(wszCertTypeName)
        {
            wszCertTypeName++;
        }
        else
        {
            wszCertTypeName = (LPWSTR)pCTLContext->pCtlInfo->ListIdentifier.pbData;
        }

        AETemplateInfo.pwszName = wszCertTypeName;

        if(pCertType=AEFindTemplateInRequestTree(&AETemplateInfo, pAE_General_Info))
        {
            if(0 == pCertType->dwStatus)
            {
                //mark the template needs to be auto-enrolled
                pCertType->dwStatus=CERT_REQUEST_STATUS_ACTIVE;
                pCertType->fCheckMyStore=TRUE;
            }
        }
        else
        {
            //log that the template is invalid
            AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_INVALID_ACRS_OBJECT,                              
                 pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, wszCertTypeName);
        }

    }


Ret:

    if(hStoreACRS)
        CertCloseStore(hStoreACRS, 0);

    return TRUE;
}


//-----------------------------------------------------------------------
//
//  AEManageAndMarkMyStore
//
//-----------------------------------------------------------------------
BOOL    AEManageAndMarkMyStore(AE_GENERAL_INFO *pAE_General_Info)
{
    AE_CERT_INFO        AECertInfo;
    AE_CERTTYPE_INFO    *pCertType=NULL;
    BOOL                fNeedToValidate=TRUE;
    PCCERT_CONTEXT      pCertCurrent = NULL;
    DWORD               cbData=0;

    AE_TEMPLATE_INFO    AETemplateInfo;


    memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    //enumerate all certificate in store
    while(pCertCurrent = CertEnumCertificatesInStore(pAE_General_Info->hMyStore, pCertCurrent))
    {
        //only interested in certificate with template information
        if(AERetrieveTemplateInfo(pCertCurrent, &AETemplateInfo))
        {
            if(pCertType=AEFindTemplateInRequestTree(
                            &AETemplateInfo, pAE_General_Info))
            {
                //if we are not supposed to check for my store, only search
                //for template with ACTIVE status
                if(0 == (AUTO_ENROLLMENT_ENABLE_MY_STORE_MANAGEMENT & (pAE_General_Info->dwPolicy)))
                {
                    if(!(pCertType->fCheckMyStore))
                        goto Next;
                }

                //make sure the version of the certificate template is up to date
                //we do not have version for V1 template
                if(AETemplateInfo.pwszOid)
                {
                    if(AETemplateInfo.dwVersion < pCertType->dwVersion)
                    {
                        AECertInfo.fValid=FALSE;
                        AECertInfo.fRenewal = FALSE;

                        //self-RA renewal
                        if(CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT & pCertType->dwEnrollmentFlag)
                        {
                            if(CertGetCertificateContextProperty(
                                pCertCurrent,
                                CERT_KEY_PROV_INFO_PROP_ID,
                                NULL,
                                &cbData))
                                AECertInfo.fRenewal = TRUE;
                        }

                        fNeedToValidate=FALSE;
                    }
                }
                
                if(fNeedToValidate)
                {
                    //check if we need to enroll/renewal for the certificate
                    AEValidateCertificateInfo(pAE_General_Info, 
                                            pCertType,
                                            TRUE,               //valid private key
                                            pCertCurrent, 
                                            &AECertInfo);
                }

                if(AECertInfo.fValid)
                {
                    //if the certificate is valid, mark as obtained.  And copy the 
                    //certificate to the obtained store.  Keep the archive store.
                    pCertType->dwStatus = CERT_REQUEST_STATUS_OBTAINED;

                    CertAddCertificateContextToStore(
                            pCertType->hObtainedStore,
                            pCertCurrent,
                            CERT_STORE_ADD_ALWAYS,
                            NULL);

                }
                else
                {
                    //the certificate is not valid
                    //mark the status to active if it is not obtained
                    if(CERT_REQUEST_STATUS_OBTAINED != pCertType->dwStatus)
                    {
                        pCertType->dwStatus = CERT_REQUEST_STATUS_ACTIVE;

                        if(AECertInfo.fRenewal)
                        {
                            //we only need to copy renewal information once
                            if(!pCertType->fRenewal)
                            {
                                pCertType->fRenewal=TRUE;
                                pCertType->pOldCert=(PCERT_CONTEXT)CertDuplicateCertificateContext(pCertCurrent);
                            }
                        }
                    }

                    //copy the certificate to the Archive certificate store
                    CertAddCertificateContextToStore(
                            pCertType->hArchiveStore,
                            pCertCurrent,
                            CERT_STORE_ADD_ALWAYS,
                            NULL);
                }
            }
            else
            {
                 //log that the template is invalid
                 AELogAutoEnrollmentEvent(
                    pAE_General_Info->dwLogLevel, 
                    FALSE, 
                    S_OK, 
                    EVENT_INVALID_TEMPLATE_MY_STORE,                              
                    pAE_General_Info->fMachine, 
                    pAE_General_Info->hToken, 
                    1,
                    AETemplateInfo.pwszName ? AETemplateInfo.pwszName : AETemplateInfo.pwszOid);

            }
        }

Next:
        memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
        AEFreeTemplateInfo(&AETemplateInfo);
        fNeedToValidate=TRUE;
        cbData=0;
    }

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AEOpenUserDSStore
//
//      INFORMATION: We could just open the "UserDS" store as if it is "My"
//
//-----------------------------------------------------------------------
HCERTSTORE  AEOpenUserDSStore(AE_GENERAL_INFO *pAE_General_Info, DWORD dwOpenFlag)
{
    LPWSTR      pwszPath=L"ldap:///%s?userCertificate?base?objectCategory=user";
    DWORD       dwSize=0;
    WCHAR       wszDN[MAX_DN_SIZE];

    LPWSTR      pwszDN=NULL;
    LPWSTR      pwszStore=NULL;
    HCERTSTORE  hStore=NULL;

    dwSize=MAX_DN_SIZE;

    if(!GetUserNameExW(NameFullyQualifiedDN, wszDN, &dwSize))
    {
        if(dwSize > MAX_DN_SIZE)
        {
            pwszDN=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * dwSize);

            if(NULL==pwszDN)
                goto Ret;

            if(!GetUserNameExW(NameFullyQualifiedDN, pwszDN, &dwSize))
                goto Ret;
        }
        else
            goto Ret;
    }

    pwszStore = (LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR)*(wcslen(pwszDN ? pwszDN : wszDN)+wcslen(pwszPath)+1));
    if(pwszStore == NULL)
        goto Ret;

    wsprintf(pwszStore, 
             pwszPath,
             pwszDN ? pwszDN : wszDN);

    hStore = CertOpenStore(CERT_STORE_PROV_LDAP, 
                  ENCODING_TYPE,
                  NULL,
                  dwOpenFlag, 
                  pwszStore);

Ret:

    if(pwszStore)
        LocalFree(pwszStore);

    if(pwszDN)
        LocalFree(pwszDN);

    return hStore;
}


//-----------------------------------------------------------------------
//
//  AECheckUserDSStore
//
//-----------------------------------------------------------------------
BOOL    AECheckUserDSStore(AE_GENERAL_INFO  *pAE_General_Info)
{
    PCCERT_CONTEXT      pCertCurrent = NULL;
    AE_CERTTYPE_INFO    *pCertType=NULL;
    BOOL                fNeedToValidate=TRUE;
    AE_CERT_INFO        AECertInfo;

    HCERTSTORE          hUserDS = NULL;
    AE_TEMPLATE_INFO    AETemplateInfo;
    
    memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));
    
    pCertType=pAE_General_Info->rgCertTypeInfo;

    if(NULL==pCertType)
        goto Ret;

    if(NULL== (hUserDS = AEOpenUserDSStore(pAE_General_Info, CERT_STORE_READONLY_FLAG)))
        goto Ret;

    pCertType = NULL;
    while(pCertCurrent = CertEnumCertificatesInStore(hUserDS, pCertCurrent))
    {
        //only interested in certificate with template information
        if(AERetrieveTemplateInfo(pCertCurrent, &AETemplateInfo))
        {
            if(pCertType=AEFindTemplateInRequestTree(
                            &AETemplateInfo, pAE_General_Info))
            {
                //if we are not supposed to check for UserDS store, only search
                //for template with ACTIVE status
                if(0 == (AUTO_ENROLLMENT_ENABLE_MY_STORE_MANAGEMENT & (pAE_General_Info->dwPolicy)))
                {
                    if(!(pCertType->fCheckMyStore))
                        goto Next;
                }

                //make sure the version of the certificate template is up to date
                //we do not have version for V1 template
                if(AETemplateInfo.pwszOid)
                {
                    if(AETemplateInfo.dwVersion < pCertType->dwVersion)
                    {
                        AECertInfo.fValid=FALSE;
                        AECertInfo.fRenewal=FALSE;
                        fNeedToValidate=FALSE;
                    }
                }
                
                if(fNeedToValidate)
                {
                    //check if we need to enroll/renewal for the certificate
                    AEValidateCertificateInfo(pAE_General_Info, 
                                            pCertType,
                                            FALSE,               //does not valid private key
                                            pCertCurrent, 
                                            &AECertInfo);
                }

                //we only interested in any valid certificate
                if(AECertInfo.fValid)
                {
                    if((CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE & (pCertType->dwEnrollmentFlag)) &&
                        (CERT_REQUEST_STATUS_OBTAINED != pCertType->dwStatus))
                    {
                        //mark the status as obtained. 
                        pCertType->dwStatus = CERT_REQUEST_STATUS_OBTAINED;
                    }

                    CertAddCertificateContextToStore(
                            pCertType->hObtainedStore,
                            pCertCurrent,
                            CERT_STORE_ADD_USE_EXISTING,
                            NULL);

                }
                else
                {
                    //copy the certificate to the Archive certificate store
                    CertAddCertificateContextToStore(
                            pCertType->hArchiveStore,
                            pCertCurrent,
                            CERT_STORE_ADD_USE_EXISTING,
                            NULL);
                }
            }
        }

Next:
        memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
        AEFreeTemplateInfo(&AETemplateInfo);
        fNeedToValidate=TRUE;
    }
Ret:
    
    if(hUserDS)
        CertCloseStore(hUserDS, 0);

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AECheckPendingRequests
//
//      If we have pending update-to-date certificate requests, no need
//  to enroll/renew for duplicates.
//-----------------------------------------------------------------------
BOOL    AECheckPendingRequests(AE_GENERAL_INFO *pAE_General_Info)
{
    DWORD                   dwIndex=0;
    DWORD                   dwVersion=0;
    AE_CERTTYPE_INFO        *pCertType=NULL;
    BOOL                    fValid=FALSE;
    DWORD                   dwCount=0;
    DWORD                   dwMax=PENDING_ALLOC_SIZE;
    PFNPIEnroll4GetNoCOM    pfnPIEnroll4GetNoCOM=NULL;
    FILETIME                ftTime;
    LARGE_INTEGER           ftRequestTime;
    AE_TEMPLATE_INFO        AETemplateInfo;

    IEnroll4                *pIEnroll4=NULL;
    CRYPT_DATA_BLOB         *rgblobHash=NULL;
    CRYPT_DATA_BLOB         blobName;

    //init before any goto Ret
    memset(&blobName, 0, sizeof(blobName));
    memset(&AETemplateInfo, 0, sizeof(AETemplateInfo));

    if(NULL==pAE_General_Info->hXenroll)
        goto Ret;

    if(NULL==(pfnPIEnroll4GetNoCOM=(PFNPIEnroll4GetNoCOM)GetProcAddress(
                        pAE_General_Info->hXenroll,
                        "PIEnroll4GetNoCOM")))
        goto Ret;

    if(NULL==(pIEnroll4=pfnPIEnroll4GetNoCOM()))
        goto Ret;

    GetSystemTimeAsFileTime(&ftTime);

    if(pAE_General_Info->fMachine)
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_LOCAL_MACHINE))
            goto Ret;
    }
    else
    {
        if(S_OK != pIEnroll4->put_RequestStoreFlags(CERT_SYSTEM_STORE_CURRENT_USER))
            goto Ret;
    }

    //enumerate all the pending requests

    rgblobHash=(CRYPT_DATA_BLOB *)LocalAlloc(LPTR, dwMax * sizeof(CRYPT_DATA_BLOB));
    if(NULL==rgblobHash)
        goto Ret;

    memset(rgblobHash, 0, dwMax * sizeof(CRYPT_DATA_BLOB));

    //initialize the enumerator
    if(S_OK != pIEnroll4->enumPendingRequestWStr(XEPR_ENUM_FIRST, 0, NULL))
        goto Ret;

    while(AEGetPendingRequestProperty(
                    pIEnroll4,
                    dwIndex,
                    XEPR_DATE,
                    &ftRequestTime))
    {
        ftRequestTime.QuadPart += Int32x32To64(FILETIME_TICKS_PER_SECOND, 
                                    AE_PENDING_REQUEST_ACTIVE_PERIOD * 24 * 3600);

        //remove the request if out of date
        if(0 <= CompareFileTime(&ftTime, (LPFILETIME)&ftRequestTime))
        {
            AERetrieveRequestProperty(pIEnroll4, dwIndex, &dwCount, &dwMax, &rgblobHash);
        }
        else
        {
            //get the version and the template name of the request
            if(AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_V2TEMPLATEOID, &blobName))
            {
                //this is a V2 template
                if(!AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_VERSION, &dwVersion))
                    goto Next;

                AETemplateInfo.pwszOid=(LPWSTR)blobName.pbData;

            }
            else
            {
                if(!AEGetPendingRequestProperty(pIEnroll4, dwIndex, XEPR_V1TEMPLATENAME, &blobName))
                    goto Next;

                AETemplateInfo.pwszName=(LPWSTR)blobName.pbData;
            }

            //find the template
            if(NULL==(pCertType=AEFindTemplateInRequestTree(
                            &AETemplateInfo, pAE_General_Info)))
                goto Next;

            if(AETemplateInfo.pwszName)
                fValid=TRUE;
            else
            {
                if(dwVersion >= pCertType->dwVersion)
                    fValid=TRUE;
            }

            if(fValid)
            {
                //this is a valid pending request 
                if(CERT_REQUEST_STATUS_OBTAINED != pCertType->dwStatus)
                    pCertType->dwStatus=CERT_REQUEST_STATUS_PENDING;
            }
            else
            {
                if(CERT_REQUEST_STATUS_OBTAINED == pCertType->dwStatus)
                    AERetrieveRequestProperty(pIEnroll4, dwIndex, &dwCount, &dwMax, &rgblobHash);
            }
        }

Next:
        
        if(blobName.pbData)
            LocalFree(blobName.pbData);
        memset(&blobName, 0, sizeof(blobName));

        memset(&AETemplateInfo, 0, sizeof(AETemplateInfo));

        fValid=FALSE;
        dwVersion=0;

        dwIndex++;
    }

    //remove the requests based the hash
    if(dwCount)
    {
        AERemovePendingRequest(pIEnroll4, dwCount, rgblobHash);
        AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_PENDING_INVALID, pAE_General_Info->fMachine, pAE_General_Info->hToken, 0);
    }

Ret:

    AEFreePendingRequests(dwCount, rgblobHash);

    if(blobName.pbData)
        LocalFree(blobName.pbData);

    if(pIEnroll4)
        pIEnroll4->Release();

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AECheckSupersedeRequest
//
//-----------------------------------------------------------------------
BOOL AECheckSupersedeRequest(DWORD              dwCurIndex,
                             AE_CERTTYPE_INFO   *pCurCertType, 
                             AE_CERTTYPE_INFO   *pSupersedingCertType, 
                             AE_GENERAL_INFO    *pAE_General_Info)
{
    BOOL                fFound=FALSE;

    LPWSTR              *awszSuperseding=NULL; 

    if(S_OK == CAGetCertTypePropertyEx(
                 pSupersedingCertType->hCertType, 
                 CERTTYPE_PROP_SUPERSEDE,
                 &(awszSuperseding)))
    {
        if(awszSuperseding && awszSuperseding[0])
        {
            if(AEIfSupersede(pCurCertType->awszName[0], awszSuperseding, pAE_General_Info))
            {
                switch(pCurCertType->dwStatus)
                {
                    case CERT_REQUEST_STATUS_ACTIVE:
                    case CERT_REQUEST_STATUS_SUPERSEDE_ACTIVE:
                            //remove the active status if it is superseded by an obtained certificate
                            if(CERT_REQUEST_STATUS_OBTAINED != pSupersedingCertType->dwStatus) 
                            {
                                pCurCertType->dwStatus = CERT_REQUEST_STATUS_SUPERSEDE_ACTIVE;
                                pSupersedingCertType->prgActive[pSupersedingCertType->dwActive]=dwCurIndex;
                                (pSupersedingCertType->dwActive)++;
                            }
                            else
                            {
                                pCurCertType->dwStatus = 0;
                            }

                    case CERT_REQUEST_STATUS_PENDING:
                                AECopyCertStore(pCurCertType->hArchiveStore,
                                                pSupersedingCertType->hArchiveStore);

                        break;

                    case CERT_REQUEST_STATUS_OBTAINED:

                                AECopyCertStore(pCurCertType->hObtainedStore,
                                                pSupersedingCertType->hArchiveStore);

                        break;

                   default:

                        break;    
                }

                //we consider that we find a valid superseding template only if the status
                //is obtained.  If the status is anyting else, we need to keep searching since
                //enrollment/renewal requests might not be granted
                if(CERT_REQUEST_STATUS_OBTAINED == pSupersedingCertType->dwStatus)
                    fFound=TRUE;
            }

            //clear the visited flag in AE_General_Info
            AEClearVistedFlag(pAE_General_Info);
        }

        //free the property
        if(awszSuperseding)
            CAFreeCertTypeProperty(
                pSupersedingCertType->hCertType,
                awszSuperseding);

        awszSuperseding=NULL;
    }

    return fFound;
}

//-----------------------------------------------------------------------
//
//  AEIsCALonger
//
//      For renewal, the CA's certificate has to live longer than the 
//  renewing certificate    
//  
//-----------------------------------------------------------------------
BOOL    AEIsCALonger(HCAINFO    hCAInfo, PCERT_CONTEXT  pOldCert)
{
    BOOL            fCALonger=TRUE;

    PCCERT_CONTEXT  pCACert=NULL;

    //we assume the CA is good unless we found something wrong
    if((NULL == hCAInfo) || (NULL == pOldCert))
        goto Ret;

    if(S_OK != CAGetCACertificate(hCAInfo, &pCACert))
        goto Ret;

    if(NULL == pCACert)
        goto Ret;

    //CA cert's NotAfter should be longer than the issued certificate' NotAfger
    if(1 == CompareFileTime(&(pCACert->pCertInfo->NotAfter), &(pOldCert->pCertInfo->NotAfter)))
        goto Ret;

    fCALonger=FALSE;

Ret:

    if(pCACert)
        CertFreeCertificateContext(pCACert);

    return fCALonger;
}


//-----------------------------------------------------------------------
//
//  AECanFindCAForCertType
//
//      Check if there exists a CA that can issue the specified certificate 
//  template.    
//  
//-----------------------------------------------------------------------
BOOL    AECanFindCAForCertType(AE_GENERAL_INFO   *pAE_General_Info, AE_CERTTYPE_INFO *pCertType)
{
    DWORD           dwIndex=0;
    BOOL            fFound=FALSE;
    AE_CA_INFO      *prgCAInfo=pAE_General_Info->rgCAInfo;
    BOOL            fRenewal=FALSE;


    //detect if we are performing an enrollment or renewal
    if((pCertType->fRenewal) && (pCertType->pOldCert))
    {
        if((pCertType->fNeedRA) && (pCertType->fCrossRA))
            fRenewal=FALSE;
        else
            fRenewal=TRUE;
    }
    else
        fRenewal=FALSE;

    if(prgCAInfo)
    {
        for(dwIndex=0; dwIndex < pAE_General_Info->dwCA; dwIndex++)
        {
            //make sure the CA supports the specific template
            if(AEIsAnElement((pCertType->awszName)[0], 
                              (prgCAInfo[dwIndex]).awszCertificateTemplate))
            {
                if(FALSE == fRenewal)
                {
                    fFound=TRUE;
                    break;
                }
                else
                {
                    if(AEIsCALonger(prgCAInfo[dwIndex].hCAInfo, pCertType->pOldCert))
                    {
                        fFound=TRUE;
                        break;
                    }
                }
            }
        }
    }

    return fFound;
}

//-----------------------------------------------------------------------
//
//  AEManageActiveTemplates
//      
//      We make sure that for all active templates, we can in deed enroll
//  for it.
//
//-----------------------------------------------------------------------
BOOL    AEManageActiveTemplates(AE_GENERAL_INFO   *pAE_General_Info)
{
    DWORD               dwIndex=0;
    AE_CERTTYPE_INFO    *pCertTypeInfo=pAE_General_Info->rgCertTypeInfo;
    AE_CERTTYPE_INFO    *pCurCertType=NULL;
    BOOL                fCanEnrollCertType=FALSE;
	BOOL				fUserProtection=FALSE;
	DWORD				dwEventID=0;

    if(pCertTypeInfo)
    {
        for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
        {
            pCurCertType = &(pCertTypeInfo[dwIndex]);

            fCanEnrollCertType=FALSE;
			fUserProtection=FALSE;

            if(CERT_REQUEST_STATUS_PENDING == pCurCertType->dwStatus)
            {
                //check if UI is required
                if(CT_FLAG_USER_INTERACTION_REQUIRED & (pCurCertType->dwEnrollmentFlag))
                {
                    pCurCertType->fUIActive=TRUE;

                    if(pAE_General_Info->fMachine)
                    {
                        pCurCertType->dwStatus = 0;

                        //log that user does not have access right to the template
                        AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_NO_ACCESS_ACRS_OBJECT,                              
                            pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, (pCurCertType->awszDisplay)[0]);
                    }
                }

                continue;
            }


            if(CERT_REQUEST_STATUS_ACTIVE != pCurCertType->dwStatus)
                continue;

			//check if CRYPT_USER_PROTECTED is used for machine certificate template
			if(CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED & pCurCertType->dwPrivateKeyFlag)
			{
                if(pAE_General_Info->fMachine)
                {
                    pCurCertType->dwStatus = 0;

                    //log that machine template should not require user password
                    AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_NO_ACCESS_ACRS_OBJECT,                              
                        pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, (pCurCertType->awszDisplay)[0]);

					continue;
                }
				else
				{
					if(0 == (CT_FLAG_USER_INTERACTION_REQUIRED & (pCurCertType->dwEnrollmentFlag)))
					{
						pCurCertType->dwStatus = 0;

						//log that user interaction is not set
						AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_NO_ACCESS_ACRS_OBJECT,                              
							pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, (pCurCertType->awszDisplay)[0]);

						continue;
					}
				}
			}

            fCanEnrollCertType=AECanEnrollCertType(pAE_General_Info->hToken, pCurCertType, pAE_General_Info, &fUserProtection);

            if((!fCanEnrollCertType) ||
               (!AECanFindCAForCertType(pAE_General_Info, pCurCertType))
              )
            {
                pCurCertType->dwStatus = 0;

                //log that user does not have access right to the template
				if(FALSE == fUserProtection)
				{
					dwEventID=EVENT_NO_ACCESS_ACRS_OBJECT;
				}
				else
				{
					if(pAE_General_Info->fMachine)
						dwEventID=EVENT_NO_ACCESS_ACRS_OBJECT;
					else
						dwEventID=EVENT_NO_ACCESS_ACRS_OBJECT;
				}

				AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, dwEventID,                              
						pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, (pCurCertType->awszDisplay)[0]);
            }
            else
            {
                //check if UI is required
                if(CT_FLAG_USER_INTERACTION_REQUIRED & (pCurCertType->dwEnrollmentFlag))
                {
                    pCurCertType->fUIActive=TRUE;

                    if(pAE_General_Info->fMachine)
                    {
                        pCurCertType->dwStatus = 0;

                        //log that user does not have access right to the template
                        AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_NO_ACCESS_ACRS_OBJECT,                              
                            pAE_General_Info->fMachine, pAE_General_Info->hToken, 1, (pCurCertType->awszDisplay)[0]);
                    }
                }

            }
        }

    }

    return TRUE;
}        
//-----------------------------------------------------------------------
//
//  AEManageSupersedeRequests
//      remove duplicated requests based on "Supersede" relationship
//
//
//-----------------------------------------------------------------------
BOOL    AEManageSupersedeRequests(AE_GENERAL_INFO   *pAE_General_Info)
{
    DWORD               dwIndex=0;
    DWORD               dwSuperseding=0;
    DWORD               dwOrder=0;
    AE_CERTTYPE_INFO    *pCertTypeInfo=pAE_General_Info->rgCertTypeInfo;
    AE_CERTTYPE_INFO    *pCurCertType=NULL;
    AE_CERTTYPE_INFO    *pSupersedingCertType=NULL;
    BOOL                fFound=FALSE;

    if(pCertTypeInfo)
    {
        for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
        {
            pCurCertType = &(pCertTypeInfo[dwIndex]);

            //we only consider templates with valid status
            if(0 == pCurCertType->dwStatus)
                continue;

            fFound=FALSE;

            for(dwOrder=0; dwOrder < g_dwSupersedeOrder; dwOrder++)
            {
                for(dwSuperseding=0; dwSuperseding < pAE_General_Info->dwCertType; dwSuperseding++)
                {
                    //one can not be superseded by itself
                    if(dwIndex == dwSuperseding)
                        continue;

                    pSupersedingCertType = &(pCertTypeInfo[dwSuperseding]);

                    //we consider templates with obtained status first
                    if(g_rgdwSupersedeOrder[dwOrder] != pSupersedingCertType->dwStatus)
                        continue;

                    fFound = AECheckSupersedeRequest(dwIndex, pCurCertType, pSupersedingCertType, pAE_General_Info);

                    //we find a valid superseding template
                    if(fFound)
                        break;
                }

                //we find a valid superseding template
                if(fFound)
                    break;
            }
        }
    }

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AEDoOneEnrollment
//
//-----------------------------------------------------------------------
/*BOOL    AEDoOneEnrollment(HWND                  hwndParent,
                          BOOL                  fUIProcess,
                          BOOL                  fMachine,
                          LPWSTR                pwszMachineName,
                          AE_CERTTYPE_INFO      *pCertType, 
                          AE_CA_INFO            *pCAInfo,
                          DWORD                 *pdwStatus)
{
    BOOL                                fResult = FALSE;
    CRYPTUI_WIZ_CERT_REQUEST_INFO       CertRequestInfo;
    CRYPTUI_WIZ_CERT_TYPE               CertWizType;
    CRYPTUI_WIZ_CERT_REQUEST_PVK_NEW    CertPvkNew;
    CRYPT_KEY_PROV_INFO                 KeyProvInfo;

    memset(&CertRequestInfo, 0, sizeof(CRYPTUI_WIZ_CERT_REQUEST_INFO));
    memset(&CertWizType, 0, sizeof(CRYPTUI_WIZ_CERT_TYPE));
    memset(&CertPvkNew, 0, sizeof(CRYPTUI_WIZ_CERT_REQUEST_PVK_NEW));
    memset(&KeyProvInfo, 0, sizeof(CRYPT_KEY_PROV_INFO));

    CertRequestInfo.dwSize = sizeof(CRYPTUI_WIZ_CERT_REQUEST_INFO);

    //enroll or renewal
    if((pCertType->fRenewal) && (pCertType->pOldCert))
    {
        CertRequestInfo.dwPurpose = CRYPTUI_WIZ_CERT_RENEW;
        CertRequestInfo.pRenewCertContext = pCertType->pOldCert;
    }
    else
        CertRequestInfo.dwPurpose = CRYPTUI_WIZ_CERT_ENROLL;

    //machine name
    if(fMachine)
    {
        CertRequestInfo.pwszMachineName = pwszMachineName;
    }

    //private key information
    CertRequestInfo.dwPvkChoice = CRYPTUI_WIZ_CERT_REQUEST_PVK_CHOICE_NEW;
    CertRequestInfo.pPvkNew = &CertPvkNew;

    CertPvkNew.dwSize = sizeof(CertPvkNew);
    CertPvkNew.pKeyProvInfo = &KeyProvInfo;
    CertPvkNew.dwGenKeyFlags = 0;   //no need to specify the exportable flags

    //SILENT is always set for machine
    if(fMachine)
        KeyProvInfo.dwFlags = CRYPT_MACHINE_KEYSET | CRYPT_SILENT;
    else
    {
        if(fUIProcess)
            KeyProvInfo.dwFlags = 0;
        else
            KeyProvInfo.dwFlags = CRYPT_SILENT;
    }

    //CA information
    CertRequestInfo.pwszCALocation = pCAInfo->awszCADNS[0];
    CertRequestInfo.pwszCAName = pCAInfo->awszCAName[0];

    //enroll for the template
    CertRequestInfo.dwCertChoice = CRYPTUI_WIZ_CERT_REQUEST_CERT_TYPE;
    CertRequestInfo.pCertType = &CertWizType;

    CertWizType.dwSize = sizeof(CertWizType);
    CertWizType.cCertType = 1;
    CertWizType.rgwszCertType = &(pCertType->awszName[0]);

    //ISSUE: we need to call Duncanb's new no-DS look up API
    //for faster performance
    fResult = CryptUIWizCertRequest(CRYPTUI_WIZ_NO_UI_EXCEPT_CSP | CRYPTUI_WIZ_NO_INSTALL_ROOT,
                            hwndParent,
                            NULL,
                            &CertRequestInfo,
                            NULL,               //pCertContext
                            pdwStatus);
    return fResult;
} */

//-----------------------------------------------------------------------
//
//  AECreateEnrollmentRequest
//
//   
//-----------------------------------------------------------------------
BOOL    AECreateEnrollmentRequest(
                          HWND                  hwndParent,
                          BOOL                  fUIProcess,
                          BOOL                  fMachine,
                          LPWSTR                pwszMachineName,
                          AE_CERTTYPE_INFO      *pCertType,
                          AE_CA_INFO            *pCAInfo,
                          HANDLE                *phRequest,
                          DWORD                 *pdwLastError)
{
    BOOL                                    fResult = FALSE;
    CRYPTUI_WIZ_CREATE_CERT_REQUEST_INFO    CreateRequestInfo;
    CRYPTUI_WIZ_CERT_REQUEST_PVK_NEW        CertPvkNew;
    CRYPT_KEY_PROV_INFO                     KeyProvInfo;
    DWORD                                   dwFlags=CRYPTUI_WIZ_NO_UI_EXCEPT_CSP | 
                                                    CRYPTUI_WIZ_NO_INSTALL_ROOT |
                                                    CRYPTUI_WIZ_ALLOW_ALL_TEMPLATES |
                                                    CRYPTUI_WIZ_ALLOW_ALL_CAS;
    DWORD                                   dwSize=0;
    DWORD                                   dwAcquireFlags=0;
    BOOL                                    fResetProv=FALSE;

    CRYPT_KEY_PROV_INFO                     *pKeyProvInfo=NULL;
    HANDLE                                  hRequest=NULL;

    memset(&CreateRequestInfo, 0, sizeof(CRYPTUI_WIZ_CREATE_CERT_REQUEST_INFO));
    memset(&CertPvkNew, 0, sizeof(CRYPTUI_WIZ_CERT_REQUEST_PVK_NEW));
    memset(&KeyProvInfo, 0, sizeof(CRYPT_KEY_PROV_INFO));

    CreateRequestInfo.dwSize = sizeof(CreateRequestInfo);


    //enroll or renewal
    if((pCertType->fRenewal) && (pCertType->pOldCert))
    {
        CreateRequestInfo.dwPurpose = CRYPTUI_WIZ_CERT_RENEW;
        CreateRequestInfo.pRenewCertContext = pCertType->pOldCert;

        //we should not archive renewal certificate for cross template RA
        if((pCertType->fNeedRA) && (pCertType->fCrossRA))
            dwFlags |= CRYPTUI_WIZ_NO_ARCHIVE_RENEW_CERT;

        //we should disalbe UI for machine or non-UI enrollment renew/RA certificate
        if((TRUE == fMachine) || (FALSE == fUIProcess))
        {
            dwSize=0;
            if(!CertGetCertificateContextProperty(pCertType->pOldCert,
                                                CERT_KEY_PROV_INFO_PROP_ID,
                                                NULL,
                                                &dwSize))
                goto error;

            pKeyProvInfo=(CRYPT_KEY_PROV_INFO *)LocalAlloc(LPTR, dwSize);

            if(NULL == pKeyProvInfo)
                goto error;

            if(!CertGetCertificateContextProperty(pCertType->pOldCert,
                                                CERT_KEY_PROV_INFO_PROP_ID,
                                                pKeyProvInfo,
                                                &dwSize))
                goto error;

            dwAcquireFlags=pKeyProvInfo->dwFlags;

            pKeyProvInfo->dwFlags |= CRYPT_SILENT;

            //set the property
            if(!CertSetCertificateContextProperty(pCertType->pOldCert,
                                                 CERT_KEY_PROV_INFO_PROP_ID,
                                                 CERT_SET_PROPERTY_INHIBIT_PERSIST_FLAG,
                                                 pKeyProvInfo))
                goto error;

            fResetProv=TRUE;
        }
    }
    else
        CreateRequestInfo.dwPurpose = CRYPTUI_WIZ_CERT_ENROLL;

    //cert template information
    CreateRequestInfo.hCertType = pCertType->hCertType;

    //machine name
    if(fMachine)
    {
        CreateRequestInfo.fMachineContext = TRUE;
    }

    //private key information
    CreateRequestInfo.dwPvkChoice = CRYPTUI_WIZ_CERT_REQUEST_PVK_CHOICE_NEW;
    CreateRequestInfo.pPvkNew = &CertPvkNew;

    CertPvkNew.dwSize = sizeof(CertPvkNew);
    CertPvkNew.pKeyProvInfo = &KeyProvInfo;
    CertPvkNew.dwGenKeyFlags = 0;   //no need to specify the exportable flags

    //SILENT is always set for machine
    if(fMachine)
        KeyProvInfo.dwFlags = CRYPT_MACHINE_KEYSET | CRYPT_SILENT;
    else
    {
        if(fUIProcess)
            KeyProvInfo.dwFlags = 0;
        else
            KeyProvInfo.dwFlags = CRYPT_SILENT;
    }


    //CA information
    CreateRequestInfo.pwszCALocation = pCAInfo->awszCADNS[0];
    CreateRequestInfo.pwszCAName = pCAInfo->awszCAName[0];

    if(!CryptUIWizCreateCertRequestNoDS(
                            dwFlags,
                            hwndParent,
                            &CreateRequestInfo,
                            &hRequest))
        goto error;


    if(NULL==hRequest)
        goto error;

    *phRequest=hRequest;

    hRequest=NULL;


    fResult = TRUE;

error:

    //get the last error
    if(FALSE == fResult)
    {
        *pdwLastError=GetLastError();
    }

    //reset the property
    if(TRUE == fResetProv)
    {
        if((pKeyProvInfo) && (pCertType->pOldCert))
        {
            pKeyProvInfo->dwFlags = dwAcquireFlags;

            //set the property
            CertSetCertificateContextProperty(pCertType->pOldCert,
                                             CERT_KEY_PROV_INFO_PROP_ID,
                                             CERT_SET_PROPERTY_INHIBIT_PERSIST_FLAG,
                                             pKeyProvInfo);
        }
    }

    if(pKeyProvInfo)
        LocalFree(pKeyProvInfo);

    if(hRequest)
        CryptUIWizFreeCertRequestNoDS(hRequest);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AECancelled
//
//-----------------------------------------------------------------------
BOOL    AECancelled(HANDLE hCancelEvent)
{
    if(NULL==hCancelEvent)
        return FALSE;

    //test if the event is signalled
    if(WAIT_OBJECT_0 == WaitForSingleObject(hCancelEvent, 0))
        return TRUE;

    return FALSE;
}
//-----------------------------------------------------------------------
//
//  AEDoEnrollment
//
//  return TRUE is no need to do another renewal.   
//  *pdwStatus contain the real enrollment status.
//
//-----------------------------------------------------------------------
BOOL    AEDoEnrollment(HWND             hwndParent,
                       HANDLE           hCancelEvent,
                       BOOL             fUIProcess,
                       DWORD            dwLogLevel,
                       HANDLE           hToken,
                       BOOL             fMachine,
                       LPWSTR           pwszMachineName,
                       AE_CERTTYPE_INFO *pCertType, 
                       DWORD            dwCA,
                       AE_CA_INFO       *rgCAInfo,
                       DWORD            *pdwStatus)
{
    BOOL            fResult = FALSE;
    DWORD           dwIndex = 0;
    DWORD           dwCAIndex = 0;
    BOOL            fRenewal = FALSE;
    DWORD           dwEventID = 0;
    BOOL            fFoundCA = FALSE; 
    DWORD           idsSummary = 0;         //keep the last failure case
    DWORD           dwLastError = 0;

    CRYPTUI_WIZ_QUERY_CERT_REQUEST_INFO     QueryCertRequestInfo;

    HANDLE          hRequest=NULL;
    PCCERT_CONTEXT  pCertContext=NULL;


    //init the out parameter
    *pdwStatus = CRYPTUI_WIZ_CERT_REQUEST_STATUS_REQUEST_ERROR;

    //detect if we are performing an enrollment or renewal
    if((pCertType->fRenewal) && (pCertType->pOldCert))
    {
        if((pCertType->fNeedRA) && (pCertType->fCrossRA))
            fRenewal=FALSE;
        else
            fRenewal=TRUE;
    }
    else
        fRenewal=FALSE;


    //loop through all the CAs
    for(dwIndex =0; dwIndex < dwCA; dwIndex++)
    {
        dwCAIndex =  (dwIndex + pCertType->dwRandomCAIndex) % dwCA;

        if(AECancelled(hCancelEvent))
        {
            //no need to renew any more
            fResult=TRUE;

            //log that autoenrollment is cancelled
            AELogAutoEnrollmentEvent(dwLogLevel,
                                    FALSE, 
                                    S_OK, 
                                    EVENT_AUTOENROLL_CANCELLED,
                                    fMachine, 
                                    hToken,
                                    0);

            break;
        }

        //make sure the CA supports the specific template
        if(!AEIsAnElement((pCertType->awszName)[0], 
                          rgCAInfo[dwCAIndex].awszCertificateTemplate))
            continue;

        //make sure the CA's validity period of more than the renewing certificate
        if(TRUE == fRenewal)
        {
            if(!AEIsCALonger(rgCAInfo[dwCAIndex].hCAInfo, pCertType->pOldCert))
                continue;
        }

        //enroll to the CA
        *pdwStatus = CRYPTUI_WIZ_CERT_REQUEST_STATUS_REQUEST_ERROR;
        fFoundCA = TRUE;

        //create a certificate request
        if(NULL==hRequest)
        {
            if(!AECreateEnrollmentRequest(hwndParent, fUIProcess, fMachine, pwszMachineName, pCertType, &(rgCAInfo[dwCAIndex]), &hRequest, &dwLastError))
            {
                //check if user cancelled the enrollment.  If so, no 
                //need to try another CA.
                if((HRESULT_FROM_WIN32(ERROR_CANCELLED) == dwLastError) ||
                   (SCARD_W_CANCELLED_BY_USER == dwLastError))
                {
                    //no need to renewal anymore
                    fResult = TRUE;

                    //log that autoenrollment is cancelled
                    AELogAutoEnrollmentEvent(dwLogLevel,
                                            FALSE, 
                                            S_OK, 
                                            EVENT_AUTOENROLL_CANCELLED_TEMPLATE,
                                            fMachine, 
                                            hToken,
                                            1,
                                            pCertType->awszDisplay[0]);

                    break;

                }
                else
                {
                    idsSummary=IDS_SUMMARY_REQUEST;

                    if(CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL & pCertType->dwPrivateKeyFlag)
                    {
                        //we have a chance of success with another CA
                        if(hRequest)
                        {
                            CryptUIWizFreeCertRequestNoDS(hRequest);
                            hRequest=NULL;
                        }

                        continue;

                    }
                    else
                    {
                        //we have no hope to create a request successfully
                        //mark dwIndex to the dwCA so that we will log an event at the end of the loop
                        dwIndex=dwCA;
                        break;
                    }
                }
            }
        }

        //check the cancel again because significant time can pass during 
        //request creation
        if(AECancelled(hCancelEvent))
        {
            //no need to renew any more
            fResult=TRUE;

            //log that autoenrollment is cancelled
            AELogAutoEnrollmentEvent(dwLogLevel,
                                    FALSE, 
                                    S_OK, 
                                    EVENT_AUTOENROLL_CANCELLED,
                                    fMachine, 
                                    hToken,
                                    0);

            break;
        }

        if(CryptUIWizSubmitCertRequestNoDS(
                    hRequest, 
                    hwndParent,
                    rgCAInfo[dwCAIndex].awszCAName[0], 
                    rgCAInfo[dwCAIndex].awszCADNS[0], 
                    pdwStatus, 
                    &pCertContext))
        {
            //no need to try another CA if the request is successful or pending
            if((CRYPTUI_WIZ_CERT_REQUEST_STATUS_SUCCEEDED == (*pdwStatus)) ||
                (CRYPTUI_WIZ_CERT_REQUEST_STATUS_UNDER_SUBMISSION == (*pdwStatus))
              )
            {
                //no need to renewal anymore
                fResult = TRUE;

                if(CRYPTUI_WIZ_CERT_REQUEST_STATUS_SUCCEEDED == (*pdwStatus))
                {
                    //we copy the certificate to publishing
                    if(pCertContext)
                    {
                        CertAddCertificateContextToStore(pCertType->hIssuedStore,
                                                        pCertContext,
                                                        CERT_STORE_ADD_USE_EXISTING,
                                                        NULL);

                        CertFreeCertificateContext(pCertContext);
                        pCertContext=NULL;
                    }

                    dwEventID=fRenewal ? EVENT_RENEWAL_SUCCESS_ONCE : EVENT_ENROLL_SUCCESS_ONCE; 
                }
                else
                {
                    dwEventID=fRenewal ? EVENT_RENEWAL_PENDING_ONCE : EVENT_ENROLL_PENDING_ONCE; 
                }

                //log the enrollment sucess or pending event
                AELogAutoEnrollmentEvent(dwLogLevel,
                                        FALSE, 
                                        S_OK, 
                                        dwEventID,
                                        fMachine, 
                                        hToken,
                                        3,
                                        pCertType->awszDisplay[0],
                                        rgCAInfo[dwCAIndex].awszCADisplay[0],
                                        rgCAInfo[dwCAIndex].awszCADNS[0]);

                //log if the private key is re-used
                memset(&QueryCertRequestInfo, 0, sizeof(QueryCertRequestInfo));
                QueryCertRequestInfo.dwSize=sizeof(QueryCertRequestInfo);

                if(CryptUIWizQueryCertRequestNoDS(hRequest,
                                                  &QueryCertRequestInfo))
                {
                    if(CRYPTUI_WIZ_QUERY_CERT_REQUEST_STATUS_CREATE_REUSED_PRIVATE_KEY &
                        (QueryCertRequestInfo.dwStatus))
                    {
                        AELogAutoEnrollmentEvent(dwLogLevel,
                                                FALSE, 
                                                S_OK, 
                                                EVENT_PRIVATE_KEY_REUSED,
                                                fMachine, 
                                                hToken,
                                                1,
                                                pCertType->awszDisplay[0]);
                    }
                }


                break;
            }
        }

        //get the last error
        dwLastError=GetLastError();

        idsSummary=IDS_SUMMARY_CA;

        //log the one enrollment warning
        AELogAutoEnrollmentEvent(dwLogLevel,
                                TRUE, 
                                HRESULT_FROM_WIN32(dwLastError), 
                                fRenewal ? EVENT_RENEWAL_FAIL_ONCE : EVENT_ENROLL_FAIL_ONCE, 
                                fMachine, 
                                hToken,
                                3,
                                pCertType->awszDisplay[0],
                                rgCAInfo[dwCAIndex].awszCADisplay[0],
                                rgCAInfo[dwCAIndex].awszCADNS[0]);


        //we should recreate the request for key archival
        if(CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL & pCertType->dwPrivateKeyFlag)
        {
            if(hRequest)
            {
                CryptUIWizFreeCertRequestNoDS(hRequest);
                hRequest=NULL;
            }
        }
   }

    //log all enrollments error
    //the loop will exit only if CANCEL, or SUCCEED, or we run out of CAs to try or
    //the request can not be created
    if(dwIndex == dwCA)
    {
        //we either run out of CAs to try or the request can not be created
        if(0 != idsSummary)
            pCertType->idsSummary=idsSummary;

        if(fFoundCA)
        {
            dwEventID = fRenewal ? EVENT_RENEWAL_FAIL : EVENT_ENROLL_FAIL; 
        }
        else
        {
            //if there is no CA, no need to try re-enrollment
            if(fRenewal)
                 pCertType->fRenewal=FALSE; 
           
            dwEventID = fRenewal ? EVENT_RENEWAL_NO_CA_FAIL : EVENT_ENROLL_NO_CA_FAIL;
        }

        AELogAutoEnrollmentEvent(dwLogLevel,
                                fFoundCA ? TRUE : FALSE, 
                                HRESULT_FROM_WIN32(dwLastError), 
                                dwEventID,
                                fMachine, 
                                hToken,
                                1,
                                pCertType->awszDisplay[0]);
    }

    if(hRequest)
        CryptUIWizFreeCertRequestNoDS(hRequest);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AEEnrollmentCertificates
//
//-----------------------------------------------------------------------
BOOL    AEEnrollmentCertificates(AE_GENERAL_INFO *pAE_General_Info, DWORD dwEnrollStatus)
{
    AE_CERTTYPE_INFO    *rgCertTypeInfo = NULL;
    DWORD               dwIndex =0 ;
    DWORD               dwStatus= 0;
    DWORD               dwRandom = 0;

    HCRYPTPROV          hProv = NULL;

    rgCertTypeInfo = pAE_General_Info->rgCertTypeInfo;

    if(NULL == rgCertTypeInfo)
        return FALSE;

    if((0 == pAE_General_Info->dwCA) || (NULL==pAE_General_Info->rgCAInfo))
        return FALSE;

    if(!CryptAcquireContextW(&hProv,
                NULL,
                MS_DEF_PROV_W,
                PROV_RSA_FULL,
                CRYPT_VERIFYCONTEXT))
        hProv=NULL;


    //going through all the active requests
    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        //we enroll/renew for templates that are active
        if(dwEnrollStatus != rgCertTypeInfo[dwIndex].dwStatus)
            continue;

        if(pAE_General_Info->fUIProcess != rgCertTypeInfo[dwIndex].fUIActive)
            continue;
 
        //select a random CA index to balance the load
        if((hProv) && (CryptGenRandom(hProv, sizeof(dwRandom), (BYTE *)(&dwRandom))))
        {
            rgCertTypeInfo[dwIndex].dwRandomCAIndex = dwRandom % (pAE_General_Info->dwCA);
        }
        else
            rgCertTypeInfo[dwIndex].dwRandomCAIndex = 0;

        
        //enroll
        dwStatus=0;

        //report progress
        if(pAE_General_Info->fUIProcess)
        {
            //continue if user choose CANCEL in view RA dialogue
            if(!AEUIProgressReport(FALSE, &(rgCertTypeInfo[dwIndex]),pAE_General_Info->hwndDlg, pAE_General_Info->hCancelEvent))
            {
                AEUIProgressAdvance(pAE_General_Info);
                continue;
            }

        }

        if(AEDoEnrollment(  pAE_General_Info->hwndDlg ? pAE_General_Info->hwndDlg : pAE_General_Info->hwndParent,
                            pAE_General_Info->hCancelEvent,
                            pAE_General_Info->fUIProcess,
                            pAE_General_Info->dwLogLevel,
                            pAE_General_Info->hToken,
                            pAE_General_Info->fMachine,
                            pAE_General_Info->wszMachineName,
                            &(rgCertTypeInfo[dwIndex]), 
                            pAE_General_Info->dwCA,
                            pAE_General_Info->rgCAInfo,
                            &dwStatus))
        {
            //mark the status
            if(CRYPTUI_WIZ_CERT_REQUEST_STATUS_SUCCEEDED == dwStatus)
                rgCertTypeInfo[dwIndex].dwStatus=CERT_REQUEST_STATUS_OBTAINED;
        }
        else
        {
            //if renewal failed, we try to re-enrollment if no RA is required
            if((rgCertTypeInfo[dwIndex].fRenewal) && (FALSE == (rgCertTypeInfo[dwIndex].fNeedRA)))
            {
                 rgCertTypeInfo[dwIndex].fRenewal=FALSE;  
                 dwStatus=0;

                 if(AEDoEnrollment( pAE_General_Info->hwndDlg ? pAE_General_Info->hwndDlg : pAE_General_Info->hwndParent,
                                    pAE_General_Info->hCancelEvent,
                                    pAE_General_Info->fUIProcess,
                                    pAE_General_Info->dwLogLevel,
                                    pAE_General_Info->hToken,
                                    pAE_General_Info->fMachine,
                                    pAE_General_Info->wszMachineName,
                                    &(rgCertTypeInfo[dwIndex]), 
                                    pAE_General_Info->dwCA,
                                    pAE_General_Info->rgCAInfo,
                                    &dwStatus))
                 {
                    //mark the status
                    if(CRYPTUI_WIZ_CERT_REQUEST_STATUS_SUCCEEDED == dwStatus)
                        rgCertTypeInfo[dwIndex].dwStatus=CERT_REQUEST_STATUS_OBTAINED;
                 }
            }
        }

        //advance progress
        if(pAE_General_Info->fUIProcess)
        {
            AEUIProgressAdvance(pAE_General_Info);
        }

    }

    if(hProv)
        CryptReleaseContext(hProv, 0);

    return TRUE;
}


//-----------------------------------------------------------------------
//
//  AEIsDeletableCert
//      Decide if we should archive or delete the certificate
//
//-----------------------------------------------------------------------
BOOL AEIsDeletableCert(PCCERT_CONTEXT pCertContext, AE_GENERAL_INFO *pAE_General_Info)
{
    AE_CERTTYPE_INFO    *pCertType=NULL;
    BOOL                fDelete=FALSE;

    AE_TEMPLATE_INFO    AETemplateInfo;

    memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

    //only interested in certificate with template information
    if(!AERetrieveTemplateInfo(pCertContext, &AETemplateInfo))
        goto Ret;

    pCertType=AEFindTemplateInRequestTree(&AETemplateInfo, pAE_General_Info);

    if(NULL==pCertType)
        goto Ret;

    if(CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE & (pCertType->dwEnrollmentFlag))
        fDelete=TRUE;
    else 
        fDelete=FALSE;
Ret:

    AEFreeTemplateInfo(&AETemplateInfo);

    return fDelete;
}

//-----------------------------------------------------------------------
//
//  AEArchiveObsoleteCertificates
//      archive old certificate after the enrollment/renewal
//
//      clean up the hUserDS store (delete the expired or revoked certificate)
//-----------------------------------------------------------------------
BOOL    AEArchiveObsoleteCertificates(AE_GENERAL_INFO *pAE_General_Info)
{
    AE_CERTTYPE_INFO    *rgCertTypeInfo = NULL;
    DWORD               dwIndex = 0;
    CRYPT_DATA_BLOB     Archived;
    BOOL                fArchived = FALSE;
    AE_CERT_INFO        AECertInfo;
    BOOL                fRepublish=FALSE;
	BYTE				rgbHash[SHA1_HASH_LENGTH];
	CRYPT_HASH_BLOB		blobHash;
	BOOL				fHash=FALSE;

    HCERTSTORE          hUserDS = NULL;
    PCCERT_CONTEXT      pCertContext = NULL;
    PCCERT_CONTEXT      pMyContext = NULL;
    PCCERT_CONTEXT      pDSContext = NULL;
	PCCERT_CONTEXT		pIssuedContext = NULL;

    rgCertTypeInfo = pAE_General_Info->rgCertTypeInfo;

    if(NULL == rgCertTypeInfo)
        return FALSE;

    memset(&Archived, 0, sizeof(CRYPT_DATA_BLOB));
    memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));

    //open the UserDS store
    if(!(pAE_General_Info->fMachine))
    {
    	hUserDS = AEOpenUserDSStore(pAE_General_Info, 0);
    }

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
		fHash=FALSE;
		fRepublish=FALSE;

        if(CERT_REQUEST_STATUS_OBTAINED == rgCertTypeInfo[dwIndex].dwStatus)
        {
			//get the hash of newly enrolled certificate
			blobHash.cbData=SHA1_HASH_LENGTH;
			blobHash.pbData=rgbHash;

			if(rgCertTypeInfo[dwIndex].hIssuedStore)
			{
				if(pIssuedContext = CertEnumCertificatesInStore(
									rgCertTypeInfo[dwIndex].hIssuedStore, NULL))
				{
					if(CryptHashCertificate(
						NULL,             
						0,
						X509_ASN_ENCODING,
						pIssuedContext->pbCertEncoded,
						pIssuedContext->cbCertEncoded,
						blobHash.pbData,
						&(blobHash.cbData)))
					{
						fHash=TRUE;
					}
				}

				//free the cert context
				if(pIssuedContext)
				{
                    CertFreeCertificateContext(pIssuedContext);
                    pIssuedContext = NULL;
				}
			}

            while(pCertContext = CertEnumCertificatesInStore(
                    rgCertTypeInfo[dwIndex].hArchiveStore, pCertContext))
            {
                //archive or delete the certificate from my store
                pMyContext = FindCertificateInOtherStore(
                        pAE_General_Info->hMyStore,
                        pCertContext);


                if(pMyContext)
                {
					//set the Hash of the newly enrolled certificate
					if(fHash)
					{
						CertSetCertificateContextProperty(
											pMyContext,
											CERT_RENEWAL_PROP_ID,
											0,
											&blobHash);
					}

                    if(AEIsDeletableCert(pMyContext, pAE_General_Info))
                    {
                        CertDeleteCertificateFromStore(CertDuplicateCertificateContext(pMyContext));
                    }
                    else
                    {
                        // We force an archive on the old cert and close it.
                        CertSetCertificateContextProperty(pMyContext,
                                                          CERT_ARCHIVED_PROP_ID,
                                                          0,
                                                          &Archived);

                        fArchived=TRUE;
                    }

                    CertFreeCertificateContext(pMyContext);
                    pMyContext = NULL;
                }

                //check the DS store. remove the certificates from DS store
                if(hUserDS)
                {
                    if(pMyContext = FindCertificateInOtherStore(
                            hUserDS,
                            pCertContext))
                    {
                        CertDeleteCertificateFromStore(pMyContext);
                        pMyContext = NULL;
                        fRepublish=TRUE;
                    }
                }
            }
        }
    }


    //now we are done with archiving, we clean up user DS store
   if(AUTO_ENROLLMENT_ENABLE_MY_STORE_MANAGEMENT & (pAE_General_Info->dwPolicy))
   {
    	if(hUserDS)
        {
            while(pDSContext = CertEnumCertificatesInStore(hUserDS, pDSContext))
            {
                AEValidateCertificateInfo(pAE_General_Info, 
                    NULL,                //do not evaluate soon to expire
                    FALSE,               //do not valid private key
                    pDSContext, 
                    &AECertInfo);

                if(FALSE == AECertInfo.fRenewal) 
                {
                    CertDeleteCertificateFromStore(CertDuplicateCertificateContext(pDSContext));
                    fRepublish=TRUE;
                }

                memset(&AECertInfo, 0, sizeof(AE_CERT_INFO));
            }
        }
   }

   //we have to republish the certificates as we have rewritten the user DS store
   //CA might has just published to the location
   if(fRepublish)
   {
       if(hUserDS)
       {
            for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
            {
                if(CERT_REQUEST_STATUS_OBTAINED == rgCertTypeInfo[dwIndex].dwStatus)
                {
                    if((rgCertTypeInfo[dwIndex].hIssuedStore) && 
                       (CT_FLAG_PUBLISH_TO_DS & rgCertTypeInfo[dwIndex].dwEnrollmentFlag)
                      )
                    {
                        pCertContext=NULL;
                        while(pCertContext = CertEnumCertificatesInStore(
                                rgCertTypeInfo[dwIndex].hIssuedStore, pCertContext))
                        {
                            CertAddCertificateContextToStore(hUserDS, 
                                                              pCertContext,
                                                              CERT_STORE_ADD_USE_EXISTING,
                                                              NULL);
                        }
                    }
                }
            }
       }
   }
   
   
   //report the event if archival has happened
    if(fArchived)
        AELogAutoEnrollmentEvent(pAE_General_Info->dwLogLevel, FALSE, S_OK, EVENT_ARCHIVE_CERT,                              
                 pAE_General_Info->fMachine, pAE_General_Info->hToken, 0);

    if(hUserDS)
        CertCloseStore(hUserDS, 0);

    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AERemoveSupersedeActive
//      Remove supersedeActive flag after any successful the enrollment/renewal
//
//-----------------------------------------------------------------------
BOOL    AERemoveSupersedeActive(AE_GENERAL_INFO *pAE_General_Info)
{
    AE_CERTTYPE_INFO    *rgCertTypeInfo = NULL;
    DWORD               dwIndex = 0;
    DWORD               dwActiveIndex = 0;
    DWORD               dwMarkIndex = 0;


    rgCertTypeInfo = pAE_General_Info->rgCertTypeInfo;

    if(NULL == rgCertTypeInfo)
        return FALSE;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if(CERT_REQUEST_STATUS_OBTAINED == rgCertTypeInfo[dwIndex].dwStatus)
        {
             for(dwActiveIndex=0; dwActiveIndex < rgCertTypeInfo[dwIndex].dwActive; dwActiveIndex++)
             {
                dwMarkIndex = rgCertTypeInfo[dwIndex].prgActive[dwActiveIndex];
                rgCertTypeInfo[dwMarkIndex].dwStatus=CERT_REQUEST_STATUS_OBTAINED;
             }
        }
    }


    return TRUE;
}

//-----------------------------------------------------------------------
//
//  AEEnrollmentWalker
//
//      This functin performs enrollment tasks 
//
//
//-----------------------------------------------------------------------
BOOL    AEEnrollmentWalker(AE_GENERAL_INFO *pAE_General_Info)
{

    BOOL    fResult = FALSE;

    //we need to set the range for the progress bar in the 
    //UI case
    if((pAE_General_Info->fUIProcess) && (pAE_General_Info->hwndDlg))
    {
        //set the range
        if(0 != (pAE_General_Info->dwUIEnrollCount))
        {
            SendMessage(GetDlgItem(pAE_General_Info->hwndDlg, IDC_ENROLL_PROGRESS),
                        PBM_SETRANGE,
                        0,
                        MAKELPARAM(0, ((pAE_General_Info->dwUIEnrollCount) & (0xFFFF)))
                        );


            SendMessage(GetDlgItem(pAE_General_Info->hwndDlg, IDC_ENROLL_PROGRESS),
                        PBM_SETSTEP, 
                        (WPARAM)1, 
                        0);

            SendMessage(GetDlgItem(pAE_General_Info->hwndDlg, IDC_ENROLL_PROGRESS),
                        PBM_SETPOS, 
                        (WPARAM)0, 
                        0);
        }
    }

    //retrieve the pending request.  Mark the status to obtained if the
    //certificate is issued and of the correct version
    if(AUTO_ENROLLMENT_ENABLE_PENDING_FETCH & (pAE_General_Info->dwPolicy))
    {
        if(FALSE == pAE_General_Info->fUIProcess)
        {
            if(!AEProcessPendingRequest(pAE_General_Info))
                goto Ret;
        }
        else
        {
            if(!AEProcessUIPendingRequest(pAE_General_Info))
                goto Ret;
        }
    }

    //remove duplicated requests based on "Supersede" relationship
    //supress active templates that are superseded by other templates
    if(!AEManageSupersedeRequests(pAE_General_Info))
        goto Ret; 

    //do enrollment/renewal
    if(!AEEnrollmentCertificates(pAE_General_Info, CERT_REQUEST_STATUS_ACTIVE))
        goto Ret;

    
    //We try to get the superseded templates if supserseding templates failed.
    //Only for machine for the case of two V2 DC templates.
    if(TRUE == pAE_General_Info->fMachine)
    {
        //remove supersedeActive based on the obtained flag
        if(!AERemoveSupersedeActive(pAE_General_Info))
            goto Ret;

        //do enrollment/renewal again since we migh fail to get superseding templates
        if(!AEEnrollmentCertificates(pAE_General_Info, CERT_REQUEST_STATUS_SUPERSEDE_ACTIVE))
            goto Ret;
    }

    fResult = TRUE;

Ret:

    return fResult;
}

//-----------------------------------------------------------------------------
//
// AEUIProgressAdvance
//
//      Increase the progress bar by one step
//-----------------------------------------------------------------------------
BOOL   AEUIProgressAdvance(AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL    fResult=FALSE;

    if(NULL==pAE_General_Info)
        goto Ret;

    if(NULL==(pAE_General_Info->hwndDlg))
        goto Ret;

    //check if CANCEL button is clicked
    if(AECancelled(pAE_General_Info->hCancelEvent))
    {
        fResult=TRUE;
        goto Ret;
    }

    //advance the progress bar
    SendMessage(GetDlgItem(pAE_General_Info->hwndDlg, IDC_ENROLL_PROGRESS),
        PBM_STEPIT,
        0,
        0);

    fResult=TRUE;

Ret:

    return fResult;
}

//-----------------------------------------------------------------------------
//
// AEUIGetNameFromCert
//
//      Retrieve a unique string to identify the certificate. 
//-----------------------------------------------------------------------------
BOOL    AEUIGetNameFromCert(PCCERT_CONTEXT pCertContext, LPWSTR *ppwszRACert)
{

    BOOL                fResult=FALSE;
    DWORD               dwChar=0;
    DWORD               cbOID=0;
    PCCRYPT_OID_INFO    pOIDInfo=NULL;

    LPWSTR              pwszRACert=NULL;
    AE_TEMPLATE_INFO    TemplateInfo;
    LPSTR               szOID=NULL;

    if((NULL==pCertContext) || (NULL==ppwszRACert))
        goto Ret;

    *ppwszRACert=NULL;
    
    memset(&TemplateInfo, 0, sizeof(TemplateInfo));

    //get the template name first
    if(!AERetrieveTemplateInfo(pCertContext, &TemplateInfo))
        goto Ret;
    
    if(TemplateInfo.pwszName)
    {
        pwszRACert=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (wcslen(TemplateInfo.pwszName) + 1));
        if(NULL == pwszRACert)
            goto Ret;

        wcscpy(pwszRACert, TemplateInfo.pwszName);
    }
    else
    {
        if(NULL==(TemplateInfo.pwszOid))
            goto Ret;

        //find the OID
        if(0 == (cbOID = WideCharToMultiByte(CP_ACP, 
                                  0,
                                  TemplateInfo.pwszOid,
                                  -1,
                                  NULL,
                                  0,
                                  NULL,
                                  NULL)))
            goto Ret;

        szOID=(LPSTR)LocalAlloc(LPTR, cbOID);

        if(NULL==szOID)
            goto Ret;

        if(0 == WideCharToMultiByte(CP_ACP, 
                                  0,
                                  TemplateInfo.pwszOid,
                                  -1,
                                  szOID,
                                  cbOID,
                                  NULL,
                                  NULL))
            goto Ret;
            
        pOIDInfo=CryptFindOIDInfo(
                    CRYPT_OID_INFO_OID_KEY,
                    szOID,
                    CRYPT_TEMPLATE_OID_GROUP_ID);


        if(pOIDInfo)
        {
            if(pOIDInfo->pwszName)
            {
                pwszRACert=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (wcslen(pOIDInfo->pwszName) + 1));
                if(NULL== pwszRACert)
                    goto Ret;

                wcscpy(pwszRACert, pOIDInfo->pwszName);
            }
        }

    }

    //if template name does not exist.  Get the subject name for now
  /*  if(NULL==pwszRACert)
    {
        if(0 == (dwChar=CertGetNameStringW(
                    pCertContext,
                    CERT_NAME_SIMPLE_DISPLAY_TYPE,
                    0,
                    NULL,
                    NULL,
                    0)))
            goto Ret;

        pwszRACert=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (dwChar));
        if(NULL== pwszRACert)
            goto Ret;

        if(0 == (dwChar=CertGetNameStringW(
                    pCertContext,
                    CERT_NAME_SIMPLE_DISPLAY_TYPE,
                    0,
                    NULL,
                    pwszRACert,
                    dwChar)))
            goto Ret;
    } */

    *ppwszRACert = pwszRACert;
    pwszRACert=NULL;

    fResult=TRUE;

Ret:

    if(pwszRACert)
        LocalFree(pwszRACert);

    if(szOID)
        LocalFree(szOID);

    AEFreeTemplateInfo(&TemplateInfo);


    return fResult;

}

//-----------------------------------------------------------------------------
//
//  AEGetRACertInfo
//
//-----------------------------------------------------------------------------
BOOL    AEGetRACertInfo(PCERT_CONTEXT   pRAContext,  
                        LPWSTR          pwszRATemplate,
                        LPWSTR          *ppwszRACertInfo)
{
    BOOL        fResult=FALSE;
    UINT        idsMessage=0;
    DWORD       dwSize=0;

    LPWSTR      pwszIssuer=NULL;

    if(NULL==pRAContext)
        goto Ret;

    if(pwszRATemplate)
        idsMessage=IDS_VIEW_RA_INFO;
    else
        idsMessage=IDS_VIEW_RA_INFO_GENERAL;

    //the cert has to have an issuer
    if(0 == (dwSize=CertNameToStrW(
            ENCODING_TYPE,
            &(pRAContext->pCertInfo->Issuer),
            CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
            NULL,
            0)))
        goto Ret;

    pwszIssuer=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * dwSize);
    if(NULL==pwszIssuer)
        goto Ret;

    if(0 == CertNameToStrW(
            ENCODING_TYPE,
            &(pRAContext->pCertInfo->Issuer),
            CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
            pwszIssuer,
            dwSize))
        goto Ret;


    if(!FormatMessageUnicode(
            ppwszRACertInfo, 
            idsMessage, 
            pwszIssuer,
            pwszRATemplate))
        goto Ret;

    fResult=TRUE;

Ret:

    if(pwszIssuer)
        LocalFree(pwszIssuer);

    return fResult;
}



//-----------------------------------------------------------------------------
//
//  WinProc for the view RA certificate dialogue
//
//-----------------------------------------------------------------------------
INT_PTR CALLBACK AEViewRADlgProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
{
    BOOL                            fPropertyChanged = FALSE;
    AE_VIEW_RA_INFO                 *pAEViewRAInfo = NULL;
    CRYPTUI_VIEWCERTIFICATE_STRUCT  CertViewStruct;

    LPWSTR                          pwszRACertInfo=NULL;

    switch (msg) 
    {
        case WM_INITDIALOG:
                pAEViewRAInfo=(AE_VIEW_RA_INFO *)lParam;

                if(NULL==pAEViewRAInfo)
                    break;

                SetWindowLongPtr(hwndDlg, DWLP_USER, (LONG_PTR)pAEViewRAInfo);

                //display the RA template and issuer dynamically
                if(AEGetRACertInfo(pAEViewRAInfo->pRAContext,  
                                    pAEViewRAInfo->pwszRATemplate,
                                    &pwszRACertInfo))
                {
                    SetDlgItemTextW(hwndDlg, IDC_EDIT3, pwszRACertInfo);

                    LocalFree((HLOCAL)pwszRACertInfo);

                }

                return TRUE;
            break;

         case WM_NOTIFY:
            break;

        case WM_CLOSE:
                EndDialog(hwndDlg, IDC_BUTTON3);
                return TRUE;
            break;

        case WM_COMMAND:
                switch (LOWORD(wParam))
                {
                    //view certificate
                    case IDC_BUTTON1:
                            if(NULL==(pAEViewRAInfo=(AE_VIEW_RA_INFO *)GetWindowLongPtr(hwndDlg, DWLP_USER)))
                                break; 
                            
                            if(NULL==pAEViewRAInfo->pRAContext)
                                break;

                            //show the certificate
                            memset(&CertViewStruct, 0, sizeof(CRYPTUI_VIEWCERTIFICATE_STRUCT));
                            CertViewStruct.dwSize=sizeof(CRYPTUI_VIEWCERTIFICATE_STRUCT);
                            CertViewStruct.hwndParent=hwndDlg;
                            CertViewStruct.dwFlags=CRYPTUI_DISABLE_EDITPROPERTIES;
                            CertViewStruct.pCertContext=pAEViewRAInfo->pRAContext;

                            fPropertyChanged=FALSE;

                            CryptUIDlgViewCertificate(&CertViewStruct, &fPropertyChanged);

                        return TRUE;

                    //OK
                    case IDC_BUTTON2:
                        EndDialog(hwndDlg, IDC_BUTTON2);
                        return TRUE;
                }
            break;

        default:
                return FALSE;
    }

    return FALSE;
}                             
//-----------------------------------------------------------------------------
//
// AEUIProgressReport
//
//      Report the current enrollment action.  Return FALSE if no progress status
// can be reported.
//-----------------------------------------------------------------------------
BOOL    AEUIProgressReport(BOOL fPending, AE_CERTTYPE_INFO *pCertType, HWND hwndDlg, HANDLE hCancelEvent)
{
    BOOL                fResult=FALSE;
    UINT                idsMessage=0;
    INT_PTR             ret=0;
    AE_VIEW_RA_INFO     AEViewRAInfo;

    LPWSTR              *awszFriendlyName=NULL;
    LPWSTR              pwszRACert=NULL;
    LPWSTR              pwszReport=NULL;

    memset(&AEViewRAInfo, 0, sizeof(AE_VIEW_RA_INFO));

    if((NULL==pCertType) || (NULL==hwndDlg))
        goto Ret;

    if(NULL==(pCertType->hCertType))
        goto Ret;

    if(AECancelled(hCancelEvent))
    {
        fResult=TRUE;
        goto Ret;
    }

    if(fPending)
        idsMessage=IDS_REPORT_PENDING;
    else
    {
        if((pCertType->fRenewal) && (pCertType->pOldCert))
        {
            if(pCertType->fNeedRA)
            {
                if(FALSE == (pCertType->fCrossRA))
                    idsMessage=IDS_REPORT_RENEW;
                else
                    idsMessage=IDS_REPORT_ENROLL_RA;
            }
            else
                idsMessage=IDS_REPORT_RENEW;
        }
        else
            idsMessage=IDS_REPORT_ENROLL;
    }

    //retrieve the template's friendly name
    if(S_OK != CAGetCertTypePropertyEx(
                  pCertType->hCertType, 
                  CERTTYPE_PROP_FRIENDLY_NAME,
                  &awszFriendlyName))
        goto Ret;

    if(NULL==awszFriendlyName)
        goto Ret;

    if(NULL==(awszFriendlyName[0]))
        goto Ret;


    //retrieve the RA certificate's template name
    if(IDS_REPORT_ENROLL_RA == idsMessage)
    {
        if(!AEUIGetNameFromCert(pCertType->pOldCert, &pwszRACert))
        {
            pwszRACert=NULL;
        }
    }

    if(!FormatMessageUnicode(&pwszReport, idsMessage, awszFriendlyName[0]))
        goto Ret;

    if(0 == SetDlgItemTextW(hwndDlg, IDC_EDIT2, pwszReport))
        goto Ret;

    //we will give user an opportunity to view the RA certificate before we go on
    //format the view message
    if(IDS_REPORT_ENROLL_RA != idsMessage)
    {
        //no need to do anything more
        fResult=TRUE;
        goto Ret;
    }

    AEViewRAInfo.pRAContext=pCertType->pOldCert;
    AEViewRAInfo.pwszRATemplate=pwszRACert;

    //ask user if he/she wants to view the RA certificate
    ret=DialogBoxParam(g_hmodThisDll, 
                 (LPCWSTR)MAKEINTRESOURCE(IDD_VIEW_RA_CERTIFICATE_DLG),
                 hwndDlg, 
                 AEViewRADlgProc,
                 (LPARAM)(&AEViewRAInfo));

    fResult=TRUE;

Ret:

    if(pwszRACert)
        LocalFree(pwszRACert);

    if(awszFriendlyName)
        CAFreeCertTypeProperty(pCertType->hCertType, awszFriendlyName);

    if(pwszReport)
        LocalFree((HLOCAL) pwszReport);
    
    return fResult;
}



//-----------------------------------------------------------------------------
//
//  the call back function to compare summary column
//
//-----------------------------------------------------------------------------
int CALLBACK CompareSummary(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort)
{
    AE_CERTTYPE_INFO    *pCertTypeOne=NULL;
    AE_CERTTYPE_INFO    *pCertTypeTwo=NULL;
    DWORD               dwColumn=0;
    int                 iCompare=0;
    
    LPWSTR              pwszOne=NULL;
    LPWSTR              pwszTwo=NULL;

    pCertTypeOne=(AE_CERTTYPE_INFO *)lParam1;
    pCertTypeTwo=(AE_CERTTYPE_INFO *)lParam2;

    dwColumn=(DWORD)lParamSort;

    if((NULL==pCertTypeOne) || (NULL==pCertTypeTwo))
        goto Ret;

    switch(dwColumn & 0x0000FFFF)
    {
       case AE_SUMMARY_COLUMN_TYPE:
	            //we should use wcsicoll instead of wcsicmp since wcsicoll use the
	            //lexicographic order of current code page.
	            iCompare=CompareStringW(LOCALE_USER_DEFAULT,
						            NORM_IGNORECASE,
						            pCertTypeOne->awszDisplay[0],
						            -1,
						            pCertTypeTwo->awszDisplay[0],
						            -1);
            break;

       case AE_SUMMARY_COLUMN_REASON:
                pwszOne=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (MAX_DN_SIZE));
                pwszTwo=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (MAX_DN_SIZE));

                if((NULL==pwszOne) || (NULL==pwszTwo))
                    goto Ret;


                if(0 == LoadStringW(g_hmodThisDll, 
                                pCertTypeOne->idsSummary, 
                                pwszOne, 
                                MAX_DN_SIZE))
                    goto Ret;


                if(0 == LoadStringW(g_hmodThisDll, 
                                pCertTypeTwo->idsSummary, 
                                pwszTwo, 
                                MAX_DN_SIZE))
                    goto Ret;

	            //we should use wcsicoll instead of wcsicmp since wcsicoll use the
	            //lexicographic order of current code page.
	            iCompare=CompareStringW(LOCALE_USER_DEFAULT,
						            NORM_IGNORECASE,
						            pwszOne,
						            -1,
						            pwszTwo,
						            -1);
           
            
           break;
       default:
                goto Ret;
            break;
    }

    switch(iCompare)
    {
        case CSTR_LESS_THAN:

                iCompare=-1;
            break;
            
        case CSTR_EQUAL:

                iCompare=0;
            break;

        case CSTR_GREATER_THAN:

                iCompare=1;
            break;

        default:
                goto Ret;
            break;
    }

    if(dwColumn & SORT_COLUMN_DESCEND)
        iCompare = 0-iCompare;

Ret:

    if(pwszOne)
        LocalFree(pwszOne);

    if(pwszTwo)
        LocalFree(pwszTwo);

    return iCompare;
}


//-----------------------------------------------------------------------------
//
//  AEDisplaySummaryInfo
//
//-----------------------------------------------------------------------------
BOOL    AEDisplaySummaryInfo(HWND hWndListView, AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL                fResult=FALSE;
    AE_CERTTYPE_INFO    *rgCertTypeInfo = NULL;
    DWORD               dwIndex =0;
    DWORD               dwItem=0;
    LV_ITEMW            lvItem;   
    WCHAR               wszReason[MAX_DN_SIZE];
    AE_CERTTYPE_INFO    *pCertType=NULL;

    if((NULL==hWndListView) || (NULL==pAE_General_Info))
        goto Ret;

    rgCertTypeInfo = pAE_General_Info->rgCertTypeInfo;

    if(NULL == rgCertTypeInfo)
        goto Ret;

     // set up the fields in the list view item struct that don't change from item to item
    lvItem.mask = LVIF_TEXT | LVIF_PARAM;
    lvItem.state = 0;
    lvItem.stateMask = 0;
    lvItem.iItem=0;
    lvItem.iSubItem=0;
    lvItem.iImage = 0;
    lvItem.lParam = NULL;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if((TRUE == rgCertTypeInfo[dwIndex].fUIActive) && (0 != rgCertTypeInfo[dwIndex].idsSummary))
        {
            if(0 != LoadStringW(g_hmodThisDll, 
                                rgCertTypeInfo[dwIndex].idsSummary, 
                                wszReason, 
                                MAX_DN_SIZE))
            {
                lvItem.iItem=dwItem;
                lvItem.iSubItem=0;
                dwItem++;

                pCertType=&(rgCertTypeInfo[dwIndex]);

                lvItem.lParam = (LPARAM)(pCertType);

                //template name
                lvItem.pszText=rgCertTypeInfo[dwIndex].awszDisplay[0];

                ListView_InsertItem(hWndListView, &lvItem);

                //reason
                lvItem.iSubItem++;

                ListView_SetItemText(hWndListView, lvItem.iItem, lvItem.iSubItem, wszReason);
            }
        }
    }

    fResult=TRUE;

Ret:

    return fResult;
}

//-----------------------------------------------------------------------------
//
//  WinProc for the summary page
//
//-----------------------------------------------------------------------------
INT_PTR CALLBACK AESummaryDlgProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
{

    AE_GENERAL_INFO             *pAE_General_Info=NULL;
    HWND                        hWndListView=NULL;
    UINT                        rgIDS[]={IDS_COLUMN_TYPE,
                                        IDS_COLUMN_REASON};
    DWORD                       dwIndex=0;
    DWORD                       dwCount=0;
    LV_COLUMNW                  lvC;
    WCHAR                       wszText[AE_SUMMARY_COLUMN_SIZE];
    NM_LISTVIEW                 *pnmv=NULL;
    DWORD                       dwSortParam=0;
    static DWORD                rgdwSortParam[]=
                                    {AE_SUMMARY_COLUMN_TYPE | SORT_COLUMN_ASCEND,
                                    AE_SUMMARY_COLUMN_REASON | SORT_COLUMN_DESCEND};

    switch (msg) 
    {
        case WM_INITDIALOG:
                pAE_General_Info=(AE_GENERAL_INFO *)lParam;

                if(NULL==pAE_General_Info)
                    break;

                SetWindowLongPtr(hwndDlg, DWLP_USER, (LONG_PTR)pAE_General_Info);

                //init the list view control
                //add the colums to the list view
                hWndListView = GetDlgItem(hwndDlg, IDC_LIST2);

                if(NULL==hWndListView)
                    break;

                dwCount=sizeof(rgIDS)/sizeof(rgIDS[0]);

                //set up the common info for the column
                memset(&lvC, 0, sizeof(LV_COLUMNW));

                lvC.mask = LVCF_FMT | LVCF_WIDTH | LVCF_TEXT | LVCF_SUBITEM;
                lvC.fmt = LVCFMT_LEFT;      // Left-align the column.
                lvC.cx = 150;                // Width of the column, in pixels.
                lvC.iSubItem=0;
                lvC.pszText = wszText;      // The text for the column.

                //insert the column one at a time
                for(dwIndex=0; dwIndex < dwCount; dwIndex++)
                {
                    //get the column header
                    wszText[0]=L'\0';

                    if(0 != LoadStringW(g_hmodThisDll, rgIDS[dwIndex], wszText, AE_SUMMARY_COLUMN_SIZE))
                    {
                        ListView_InsertColumn(hWndListView, dwIndex, &lvC);
                    }
                }

                // set the style in the list view so that it highlights an entire line
                SendMessage(hWndListView, LVM_SETEXTENDEDLISTVIEWSTYLE, 0, LVS_EX_FULLROWSELECT);

                AEDisplaySummaryInfo(hWndListView, pAE_General_Info);

                //autosize the columns
                for(dwIndex=0; dwIndex < dwCount; dwIndex++)
                {
                    ListView_SetColumnWidth(hWndListView, dwIndex, LVSCW_AUTOSIZE);
                }

                //sort 1st column of the list view
                dwSortParam=rgdwSortParam[0];

                SendDlgItemMessage(hwndDlg,
                    IDC_LIST2,
                    LVM_SORTITEMS,
                    (WPARAM) (LPARAM) dwSortParam,
                    (LPARAM) (PFNLVCOMPARE)CompareSummary);

                return TRUE;
            break;

         case WM_NOTIFY:
                switch (((NMHDR FAR *) lParam)->code)
                {
                    //the column has been changed
                    case LVN_COLUMNCLICK:

                            pnmv = (NM_LISTVIEW *) lParam;

                            dwSortParam=0;

                            //get the column number
                            switch(pnmv->iSubItem)
                            {
                                case 0:
                                case 1:
                                        dwSortParam=rgdwSortParam[pnmv->iSubItem];
                                    break;
                                default:
                                        dwSortParam=0;
                                    break;
                            }

                            if(0!=dwSortParam)
                            {
                                //remember to flip the ascend ording
                                if(dwSortParam & SORT_COLUMN_ASCEND)
                                {
                                    dwSortParam &= 0x0000FFFF;
                                    dwSortParam |= SORT_COLUMN_DESCEND;
                                }
                                else
                                {
                                    if(dwSortParam & SORT_COLUMN_DESCEND)
                                    {
                                        dwSortParam &= 0x0000FFFF;
                                        dwSortParam |= SORT_COLUMN_ASCEND;
                                    }
                                }

                                //sort the column
                                SendDlgItemMessage(hwndDlg,
                                    IDC_LIST2,
                                    LVM_SORTITEMS,
                                    (WPARAM) (LPARAM) dwSortParam,
                                    (LPARAM) (PFNLVCOMPARE)CompareSummary);

                                rgdwSortParam[pnmv->iSubItem]=dwSortParam;
                            }

                        break;
                }
            break;

        case WM_CLOSE:
                EndDialog(hwndDlg, IDC_BUTTON1);
                return TRUE;
            break;

        case WM_COMMAND:
                switch (LOWORD(wParam))
                {
                    case IDC_BUTTON1:
                        EndDialog(hwndDlg, IDC_BUTTON1);
                        return TRUE;
                }
            break;

        default:
                return FALSE;
    }

    return FALSE;
}                             


//-----------------------------------------------------------------------------
//
//  AEDisplaySummaryPage
//         
//-----------------------------------------------------------------------------
BOOL    AEDisplaySummaryPage(AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL                fResult=FALSE;
    DWORD               dwIndex=0;
    BOOL                fSummary=FALSE;
    AE_CERTTYPE_INFO    *rgCertTypeInfo=NULL;
    AE_CERTTYPE_INFO    *pCertType=NULL;

    //decide if there is need to show the summary page.  
    //Checking for idsSummary for each template
    if(NULL == pAE_General_Info)
        goto Ret;

    if(NULL == (rgCertTypeInfo=pAE_General_Info->rgCertTypeInfo))
        goto Ret;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if((TRUE == rgCertTypeInfo[dwIndex].fUIActive) && (0 != rgCertTypeInfo[dwIndex].idsSummary))
        {
            fSummary=TRUE;
            break;
        }
    }

    //show the summary dialogue
    if(TRUE == fSummary)
    {
        if(pAE_General_Info->hwndDlg)
        {
            DialogBoxParam(g_hmodThisDll, 
                     (LPCWSTR)MAKEINTRESOURCE(IDD_USER_SUMMARY_DLG),
                     pAE_General_Info->hwndDlg, 
                     AESummaryDlgProc,
                     (LPARAM)(pAE_General_Info));
        }
    }

    fResult=TRUE;

Ret:
    return fResult;
}



//-----------------------------------------------------------------------------
//  WinProc for the autoenrollment progress window
//
//-----------------------------------------------------------------------------
INT_PTR CALLBACK progressDlgProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
{
    AE_GENERAL_INFO         *pAE_General_Info = NULL;

    switch (msg) 
    {
        case WM_INITDIALOG:
                pAE_General_Info=(AE_GENERAL_INFO *)lParam;

                //copy the hwndDlg to the enrollment thread
                pAE_General_Info->hwndDlg=hwndDlg;

                //start the interacive enrollment thread
                if(1 != ResumeThread(pAE_General_Info->hThread))
                {   
                    pAE_General_Info->hwndDlg=NULL;

                    //we have to end the dialogue
                    EndDialog(hwndDlg, IDC_BUTTON1);
                    return TRUE;
                }

                SetWindowLongPtr(hwndDlg, DWLP_USER, (LONG_PTR)pAE_General_Info);

                return TRUE;
            break;

        case WM_NOTIFY:
            break;

        case WM_CLOSE:

                if(NULL==(pAE_General_Info=(AE_GENERAL_INFO *)GetWindowLongPtr(hwndDlg, DWLP_USER)))
                    break;

                //disable the cancel button
                EnableWindow(GetDlgItem(hwndDlg,IDC_BUTTON1), FALSE);

                //signal the cancel event
                if(pAE_General_Info->hCancelEvent)
                    SetEvent(pAE_General_Info->hCancelEvent);

                //close the dialogue if the enrollment work is completed
                if(WAIT_OBJECT_0 == WaitForSingleObject(pAE_General_Info->hCompleteEvent, 0))
                {
                    EndDialog(hwndDlg, IDC_BUTTON1);
                }
               
                return TRUE;

            break;

        case WM_COMMAND:
                switch (LOWORD(wParam))
                {
                    case IDC_BUTTON1:
                            if(NULL==(pAE_General_Info=(AE_GENERAL_INFO *)GetWindowLongPtr(hwndDlg, DWLP_USER)))
                                break;

                            //disable the cancel button
                            EnableWindow(GetDlgItem(hwndDlg,IDC_BUTTON1), FALSE);

                            //signal the cancel event
                            if(pAE_General_Info->hCancelEvent)
                                SetEvent(pAE_General_Info->hCancelEvent);


                        return TRUE;
                }
            break;

        default:
                return FALSE;
    }

    return FALSE;
}                             


//-----------------------------------------------------------------------------
//  AEInteractiveThreadProc
//
//      The thread procedue to do interactive enrollment
//-----------------------------------------------------------------------------
DWORD WINAPI AEInteractiveThreadProc(LPVOID lpParameter)
{
    BOOL                    fResult=FALSE;
    AE_GENERAL_INFO         *pAE_General_Info = NULL;

    if(NULL==lpParameter)
        return FALSE;

    __try
    {

        pAE_General_Info=(AE_GENERAL_INFO *)lpParameter;

        pAE_General_Info->fUIProcess=TRUE;
    
        fResult = AEEnrollmentWalker(pAE_General_Info);

        //show the summary page if not canceled
        if(!AECancelled(pAE_General_Info->hCancelEvent))
        {
            AEDisplaySummaryPage(pAE_General_Info);
        }

        //signal that the process is completed
        SetEvent(pAE_General_Info->hCompleteEvent);
        
        //signal the progress window that we are done
        if(pAE_General_Info->hwndDlg)
        {
                //click the close button
                SendMessage(pAE_General_Info->hwndDlg,
                            WM_CLOSE, //WM_COMMAND,
                            0, //IDC_BUTTON1,
                            NULL);
        }
    }
    __except ( EXCEPTION_EXECUTE_HANDLER )
    {
    }
    
    return fResult;
}


//-----------------------------------------------------------------------------
//  AEInteractiveEnrollment
//
//      We are doing interactive enrollment
//-----------------------------------------------------------------------------
BOOL    AEInteractiveEnrollment(AE_GENERAL_INFO *pAE_General_Info)
{
    DWORD                       dwThreadID=0;
    BOOL                        fResult=FALSE;
    

    //create a notification event for cancel process
    pAE_General_Info->hCancelEvent=CreateEvent(
                    NULL,
                    TRUE,      // bmanual reset type           
                    FALSE,     // initial state
                    NULL);

    if(NULL==(pAE_General_Info->hCancelEvent))
        goto ret;

    //create a notification event for complete process
    pAE_General_Info->hCompleteEvent=CreateEvent(
                    NULL,
                    TRUE,      // bmanual reset type           
                    FALSE,     // initial state
                    NULL);

    if(NULL==(pAE_General_Info->hCompleteEvent))
        goto ret;

    //spawn a thread
    pAE_General_Info->hThread = CreateThread(NULL,
                            0,
                            AEInteractiveThreadProc,
                            pAE_General_Info,
                            CREATE_SUSPENDED,   //suspend execution
                            &dwThreadID);
    
    if(NULL==(pAE_General_Info->hThread))
        goto ret;

    //create the dialogue
    DialogBoxParam(
            g_hmodThisDll,
            MAKEINTRESOURCE(IDD_USER_AUTOENROLL_GENERAL_DLG),
            pAE_General_Info->hwndParent,      
            progressDlgProc,
            (LPARAM)(pAE_General_Info));

    //wait for thread to finish
    if(WAIT_FAILED == WaitForSingleObject(pAE_General_Info->hThread, INFINITE))
        goto ret;

    fResult=TRUE;

ret:

    //log the event
    if(!fResult)
    {
         AELogAutoEnrollmentEvent(
            pAE_General_Info->dwLogLevel,
            TRUE, 
            HRESULT_FROM_WIN32(GetLastError()), 
            EVENT_FAIL_INTERACTIVE_START, 
            pAE_General_Info->fMachine, 
            pAE_General_Info->hToken, 
            0);
    }


    return fResult;
}

//-----------------------------------------------------------------------------
//
//  WinProc for the confirmation to start certificate autoenrollment
//
//-----------------------------------------------------------------------------
INT_PTR CALLBACK AEConfirmDlgProc(HWND hwndDlg, UINT msg, WPARAM wParam, LPARAM lParam)
{
    switch (msg) 
    {
        case WM_INITDIALOG:

                return TRUE;
            break;

        case WM_NOTIFY:
            break;

        case WM_CLOSE:
                EndDialog(hwndDlg, IDC_BUTTON2);
                return TRUE;
            break;

        case WM_COMMAND:
                switch (LOWORD(wParam))
                {
                    case IDC_BUTTON1:
                        EndDialog(hwndDlg, IDC_BUTTON1);
                        return TRUE;

                    case IDC_BUTTON2:
                        EndDialog(hwndDlg, IDC_BUTTON2);
                        return TRUE;
                }
            break;

        default:
                return FALSE;
    }

    return FALSE;
}                             

//-----------------------------------------------------------------------
//
//  AERegisterSysTrayApp 
//
//      This functin registers autoenrollment in the sys tray area
//  as an notification
//
//
//-----------------------------------------------------------------------
BOOL AERegisterSysTrayApp(HWND hwndParent)
{
    BOOL                        fResult=FALSE;
    BOOL                        fInit=FALSE;
    INT_PTR                     ret=0;
    DWORD                       dwError=0;

    CQueryContinue              *pCQueryContinue=NULL;


    if(FAILED(CoInitialize(NULL)))
	    goto Ret;

    fInit=TRUE;

    pCQueryContinue=new CQueryContinue();

    if(NULL==pCQueryContinue)
        goto Ret;

    if(S_OK != pCQueryContinue->DoBalloon())
        goto Ret;  

    //ask user if autoenrollment should be performed
    ret=DialogBox(g_hmodThisDll, 
                 (LPCWSTR)MAKEINTRESOURCE(IDD_USER_AUTOENROLL_INFO_DLG),
                 hwndParent, 
                 AEConfirmDlgProc);

    if(IDC_BUTTON1 != ret)
    {
        dwError=GetLastError();
        goto Ret;
    }
    
    fResult=TRUE;


Ret:

    if(pCQueryContinue)
    {
        delete pCQueryContinue;
    }

    if(fInit)
        CoUninitialize();

    return fResult;

}


//-----------------------------------------------------------------------
//
//  AEUIDisabled
//
//      Detect if the user notification balloon is disabled by user 
//  setting the autoenrollment registry key in current user
//
//
//-----------------------------------------------------------------------
BOOL    AEUIDisabled()
{
    BOOL    fResult=FALSE;
    
    HKEY    hKey=NULL;

    if(ERROR_SUCCESS == RegOpenKeyEx(
                HKEY_CURRENT_USER,                  // handle to open key
                AUTO_ENROLLMENT_DISABLE_KEY,        // subkey name
                0,                                  // reserved
                KEY_READ,                           // security access mask
                &hKey))                             // handle to open key
    {
        fResult=TRUE;
    }

    if(hKey)
        RegCloseKey(hKey);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AEUIRequired
//
//      Detect if the user notification balloon is needed
//
//
//-----------------------------------------------------------------------
BOOL    AEUIRequired(AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL                fUI=FALSE;
    AE_CERTTYPE_INFO    *rgCertTypeInfo = NULL;
    DWORD               dwIndex = 0;

    if(NULL==pAE_General_Info)
        return FALSE;

    rgCertTypeInfo = pAE_General_Info->rgCertTypeInfo;

    pAE_General_Info->dwUIEnrollCount=0;

    if(NULL == rgCertTypeInfo)
        return FALSE;

    for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
    {
        if(rgCertTypeInfo[dwIndex].fUIActive)
        {
            if(CERT_REQUEST_STATUS_ACTIVE == rgCertTypeInfo[dwIndex].dwStatus)
            {
                fUI=TRUE;
                (pAE_General_Info->dwUIEnrollCount)++;
            }
        }
    }

    //add the pending count
    if(pAE_General_Info->dwUIPendCount)
    {
        fUI=TRUE;
        (pAE_General_Info->dwUIEnrollCount) +=(pAE_General_Info->dwUIPendCount); 
    }

    return fUI;  
}

                
//-----------------------------------------------------------------------
//
//  AEProcessEnrollment
//
//      This functin does the autoenrollment based on ACL and manage MY
//  store.
//
//
//-----------------------------------------------------------------------
BOOL  AEProcessEnrollment(HWND hwndParent, BOOL fMachine,   LDAP *pld, DWORD dwPolicy, DWORD dwLogLevel)
{
    BOOL                fResult=FALSE;

    AE_GENERAL_INFO     *pAE_General_Info=NULL;

    pAE_General_Info=(AE_GENERAL_INFO *)LocalAlloc(LPTR, sizeof(AE_GENERAL_INFO));

    if(NULL==pAE_General_Info)
        goto Ret;

    memset(pAE_General_Info, 0, sizeof(AE_GENERAL_INFO));

    if(NULL==pld)
        goto Ret;

    //we obtain all information needed for process enrollment
    pAE_General_Info->hwndParent = hwndParent;
    pAE_General_Info->pld = pld;
    pAE_General_Info->fMachine = fMachine;
    pAE_General_Info->dwPolicy = dwPolicy;
    pAE_General_Info->dwLogLevel = dwLogLevel;

    __try
    {

        if(!AERetrieveGeneralInfo(pAE_General_Info))
        {
            AELogAutoEnrollmentEvent(dwLogLevel,
                                TRUE, 
                                HRESULT_FROM_WIN32(GetLastError()), 
                                EVENT_FAIL_GENERAL_INFOMATION, 
                                fMachine, 
                                pAE_General_Info->hToken,
                                0);
            goto Ret;
        }

        if((0 == pAE_General_Info->dwCertType) || (NULL==pAE_General_Info->rgCertTypeInfo))
        {
            AELogAutoEnrollmentEvent(dwLogLevel, FALSE, S_OK, 
                EVENT_NO_CERT_TEMPLATE, fMachine, pAE_General_Info->hToken,0);

            AE_DEBUG((AE_WARNING, L"No CertType's available for auto-enrollment\n\r"));
            goto Ret;
        }

        //we build the auto-enrollment requests based on the ACL on the DS
        if(AUTO_ENROLLMENT_ENABLE_TEMPLATE_CHECK & (pAE_General_Info->dwPolicy))
        {
            if(!AEMarkAutoenrollment(pAE_General_Info))
                goto Ret;
        }

        //we build the auto-enrollment requests based on the ARCS store
        //this is enabled by default and can only be disabled if autoenrollment is 
        //completely disabled
        if(!AEMarkAEObject(pAE_General_Info))
            goto Ret;

        //manage MY store.  Check if we already have required certificates
        //we should always check my store with different behavior based on
        //AUTO_ENROLLMENT_ENABLE_MY_STORE_MANAGEMENT flag
        if(!AEManageAndMarkMyStore(pAE_General_Info))
                goto Ret;

        //manage UserDS store for user autoenrollment 
        if(!fMachine)
        {
            if(!AECheckUserDSStore(pAE_General_Info))
                goto Ret;
        }

        //manage pending request store.  Remove expired pending requests 
        if(AUTO_ENROLLMENT_ENABLE_PENDING_FETCH & (pAE_General_Info->dwPolicy))
        {
            if(!AECheckPendingRequests(pAE_General_Info))
                goto Ret;
        }

        //get CA information
        if(!AERetrieveCAInfo(pAE_General_Info->pld,
                             pAE_General_Info->fMachine,
                             pAE_General_Info->hToken,
                             &(pAE_General_Info->dwCA), 
                             &(pAE_General_Info->rgCAInfo)))
        {

            AELogAutoEnrollmentEvent(dwLogLevel, TRUE, HRESULT_FROM_WIN32(GetLastError()), 
                EVENT_FAIL_CA_INFORMATION, fMachine, pAE_General_Info->hToken, 0);


            AE_DEBUG((AE_ERROR, L"Unable to retrieve CA information (%lx)\n\r", GetLastError()));

            goto Ret;
        }

        if((0 == pAE_General_Info->dwCA) || (NULL==pAE_General_Info->rgCAInfo))
        {
            //we do not have any CAs on the domain.  All we need to do is to archive

            //archive old certificate after the enrollment/renewal
            AEArchiveObsoleteCertificates(pAE_General_Info);

            AELogAutoEnrollmentEvent(dwLogLevel, FALSE, S_OK, 
                EVENT_NO_CA, fMachine, pAE_General_Info->hToken, 0);

            AE_DEBUG((AE_WARNING, L"No CA's available for auto-enrollment\n\r"));

            goto Ret;
        }

        //we check if active templates do have a CA that we can enroll for
        if(!AEManageActiveTemplates(pAE_General_Info))
            goto Ret;

        //perform autoenrollment as the background 
        pAE_General_Info->fUIProcess=FALSE;
        if(!AEEnrollmentWalker(pAE_General_Info))
            goto Ret;

        //perform autoenrollment as a sys tray application for user only
        if(FALSE == fMachine)
        {
            //test if the notification balloon is disabled
            if(!AEUIDisabled())
            {
                //test if the notification balloon is needed
                if(AEUIRequired(pAE_General_Info))
                {
                    //register the sys tray application
                    if(AERegisterSysTrayApp(pAE_General_Info->hwndParent))
                    {
                        //perform autoenrollment in interactive mode
                        AEInteractiveEnrollment(pAE_General_Info);
                    }
                }
            }
        }

        //archive old certificate after the enrollment/renewal
        if(!AEArchiveObsoleteCertificates(pAE_General_Info))
            goto Ret;

    }
    __except ( EXCEPTION_EXECUTE_HANDLER )
    {
        goto Ret;
    }

    fResult=TRUE;

Ret:

    //free memory only if no thread is created
    if(pAE_General_Info)
    {
        AEFreeGeneralInfo(pAE_General_Info);
        LocalFree(pAE_General_Info);
    }

    return fResult;
    
}

//-----------------------------------------------------------------------
//
//  AEExpress
//
//      Detect if the user autoenrollment has the express key set.  If the 
//  Express key is set, user autoenrollment will not wait for machine 
//  autoenrollment to complete on root certificates download
//
//
//-----------------------------------------------------------------------
BOOL    AEExpress()
{
    BOOL    fResult=FALSE;
    
    HKEY    hKey=NULL;

    if(ERROR_SUCCESS == RegOpenKeyEx(
                HKEY_CURRENT_USER,                  // handle to open key
                AUTO_ENROLLMENT_EXPRESS_KEY,        // subkey name
                0,                                  // reserved
                KEY_READ,                           // security access mask
                &hKey))                             // handle to open key
    {
        fResult=TRUE;
    }

    if(hKey)
        RegCloseKey(hKey);

    return fResult;
}

//-----------------------------------------------------------------------
//
//  AEMainThreadProc
//
//      The background thread for non-blocking autoenrollment background
//  processing.
//
//-----------------------------------------------------------------------
DWORD WINAPI AEMainThreadProc(LPVOID lpParameter)
{
    HRESULT         hr=S_OK;
    BOOL            fMachine=FALSE;
    DWORD           dwPolicy=0;
    DWORD           dwLogLevel=STATUS_SEVERITY_ERROR;
    HWND            hwndParent=0;
    DWORD           dwStatus=0;
    LARGE_INTEGER   ftPreTimeStamp;
    LARGE_INTEGER   ftPostTimeStamp;
    BOOL            fNeedToSetupTimer=FALSE;

    LDAP            *pld = NULL;
    LPWSTR          pwszDCName=NULL;

    //get the system time stamp
    GetSystemTimeAsFileTime((LPFILETIME)&ftPreTimeStamp);

    //the two input parameters are not yet used
    if(NULL==lpParameter)
        goto CommonReturn;

    hwndParent = ((AE_MAIN_THREAD_INFO *)lpParameter)->hwndParent;
    dwStatus = ((AE_MAIN_THREAD_INFO *)lpParameter)->dwStatus;

    AE_DEBUG((AE_INFO, L"Beginning CertAutoEnrollment(%s).\n", (CERT_AUTO_ENROLLMENT_START_UP==dwStatus?L"START_UP":L"WAKE_UP")));

    //no autoenrollment in the safe boot mode
    //no autoenrollment if we are not in a domain
    if(AEInSafeBoot() || !AEIsDomainMember())
        goto CommonReturn;

    //we need to set up the timer
    fNeedToSetupTimer=TRUE;

    //detect if we are running under user or machine context
    if(!AEIsLocalSystem(&fMachine))
        goto CommonReturn;
    AE_DEBUG((AE_INFO, L"CertAutoEnrollment running as %s.\n", (fMachine?L"machine":L"user")));

    AESetWakeUpFlag(fMachine, TRUE);   
    
    //we wait for 70 seconds for user case to give enough time for 
    //machine autoenrollment to complete, which will download certificates
    //from the directory
    if(!fMachine)
    {
        if(!AEExpress())
        {
            Sleep(USER_AUTOENROLL_DELAY_FOR_MACHINE * 1000);
        }
    }

   //get the autoenrollment log level
    if(!AERetrieveLogLevel(fMachine, &dwLogLevel))
        goto CommonReturn;

    //log the autoenrollment start event
    AELogAutoEnrollmentEvent(dwLogLevel, FALSE, S_OK, EVENT_AUTOENROLL_START, fMachine, NULL, 0);

   //get the autoenrollment policy flag
    if(!AEGetPolicyFlag(fMachine, &dwPolicy))
        goto CommonReturn;

    //no need to do anything if autoenrollment is completely disabled
    if(AUTO_ENROLLMENT_DISABLE_ALL & dwPolicy)
        goto CommonReturn;


    //download NTAuth And Enterprise root store for machine 
    if(fMachine)
    {    
        //bind to the DS
        if(S_OK != (hr=AERobustLdapBind(&pld, &pwszDCName)))
        {
            SetLastError(hr);
            AELogAutoEnrollmentEvent(dwLogLevel, TRUE, hr, EVENT_FAIL_BIND_TO_DS, fMachine, NULL, 0);
            goto CommonReturn;
        }

        AEDownloadStore(pld, pwszDCName);
    }

    //if we are required to do a WIN2K style autoenrollment, and the machine/user's
    //ACRS store is empty, just return as we done.
    if(0 == dwPolicy)
    {
        if(IsACRSStoreEmpty(fMachine))
            goto CommonReturn;
    }

    if(NULL==pld)
    {
        //bind to the DS
        if(S_OK != (hr=AERobustLdapBind(&pld, NULL)))
        {
            SetLastError(hr);
            AELogAutoEnrollmentEvent(dwLogLevel, TRUE, hr, EVENT_FAIL_BIND_TO_DS, fMachine, NULL, 0);
            goto CommonReturn;
        }
    }

    AEProcessEnrollment(hwndParent, fMachine, pld, dwPolicy, dwLogLevel);

CommonReturn:

    //get the system time
    GetSystemTimeAsFileTime((LPFILETIME)&ftPostTimeStamp);

    //set up the timer for next time
    if(TRUE == fNeedToSetupTimer)
    {
        // we will need to do this again in a few hours.
        AESetWakeUpTimer(fMachine, &ftPreTimeStamp, &ftPostTimeStamp);
    }

    if(pld)
        ldap_unbind(pld);

    if(pwszDCName)
        LocalFree(pwszDCName);

    if(lpParameter)
        LocalFree((HLOCAL)lpParameter);

    AELogAutoEnrollmentEvent(dwLogLevel, FALSE, S_OK, EVENT_AUTOENROLL_COMPLETE, fMachine, NULL, 0);

    return TRUE;
}

//--------------------------------------------------------------------------
//
//  CertAutoEnrollment
//
//      Function to perform autoenrollment actions.  It creates a working
//      thread and return immediately so that it is non-blocking.
//     
//      Parameters:
//          IN  hwndParent:     The parent window 
//          IN  dwStatus:       The status under which the function is called.  
//                              It can be one of the following:
//                              CERT_AUTO_ENROLLMENT_START_UP
//                              CERT_AUTO_ENROLLMENT_WAKE_UP
//
//--------------------------------------------------------------------------
HANDLE 
WINAPI
CertAutoEnrollment(IN HWND     hwndParent,
                   IN DWORD    dwStatus)
{
    DWORD                       dwThreadID=0;
                                //memory will be freed in the main thread
    AE_MAIN_THREAD_INFO         *pAE_Main_Thread_Info=NULL;     
        
    HANDLE                      hThread=NULL;

    pAE_Main_Thread_Info=(AE_MAIN_THREAD_INFO *)LocalAlloc(LPTR, sizeof(AE_MAIN_THREAD_INFO));
    if(NULL==pAE_Main_Thread_Info)
        return NULL;

    memset(pAE_Main_Thread_Info, 0, sizeof(AE_MAIN_THREAD_INFO));
    pAE_Main_Thread_Info->hwndParent=hwndParent;
    pAE_Main_Thread_Info->dwStatus=dwStatus;

    hThread = CreateThread(NULL,
                            0,
                            AEMainThreadProc,
                            pAE_Main_Thread_Info,
                            0,          //execute immediately
                            &dwThreadID);  

    //set the thread priority to low so that we will not compete with the shell
    SetThreadPriority(hThread,  THREAD_PRIORITY_BELOW_NORMAL);

    return hThread;
}

//--------------------------------------------------------------------
//
//  AERetrieveClientToken
//
//--------------------------------------------------------------------
BOOL    AERetrieveClientToken(HANDLE  *phToken)
{
    HRESULT         hr = S_OK;

    HANDLE          hHandle = NULL;
    HANDLE          hClientToken = NULL;

    hHandle = GetCurrentThread();
    if (NULL == hHandle)
    {
        hr = HRESULT_FROM_WIN32(GetLastError());
    }
    else
    {

        if (!OpenThreadToken(hHandle,
                             TOKEN_QUERY,
                             TRUE,  // open as self
                             &hClientToken))
        {
            hr = HRESULT_FROM_WIN32(GetLastError());
            CloseHandle(hHandle);
            hHandle = NULL;
        }
    }

    if(hr != S_OK)
    {
        hHandle = GetCurrentProcess();
        if (NULL == hHandle)
        {
            hr = HRESULT_FROM_WIN32(GetLastError());
        }
        else
        {
            HANDLE hProcessToken = NULL;
            hr = S_OK;


            if (!OpenProcessToken(hHandle,
                                 TOKEN_DUPLICATE,
                                 &hProcessToken))
            {
                hr = HRESULT_FROM_WIN32(GetLastError());
                CloseHandle(hHandle);
                hHandle = NULL;
            }
            else
            {
                if(!DuplicateToken(hProcessToken,
                               SecurityImpersonation,
                               &hClientToken))
                {
                    hr = HRESULT_FROM_WIN32(GetLastError());
                    CloseHandle(hHandle);
                    hHandle = NULL;
                }
                CloseHandle(hProcessToken);
            }
        }
    }


    if(S_OK == hr)
        *phToken = hClientToken;

    if(hHandle)
        CloseHandle(hHandle);

    return (S_OK == hr);
}

//--------------------------------------------------------------------------
//
//  AERetrieveGeneralInfo
//
//
//--------------------------------------------------------------------------
BOOL    AERetrieveGeneralInfo(AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL                fResult = FALSE;
    DWORD               dwOpenStoreFlags = CERT_SYSTEM_STORE_CURRENT_USER;
    DWORD               cMachineName = MAX_COMPUTERNAME_LENGTH + 2;
	LONG	            dwResult = 0;

	SCARDCONTEXT		hSCContext=NULL;

    //get the client token
    if(pAE_General_Info->fMachine)
    {   
        if(!AENetLogonUser(NULL, NULL, NULL, &(pAE_General_Info->hToken)))
        {
            AE_DEBUG((AE_ERROR, L"Obtain local system's token (%lx)\n\r", GetLastError()));
            goto Ret;
        }
    }
    else
    {
        if(!AERetrieveClientToken(&(pAE_General_Info->hToken)))
            goto Ret;
    }

    //get the machine name
    if (!GetComputerNameW(pAE_General_Info->wszMachineName,
                          &cMachineName))
        goto Ret;

    if(pAE_General_Info->fMachine)
        dwOpenStoreFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE;

    //open my store
    if (NULL == (pAE_General_Info->hMyStore = CertOpenStore(
                        CERT_STORE_PROV_SYSTEM_W, 
                        ENCODING_TYPE, 
                        NULL, 
                        dwOpenStoreFlags, 
                        MY_STORE)))
    {
        AE_DEBUG((AE_ERROR, L"Unable to open MY store (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    if(!CertControlStore(pAE_General_Info->hMyStore, 
                        0, 
                        CERT_STORE_CTRL_AUTO_RESYNC, 
                        NULL))
    {
        AE_DEBUG((AE_ERROR, L"Unable configure MY store for auto-resync(%lx)\n\r", GetLastError()));
        goto Ret;
    }

    //open request store
    if (NULL == (pAE_General_Info->hRequestStore = CertOpenStore(
                        CERT_STORE_PROV_SYSTEM_W, 
                        ENCODING_TYPE, 
                        NULL, 
                        dwOpenStoreFlags, 
                        REQUEST_STORE)))
    {
        AE_DEBUG((AE_ERROR, L"Unable to open Request store (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    //get CertType information
    if(!AERetrieveCertTypeInfo( pAE_General_Info->pld, 
                                pAE_General_Info->fMachine,
                                &(pAE_General_Info->dwCertType), 
                                &(pAE_General_Info->rgCertTypeInfo)))
    {
        AE_DEBUG((AE_ERROR, L"Unable to retrieve CertType information (%lx)\n\r", GetLastError()));
        goto Ret;
    }

    //load xenroll module.  No need to check errors since this is not a fatal error
    pAE_General_Info->hXenroll = LoadLibrary(L"xenroll.dll");


    //detect if the smart card subsystem if running for users only
    if(FALSE == pAE_General_Info->fMachine)
    {
        dwResult = SCardEstablishContext(
                        SCARD_SCOPE_USER,
                        NULL,
                        NULL,
                        &hSCContext );

        if((0 == dwResult) && (NULL != hSCContext))
            pAE_General_Info->fSmartcardSystem=TRUE;
    }

    fResult = TRUE;

Ret:

    if(hSCContext)
        SCardReleaseContext(hSCContext);

    if(FALSE == fResult)
        AEFreeGeneralInfo(pAE_General_Info);

    return fResult;
}


//--------------------------------------------------------------------------
//
//  AEFreeGeneralInfo
//
//
//--------------------------------------------------------------------------
BOOL    AEFreeGeneralInfo(AE_GENERAL_INFO *pAE_General_Info)
{
    if(pAE_General_Info)
    {
        if(pAE_General_Info->hToken)
            CloseHandle(pAE_General_Info->hToken);

        if(pAE_General_Info->hMyStore)
            CertCloseStore(pAE_General_Info->hMyStore, 0);

        if(pAE_General_Info->hRequestStore)
            CertCloseStore(pAE_General_Info->hRequestStore, 0);

        //free CA information
        AEFreeCAInfo(pAE_General_Info->dwCA, pAE_General_Info->rgCAInfo);

        //free CertType information
        AEFreeCertTypeInfo(pAE_General_Info->dwCertType, pAE_General_Info->rgCertTypeInfo);

        if(pAE_General_Info->hXenroll)
            FreeLibrary(pAE_General_Info->hXenroll);

        if(pAE_General_Info->hCancelEvent)
            CloseHandle(pAE_General_Info->hCancelEvent);

        if(pAE_General_Info->hCompleteEvent)
            CloseHandle(pAE_General_Info->hCompleteEvent);

        if(pAE_General_Info->hThread)
            CloseHandle(pAE_General_Info->hThread);

        memset(pAE_General_Info, 0, sizeof(AE_GENERAL_INFO));

    }

    return TRUE;
}


//--------------------------------------------------------------------------
//
//  AERetrieveCertTypeInfo
//
//--------------------------------------------------------------------------
BOOL    AERetrieveCertTypeInfo(LDAP *pld, BOOL fMachine, DWORD *pdwCertType, AE_CERTTYPE_INFO **prgCertType)
{
    BOOL                fResult=FALSE;
    DWORD               dwCount=0;
    DWORD               dwCertType=0;
    DWORD               dwIndex=0;
    HRESULT             hr=E_FAIL;

    HCERTTYPE           hCTCurrent = NULL;
    HCERTTYPE           hCTNew = NULL;
    AE_CERTTYPE_INFO    *rgCertTypeInfo=NULL;

    *pdwCertType=0;
    *prgCertType=NULL;

    if(S_OK != (hr = CAEnumCertTypesEx(
                (LPCWSTR)pld,
                fMachine?CT_ENUM_MACHINE_TYPES | CT_FIND_LOCAL_SYSTEM | CT_FLAG_SCOPE_IS_LDAP_HANDLE: CT_ENUM_USER_TYPES | CT_FLAG_SCOPE_IS_LDAP_HANDLE, 
                &hCTCurrent)))
    {
        SetLastError(hr);
        goto Ret;
    }

    if((NULL == hCTCurrent) || (0 == (dwCount = CACountCertTypes(hCTCurrent))))
    {
        AE_DEBUG((AE_WARNING, L"No CT's available for auto-enrollment\n\r"));
        fResult=TRUE;
        goto Ret;
    }

    rgCertTypeInfo=(AE_CERTTYPE_INFO *)LocalAlloc(LPTR, sizeof(AE_CERTTYPE_INFO) * dwCount);
    if(NULL==rgCertTypeInfo)
    {
        SetLastError(E_OUTOFMEMORY);
        goto Ret;
    }

    memset(rgCertTypeInfo, 0, sizeof(AE_CERTTYPE_INFO) * dwCount);

    for(dwIndex = 0; dwIndex < dwCount; dwIndex++ )       
    {

        //check if we have a new certificate template
        if(dwIndex > 0)
        {
            hr = CAEnumNextCertType(hCTCurrent, &hCTNew);

            if((S_OK != hr) || (NULL == hCTNew))
            {
                // Clean up from previous calls
                if(dwCertType < dwCount)
                    AEFreeCertTypeStruct(&(rgCertTypeInfo[dwCertType]));

                break;
            }

            hCTCurrent = hCTNew; 
        }

        // Clean up from previous calls
        AEFreeCertTypeStruct(&(rgCertTypeInfo[dwCertType]));

        //copy the new CertType' data
        //hCertType
        rgCertTypeInfo[dwCertType].hCertType = hCTCurrent;

        //CTName
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_DN,
                             &(rgCertTypeInfo[dwCertType].awszName));

        if((S_OK != hr) ||
           (NULL == rgCertTypeInfo[dwCertType].awszName) || 
           (NULL == (rgCertTypeInfo[dwCertType].awszName)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No name property for CertType\n\r"));
            continue;
        }
    
        //FriendlyName
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_FRIENDLY_NAME,
                             &(rgCertTypeInfo[dwCertType].awszDisplay));
        if((S_OK != hr) ||
           (NULL == rgCertTypeInfo[dwCertType].awszDisplay) || 
           (NULL == (rgCertTypeInfo[dwCertType].awszDisplay)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No display property for CertType\n\r"));

            //get the DN as the display name
            hr = CAGetCertTypePropertyEx(
                                 hCTCurrent, 
                                 CERTTYPE_PROP_DN,
                                 &(rgCertTypeInfo[dwCertType].awszDisplay));
            if((S_OK != hr) ||
               (NULL == rgCertTypeInfo[dwCertType].awszDisplay) || 
               (NULL == (rgCertTypeInfo[dwCertType].awszDisplay)[0])
              )
            {
                AE_DEBUG((AE_INFO, L"No name property for CertType\n\r"));
                continue;
            }
        }

        //dwSchemaVersion
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_SCHEMA_VERSION,
                             &(rgCertTypeInfo[dwCertType].dwSchemaVersion));

        if(hr != S_OK)
        {
            AE_DEBUG((AE_INFO, L"No schema version for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //dwVersion
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_REVISION,
                             &(rgCertTypeInfo[dwCertType].dwVersion));

        if(hr != S_OK)
        {
            AE_DEBUG((AE_INFO, L"No major version for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //dwEnrollmentFlag
        hr = CAGetCertTypeFlagsEx(
                            hCTCurrent,
                            CERTTYPE_ENROLLMENT_FLAG,
                            &(rgCertTypeInfo[dwCertType].dwEnrollmentFlag));

        if(hr != S_OK)
        {
            AE_DEBUG((AE_INFO, L"No enrollment flag for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //dwPrivatekeyFlag
        hr = CAGetCertTypeFlagsEx(
                            hCTCurrent,
                            CERTTYPE_PRIVATE_KEY_FLAG,
                            &(rgCertTypeInfo[dwCertType].dwPrivateKeyFlag));

        if(hr != S_OK)
        {
            AE_DEBUG((AE_INFO, L"No private key flag for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //expiration offset
        hr = CAGetCertTypeExpiration(
                            hCTCurrent,
                            NULL,
                            (LPFILETIME)&(rgCertTypeInfo[dwCertType].ftExpirationOffset));

        //we might not get the expiration date
        if(hr != S_OK)
        {
            AE_DEBUG((AE_WARNING, L"Could not get cert type expirations: %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
        }

        //oid
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_OID,
                             &(rgCertTypeInfo[dwCertType].awszOID));

        //we might not get the oid property
        if(rgCertTypeInfo[dwCertType].dwSchemaVersion >= CERTTYPE_SCHEMA_VERSION_2)
        {
            if((S_OK != hr) ||
               (NULL == rgCertTypeInfo[dwCertType].awszOID) || 
               (NULL == (rgCertTypeInfo[dwCertType].awszOID)[0])
              )
            {
                AE_DEBUG((AE_INFO, L"No oid for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
                continue;
            }
        }


        //supersede
        hr = CAGetCertTypePropertyEx(
                             hCTCurrent, 
                             CERTTYPE_PROP_SUPERSEDE,
                             &(rgCertTypeInfo[dwCertType].awszSupersede));

        //we might not get the supersede property
        if(hr != S_OK)
        {
            AE_DEBUG((AE_INFO, L"No supersede for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
        }

        //hArchiveStore
        if(NULL == (rgCertTypeInfo[dwCertType].hArchiveStore=CertOpenStore(
                        CERT_STORE_PROV_MEMORY,
                        ENCODING_TYPE,
                        NULL,
                        0,
                        NULL)))

        {
            AE_DEBUG((AE_INFO, L"Unable to open archive cert store for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //hObtainedStore
        if(NULL == (rgCertTypeInfo[dwCertType].hObtainedStore=CertOpenStore(
                        CERT_STORE_PROV_MEMORY,
                        ENCODING_TYPE,
                        NULL,
                        0,
                        NULL)))

        {
            AE_DEBUG((AE_INFO, L"Unable to open obtained cert store for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //hIssuedStore
        if(NULL == (rgCertTypeInfo[dwCertType].hIssuedStore=CertOpenStore(
                        CERT_STORE_PROV_MEMORY,
                        ENCODING_TYPE,
                        NULL,
                        0,
                        NULL)))

        {
            AE_DEBUG((AE_INFO, L"Unable to open issued cert store for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        //allocate memory
        rgCertTypeInfo[dwCertType].prgActive=(DWORD *)LocalAlloc(LPTR, sizeof(DWORD) * dwCount);
        if(NULL == rgCertTypeInfo[dwCertType].prgActive)
        {
            AE_DEBUG((AE_INFO, L"Unable to allocate memory for CT %ls\n\r", (rgCertTypeInfo[dwCertType].awszName)[0]));
            continue;
        }

        memset(rgCertTypeInfo[dwCertType].prgActive, 0, sizeof(DWORD) * dwCount);

        dwCertType++;
    }

    *pdwCertType=dwCertType;
    *prgCertType=rgCertTypeInfo;

    fResult = TRUE;

Ret:

    return fResult;
}

//--------------------------------------------------------------------------
//
//  AEFreeCertTypeInfo
//
//
//--------------------------------------------------------------------------
BOOL    AEFreeCertTypeInfo(DWORD dwCertType, AE_CERTTYPE_INFO *rgCertTypeInfo)
{
    DWORD   dwIndex=0;
    
    if(rgCertTypeInfo)
    {
        for(dwIndex=0; dwIndex < dwCertType; dwIndex++)
            AEFreeCertTypeStruct(&(rgCertTypeInfo[dwIndex]));        

        LocalFree(rgCertTypeInfo);
    }
    
    return TRUE;
}


//--------------------------------------------------------------------------
//
//  AEFreeCertTypeStruct
//
//
//--------------------------------------------------------------------------
BOOL    AEFreeCertTypeStruct(AE_CERTTYPE_INFO *pCertTypeInfo)
{
    DWORD   dwIndex=0;

    if(pCertTypeInfo)
    {
        if(pCertTypeInfo->hCertType)
        {
            if(pCertTypeInfo->awszName)
                CAFreeCertTypeProperty(pCertTypeInfo->hCertType, pCertTypeInfo->awszName);

            if(pCertTypeInfo->awszDisplay)
                CAFreeCertTypeProperty(pCertTypeInfo->hCertType, pCertTypeInfo->awszDisplay);

            if(pCertTypeInfo->awszOID)
                CAFreeCertTypeProperty(pCertTypeInfo->hCertType, pCertTypeInfo->awszOID);
    
            if(pCertTypeInfo->awszSupersede)
                CAFreeCertTypeProperty(pCertTypeInfo->hCertType, pCertTypeInfo->awszSupersede);

            CACloseCertType(pCertTypeInfo->hCertType);
        }

        if(pCertTypeInfo->prgActive)
            LocalFree(pCertTypeInfo->prgActive);

        if(pCertTypeInfo->pOldCert)
            CertFreeCertificateContext(pCertTypeInfo->pOldCert);

        if(pCertTypeInfo->hArchiveStore)
            CertCloseStore(pCertTypeInfo->hArchiveStore, 0);

        if(pCertTypeInfo->hObtainedStore)
            CertCloseStore(pCertTypeInfo->hObtainedStore, 0);

        if(pCertTypeInfo->hIssuedStore)
            CertCloseStore(pCertTypeInfo->hIssuedStore, 0);

        if(pCertTypeInfo->dwPendCount)
        {
            if(pCertTypeInfo->rgPendInfo)
            {
                for(dwIndex=0; dwIndex < pCertTypeInfo->dwPendCount; dwIndex++)
                {
                    if((pCertTypeInfo->rgPendInfo[dwIndex]).blobPKCS7.pbData)
                        LocalFree((pCertTypeInfo->rgPendInfo[dwIndex]).blobPKCS7.pbData);

                    if((pCertTypeInfo->rgPendInfo[dwIndex]).blobHash.pbData)
                        LocalFree((pCertTypeInfo->rgPendInfo[dwIndex]).blobHash.pbData);
                }

                LocalFree(pCertTypeInfo->rgPendInfo);
            }
        }

        memset(pCertTypeInfo, 0, sizeof(AE_CERTTYPE_INFO));
    }

    return TRUE;
}

//--------------------------------------------------------------------------
//
//  AERetrieveCAInfo
//
//
//--------------------------------------------------------------------------
BOOL    AERetrieveCAInfo(LDAP *pld, BOOL fMachine, HANDLE hToken, DWORD *pdwCA, AE_CA_INFO **prgCAInfo)
{
    BOOL                fResult = FALSE;
    DWORD               dwCount=0;
    DWORD               dwCA=0;
    DWORD               dwIndex=0;
    HRESULT             hr=E_FAIL;

    HCAINFO             hCACurrent = NULL;
    HCAINFO             hCANew = NULL;
    AE_CA_INFO          *rgCAInfo=NULL;

    *pdwCA=0;
    *prgCAInfo=NULL;

    if(S_OK != (hr = CAEnumFirstCA(
                        (LPCWSTR)pld, 
                        CA_FLAG_SCOPE_IS_LDAP_HANDLE | (fMachine?CA_FIND_LOCAL_SYSTEM:0), 
                        &hCACurrent)))
    {
        SetLastError(hr);
        goto Ret;
    }

    if((NULL == hCACurrent) || (0 == (dwCount = CACountCAs(hCACurrent))))
    {
        AE_DEBUG((AE_WARNING, L"No CA's available for auto-enrollment\n\r"));
        fResult=TRUE;
        goto Ret;
    }

    rgCAInfo=(AE_CA_INFO *)LocalAlloc(LPTR, sizeof(AE_CA_INFO) * dwCount);
    if(NULL==rgCAInfo)
    {
        SetLastError(E_OUTOFMEMORY);
        goto Ret;
    }

    memset(rgCAInfo, 0, sizeof(AE_CA_INFO) * dwCount);

    for(dwIndex = 0; dwIndex < dwCount; dwIndex++ )       
    {

        //check if we have a new CA
        if(dwIndex > 0)
        {
            hr = CAEnumNextCA(hCACurrent, &hCANew);

            if((S_OK != hr) || (NULL == hCANew))
            {
                // Clean up from previous calls
                if(dwCA < dwCount)
                    AEFreeCAStruct(&(rgCAInfo[dwCA]));

                break;
            }

            hCACurrent = hCANew; 
        }

        // Clean up from previous calls
        AEFreeCAStruct(&(rgCAInfo[dwCA]));

        //copy the new CA' data
        //hCAInfo
        rgCAInfo[dwCA].hCAInfo = hCACurrent;

        //CAName
        hr = CAGetCAProperty(hCACurrent, 
                             CA_PROP_NAME,
                             &(rgCAInfo[dwCA].awszCAName));

        if((S_OK != hr) ||
           (NULL == rgCAInfo[dwCA].awszCAName) || 
           (NULL == (rgCAInfo[dwCA].awszCAName)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No name property for ca\n\r"));
            continue;
        }

        //access check
        if(S_OK != CAAccessCheckEx(rgCAInfo[dwCA].hCAInfo, hToken, CERTTYPE_ACCESS_CHECK_ENROLL | CERTTYPE_ACCESS_CHECK_NO_MAPPING))
        {
            AE_DEBUG((AE_INFO, L"No access for CA %ls\n\r", (rgCAInfo[dwCA].awszCAName)[0]));
            continue;
        }

        //CA Display
        hr = CAGetCAProperty(hCACurrent, 
                             CA_PROP_DISPLAY_NAME,
                             &(rgCAInfo[dwCA].awszCADisplay));

        if((S_OK != hr) ||
           (NULL == rgCAInfo[dwCA].awszCADisplay) || 
           (NULL == (rgCAInfo[dwCA].awszCADisplay)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No display name property for ca\n\r"));

            hr = CAGetCAProperty(hCACurrent, 
                                 CA_PROP_NAME,
                                 &(rgCAInfo[dwCA].awszCADisplay));

            if((S_OK != hr) ||
               (NULL == rgCAInfo[dwCA].awszCADisplay) || 
               (NULL == (rgCAInfo[dwCA].awszCADisplay)[0])
              )
            {
                AE_DEBUG((AE_INFO, L"No name property for ca\n\r"));
                continue;
            }
        }

        //CADNS
        hr = CAGetCAProperty(hCACurrent, 
                             CA_PROP_DNSNAME,
                             &(rgCAInfo[dwCA].awszCADNS));

        if((S_OK != hr) ||
           (NULL == rgCAInfo[dwCA].awszCADNS) || 
           (NULL == (rgCAInfo[dwCA].awszCADNS)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No DNS property for CA %ls\n\r", (rgCAInfo[dwCA].awszCAName)[0]));
            continue;
        }

        //CACertificateTemplate
        hr = CAGetCAProperty(hCACurrent, 
                             CA_PROP_CERT_TYPES,
                             &(rgCAInfo[dwCA].awszCertificateTemplate));

        if((S_OK != hr) ||
           (NULL == rgCAInfo[dwCA].awszCertificateTemplate) || 
           (NULL == (rgCAInfo[dwCA].awszCertificateTemplate)[0])
          )
        {
            AE_DEBUG((AE_INFO, L"No CertType property for CA %ls\n\r", (rgCAInfo[dwCA].awszCAName)[0]));
            continue;
        }

        dwCA++;
    }

    *pdwCA=dwCA;
    *prgCAInfo=rgCAInfo;

    fResult = TRUE;

Ret:

    return fResult;
}

//--------------------------------------------------------------------------
//
//  AEFreeCAInfo
//
//
//--------------------------------------------------------------------------
BOOL    AEFreeCAInfo(DWORD dwCA, AE_CA_INFO *rgCAInfo)
{
    DWORD   dwIndex=0;

    if(rgCAInfo)
    {
        for(dwIndex=0; dwIndex < dwCA; dwIndex++)
            AEFreeCAStruct(&(rgCAInfo[dwIndex]));

        LocalFree(rgCAInfo);
    }

    return TRUE;
}


//--------------------------------------------------------------------------
//
//  AEFreeCAStruct
//
//
//--------------------------------------------------------------------------
BOOL    AEFreeCAStruct(AE_CA_INFO *pCAInfo)
{
    if(pCAInfo)
    {
        if(pCAInfo->hCAInfo)
        {
            if(pCAInfo->awszCAName)
            {
                CAFreeCAProperty(pCAInfo->hCAInfo,pCAInfo->awszCAName);       
            }
            if(pCAInfo->awszCADisplay)
            {
                CAFreeCAProperty(pCAInfo->hCAInfo,pCAInfo->awszCADisplay);       
            }
            if(pCAInfo->awszCADNS)
            {
                CAFreeCAProperty(pCAInfo->hCAInfo, pCAInfo->awszCADNS);       
            }
            if(pCAInfo->awszCertificateTemplate)
            {
                CAFreeCAProperty(pCAInfo->hCAInfo,pCAInfo->awszCertificateTemplate);
            }

            CACloseCA(pCAInfo->hCAInfo);
        }

        memset(pCAInfo, 0, sizeof(AE_CA_INFO));
    }

    return TRUE;
}

//--------------------------------------------------------------------------
//
//  AEClearVistedFlag
//
//--------------------------------------------------------------------------
BOOL    AEClearVistedFlag(AE_GENERAL_INFO *pAE_General_Info)
{   
    DWORD       dwIndex=0;

    if(pAE_General_Info)
    {
       if(pAE_General_Info->rgCertTypeInfo)
       {
            for(dwIndex=0; dwIndex < pAE_General_Info->dwCertType; dwIndex++)
            {
                (pAE_General_Info->rgCertTypeInfo)[dwIndex].fSupersedeVisited=FALSE;
            }
       }
    }

    return TRUE;
}
//--------------------------------------------------------------------------
//
//  AEIfSupersede
//
//      Recursively find if pwsz is superseded by one of the template in awsz.
//      Notice that we should not loop in the superseding relationship.
//      Superseding tree should be one directional tree without duplicated nodes.
//
//--------------------------------------------------------------------------
BOOL  AEIfSupersede(LPWSTR  pwsz, LPWSTR *awsz, AE_GENERAL_INFO *pAE_General_Info)
{
    BOOL                    fResult = FALSE;
    LPWSTR                  *pwszArray = awsz;
    AE_TEMPLATE_INFO        AETemplateInfo;
    AE_CERTTYPE_INFO        *pCertType = NULL;

    LPWSTR                  *awszSupersede=NULL;

    if((NULL==pwsz) || (NULL==awsz))
        return FALSE;

    while(*pwszArray)
    {
        if(0 == wcscmp(pwsz, *pwszArray))
        {
            fResult = TRUE;
            break;
        }

        //find the template
        memset(&AETemplateInfo, 0, sizeof(AE_TEMPLATE_INFO));

        AETemplateInfo.pwszName=*pwszArray;

        pCertType = AEFindTemplateInRequestTree(
                        &AETemplateInfo,
                        pAE_General_Info);

        if(pCertType)
        {
            if(!(pCertType->fSupersedeVisited))
            {
                //mark that we have visited superseding relationship for this template
                pCertType->fSupersedeVisited=TRUE;

                if(S_OK == CAGetCertTypePropertyEx(
                             pCertType->hCertType, 
                             CERTTYPE_PROP_SUPERSEDE,
                             &(awszSupersede)))
                {
                    fResult = AEIfSupersede(pwsz, awszSupersede, pAE_General_Info);

                    if(awszSupersede)
                        CAFreeCertTypeProperty(
                            pCertType->hCertType,
                            awszSupersede);

                    awszSupersede=NULL;
                
                    if(TRUE == fResult)
                        break;
                }
            }
        }

        pwszArray++;
    }

    return fResult;
}

//--------------------------------------------------------------------------
//
//  AEIsAnElement
//
//
//--------------------------------------------------------------------------
BOOL    AEIsAnElement(LPWSTR   pwsz, LPWSTR *awsz)
{
    BOOL                    fResult = FALSE;
    LPWSTR                  *pwszArray = awsz;
    
    if((NULL==pwsz) || (NULL==awsz))
        return FALSE;

    while(*pwszArray)
    {
        if(0 == wcscmp(pwsz, *pwszArray))
        {
            fResult = TRUE;
            break;
        }
    
        pwszArray++;
    }

    return fResult;
}
                          
//--------------------------------------------------------------------------
//
//  AECopyCertStore
//
//
//--------------------------------------------------------------------------
BOOL AECopyCertStore(HCERTSTORE     hSrcStore,
                     HCERTSTORE     hDesStore)
{
    PCCERT_CONTEXT  pCertContext=NULL;

    if((NULL==hSrcStore) || (NULL==hDesStore))
        return FALSE;

    while(pCertContext = CertEnumCertificatesInStore(hSrcStore, pCertContext))
    {
        CertAddCertificateContextToStore(hDesStore,
                                     pCertContext,
                                     CERT_STORE_ADD_USE_EXISTING,
                                     NULL);
    }

    return TRUE;
}

//--------------------------------------------------------------------------
//
//  AEGetConfigDN
//
//
//--------------------------------------------------------------------------
HRESULT 
AEGetConfigDN(
    IN  LDAP *pld,
    OUT LPWSTR *pwszConfigDn
    )
{

    HRESULT         hr;
    ULONG           LdapError;

    LDAPMessage  *SearchResult = NULL;
    LDAPMessage  *Entry = NULL;
    WCHAR        *Attr = NULL;
    BerElement   *BerElement;
    WCHAR        **Values = NULL;

    WCHAR  *AttrArray[3];
    struct l_timeval        timeout;

    WCHAR  *ConfigurationNamingContext = L"configurationNamingContext";
    WCHAR  *ObjectClassFilter          = L"objectCategory=*";

    //
    // Set the out parameters to null
    //
    if(pwszConfigDn)
    {
        *pwszConfigDn = NULL;
    }

    timeout.tv_sec = 300;
    timeout.tv_usec = 0;
    //
    // Query for the ldap server oerational attributes to obtain the default
    // naming context.
    //
    AttrArray[0] = ConfigurationNamingContext;
    AttrArray[1] = NULL;  // this is the sentinel

    LdapError = ldap_search_ext_s(pld,
                               NULL,
                               LDAP_SCOPE_BASE,
                               ObjectClassFilter,
                               AttrArray,
                               FALSE,
                               NULL,
                               NULL,
                               &timeout,
                               10000,
                               &SearchResult);

    hr = HRESULT_FROM_WIN32(LdapMapErrorToWin32(LdapError));

    if (S_OK == hr) 
    {

        Entry = ldap_first_entry(pld, SearchResult);

        if (Entry) 
        {

            Values = ldap_get_values(pld, 
                                        Entry, 
                                        ConfigurationNamingContext);

            if (Values && Values[0]) 
            {
                (*pwszConfigDn) = (LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR)*(wcslen(Values[0])+1));

                if(NULL==(*pwszConfigDn))
                    hr=E_OUTOFMEMORY;
                else
                    wcscpy((*pwszConfigDn), Values[0]);
            }

            ldap_value_free(Values);
        }

        if (pwszConfigDn && (!(*pwszConfigDn))) 
        {
            // We could not get the default domain or out of memory - bail out
            if(E_OUTOFMEMORY != hr)
                hr =  HRESULT_FROM_WIN32(ERROR_CANT_ACCESS_DOMAIN_INFO);
        }

        if(SearchResult)
        {
            ldap_msgfree(SearchResult);
        }
    }

    return hr;
}

//--------------------------------------------------------------------------
//
//  AERobustLdapBind
//
//--------------------------------------------------------------------------
HRESULT 
AERobustLdapBind(
    OUT LDAP ** ppldap,
    OUT LPWSTR *ppwszDCName)
{
    DWORD               dwErr = ERROR_SUCCESS;
    HRESULT             hr = S_OK;
    BOOL                fForceRediscovery = FALSE;
    DWORD               dwGetDCFlags = DS_RETURN_DNS_NAME | DS_BACKGROUND_ONLY;
    PDOMAIN_CONTROLLER_INFO pDomainInfo = NULL;
    LDAP                *pld = NULL;
    LPWSTR              wszDomainControllerName = NULL;
    ULONG               ulOptions = 0;

    ULONG               ldaperr;

    do {

        if(fForceRediscovery)
        {
           dwGetDCFlags |= DS_FORCE_REDISCOVERY;
        }

        ldaperr = LDAP_SERVER_DOWN;

        // Get the GC location
        dwErr = DsGetDcNameW(NULL,     // Delayload wrapped
                            NULL, 
                            NULL, 
                            NULL,
                            dwGetDCFlags,
                            &pDomainInfo);

        if(dwErr != ERROR_SUCCESS)
        {
            hr = HRESULT_FROM_WIN32(dwErr);
            goto error;
        }

        if((pDomainInfo == NULL) || 
           ((pDomainInfo->Flags & DS_DNS_CONTROLLER_FLAG) == 0) ||
           (pDomainInfo->DomainControllerName == NULL))
        {
            if(!fForceRediscovery)
            {
                fForceRediscovery = TRUE;
                continue;
            }
            hr = HRESULT_FROM_WIN32(ERROR_CANT_ACCESS_DOMAIN_INFO);
            goto error;
        }


        wszDomainControllerName = pDomainInfo->DomainControllerName;


        // skip past forward slashes (why are they there?)
        while(*wszDomainControllerName == L'\\')
        {
            wszDomainControllerName++;
        }

        // bind to ds
        if((pld = ldap_initW(wszDomainControllerName, LDAP_PORT)) == NULL)
        {
            ldaperr = LdapGetLastError();
        }
        else
        {                         
            //reduce bogus DNS query
            ulOptions = PtrToUlong(LDAP_OPT_ON);
            (void)ldap_set_optionW(pld, LDAP_OPT_AREC_EXCLUSIVE, &ulOptions );

            ldaperr = ldap_bind_sW(pld, NULL, NULL, LDAP_AUTH_NEGOTIATE);
        }
        hr = HRESULT_FROM_WIN32(LdapMapErrorToWin32(ldaperr));

        if(fForceRediscovery)
        {
            break;
        }
        fForceRediscovery = TRUE;

    } while(ldaperr == LDAP_SERVER_DOWN);


    if(S_OK != hr)
        goto error;

    if(ppwszDCName)
    {
        *ppwszDCName=(LPWSTR)LocalAlloc(LPTR, 
            sizeof(WCHAR) * (wcslen(wszDomainControllerName) + 1));

        if(NULL==*ppwszDCName)
        {
            hr=E_OUTOFMEMORY;
            goto error;
        }

        wcscpy(*ppwszDCName, wszDomainControllerName);
    }


    *ppldap = pld;
    pld = NULL;

    hr=S_OK;

error:

    if(pld)
    {
        ldap_unbind(pld);
    }

    if(pDomainInfo)
    {
        NetApiBufferFree(pDomainInfo);     
    }
    return hr;
}

//---------------------------------------------------------------------------
//
//  AEAllocAndCopy
//
//---------------------------------------------------------------------------
BOOL AEAllocAndCopy(LPWSTR    pwszSrc, LPWSTR    *ppwszDest)
{
    if((NULL==ppwszDest) || (NULL==pwszSrc))
    {
        SetLastError(E_INVALIDARG);
        return FALSE;
    }

    *ppwszDest=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * (wcslen(pwszSrc) + 1));
    if(NULL==(*ppwszDest))
    {
        SetLastError(E_OUTOFMEMORY);
        return FALSE;
    }

    wcscpy(*ppwszDest, pwszSrc);

    return TRUE;
}


//--------------------------------------------------------------------------
// Name:    AELogAutoEnrollmentEvent
//
// Description: This function registers an event in the event log of the
//              local machine.  Takes an optional argument list.
//
//--------------------------------------------------------------------------
void AELogAutoEnrollmentEvent(IN DWORD    dwLogLevel,
                            IN BOOL     fError,
                            IN HRESULT  hr,
                            IN DWORD    dwEventId,
                            IN BOOL     fMachine,
                            IN HANDLE   hToken,
                            IN DWORD    dwParamCount,
                            ...
                            )
{
    BYTE        FastBuffer[MAX_DN_SIZE];
    DWORD       cbUser =0;
    BOOL        fAlloced = FALSE;
    PSID        pSID = NULL;
    WORD        dwEventType = 0;
    LPWSTR      awszStrings[PENDING_ALLOC_SIZE + 3];
    WORD        cStrings = 0;
    LPWSTR      wszString = NULL;
	WCHAR       wszMsg[MAX_DN_SIZE];
    WCHAR       wszUser[MAX_DN_SIZE];
    DWORD       dwIndex=0;
    DWORD       dwSize=0;

    HANDLE      hEventSource = NULL;  
    LPWSTR      wszHR=NULL;
    PTOKEN_USER ptgUser = NULL;


    va_list     ArgList;


    //check the log level; log errors and success by default
    if(((dwEventId >> 30) < dwLogLevel) && ((dwEventId >> 30) != STATUS_SEVERITY_SUCCESS))
        return;

    if(NULL==(hEventSource = RegisterEventSourceW(NULL, EVENT_AUTO_NAME)))
        return;

    //copy the user/machine string
    wszUser[0]=L'\0';

    //use the user name for user case
    if(FALSE == fMachine)
    {
        dwSize=MAX_DN_SIZE;

        if(!GetUserNameEx(
                NameSamCompatible,      // name format
                wszUser,                // name buffer
                &dwSize))               // size of name buffer
        {
            LoadStringW(g_hmodThisDll, IDS_USER, wszUser, MAX_DN_SIZE);
        }
    }
    else
    {
        LoadStringW(g_hmodThisDll, IDS_MACHINE, wszUser, MAX_DN_SIZE);
    }

    awszStrings[cStrings++] = wszUser;

    //copy the variable strings if present
    va_start(ArgList, dwParamCount);

    for(dwIndex=0; dwIndex < dwParamCount; dwIndex++)
    {
        wszString = va_arg(ArgList, LPWSTR);

        awszStrings[cStrings++] = wszString;

        if(cStrings >= PENDING_ALLOC_SIZE)
        {
            break;
        }
    }

    va_end(ArgList);

    //copy the hr error code
    if(fError)
    {
        
        if(S_OK == hr)
            hr=E_FAIL;

	wsprintfW(wszMsg, L"0x%lx", hr);        
        awszStrings[cStrings++] = wszMsg;


        if(0 != FormatMessage(
                    FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
                    NULL,
                    hr,
                    MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                    (WCHAR *)&wszHR,
                    0,
                    NULL))
        {
            if(wszHR)
                awszStrings[cStrings++] = wszHR;
        }
    }

    // check if the token is non zero is so then impersonating so get the SID
    if((FALSE == fMachine) && (hToken))
    {
        ptgUser = (PTOKEN_USER)FastBuffer; // try fast buffer first
        cbUser = MAX_DN_SIZE;

        if (!GetTokenInformation(
                        hToken,    // identifies access token
                        TokenUser, // TokenUser info type
                        ptgUser,   // retrieved info buffer
                        cbUser,  // size of buffer passed-in
                        &cbUser  // required buffer size
                        ))
        {
            if(GetLastError() == ERROR_INSUFFICIENT_BUFFER)
            {
                if (NULL != (ptgUser = (PTOKEN_USER)LocalAlloc(LPTR, cbUser)))
                {
                    fAlloced = TRUE;

                    // get the user info and assign the sid if able to
                    if (GetTokenInformation(
                                    hToken,    // identifies access token
                                    TokenUser, // TokenUser info type
                                    ptgUser,   // retrieved info buffer
                                    cbUser,  // size of buffer passed-in
                                    &cbUser  // required buffer size
                                    ))
                    {
                        pSID = ptgUser->User.Sid;
                    }
                }
            }

        }
        else
        {
            // assign the sid when fast buffer worked
            pSID = ptgUser->User.Sid;
        }
    }


    switch(dwEventId >> 30)
    {
        case 0:
            dwEventType = EVENTLOG_SUCCESS;
        break;

        case 1:
            dwEventType = EVENTLOG_INFORMATION_TYPE;
        break;

        case 2:
            dwEventType = EVENTLOG_WARNING_TYPE;
        break;

        case 3:
            dwEventType = EVENTLOG_ERROR_TYPE;
        break;
    }

    ReportEventW(hEventSource,          // handle of event source
                 dwEventType,           // event type
                 0,                     // event category
                 dwEventId,             // event ID
                 pSID,                  // current user's SID
                 cStrings,              // strings in lpszStrings
                 0,                     // no bytes of raw data
                 (LPCWSTR*)awszStrings, // array of error strings
                 NULL                   // no raw data
                 );

    if (hEventSource)
        DeregisterEventSource(hEventSource);  

    if(fAlloced)
    {   
        if(ptgUser)
            LocalFree(ptgUser);
    }

    if(wszHR)
        LocalFree(wszHR);

    return;
}

//--------------------------------------------------------------------------
//
//	  FormatMessageUnicode
//
//--------------------------------------------------------------------------
BOOL FormatMessageUnicode(LPWSTR * ppwszFormat, UINT ids, ...)
{
    // get format string from resources
    WCHAR		wszFormat[1000];
	va_list		argList;
	DWORD		cbMsg=0;
	BOOL		fResult=FALSE;

    if(NULL == ppwszFormat)
        goto Ret;

    if(!LoadStringW(g_hmodThisDll, ids, wszFormat, sizeof(wszFormat) / sizeof(wszFormat[0])))
		goto Ret;

    // format message into requested buffer
    va_start(argList, ids);

    cbMsg = FormatMessageW(
        FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_STRING,
        wszFormat,
        0,                  // dwMessageId
        0,                  // dwLanguageId
        (LPWSTR) (ppwszFormat),
        0,                  // minimum size to allocate
        &argList);

    va_end(argList);

	if(!cbMsg)
        goto Ret;

	fResult=TRUE;


Ret:
	return fResult;
}

//--------------------------------------------------------------------------
//
//	  AENetLogonUser
//
//Abstract:
//
//    This module implements the network logon type by interfacing
//    with the NT Lan Man Security Support Provider (NTLMSSP).
//
//    If the logon succeds via the provided credentials, we duplicate
//    the resultant Impersonation token to a Primary level token.
//    This allows the result to be used in a call to CreateProcessAsUser
//
//Author:
//
//    Scott Field (sfield)    09-Jun-96
//--------------------------------------------------------------------------
BOOL
AENetLogonUser(
    LPTSTR UserName,
    LPTSTR DomainName,
    LPTSTR Password,
    PHANDLE phToken
    )
{
    SECURITY_STATUS SecStatus;
    CredHandle CredentialHandle1;
    CredHandle CredentialHandle2;

    CtxtHandle ClientContextHandle;
    CtxtHandle ServerContextHandle;
    SecPkgCredentials_Names sNames;

    ULONG ContextAttributes;

    ULONG PackageCount;
    ULONG PackageIndex;
    PSecPkgInfo PackageInfo;
    DWORD cbMaxToken;

    TimeStamp Lifetime;
    SEC_WINNT_AUTH_IDENTITY AuthIdentity;

    SecBufferDesc NegotiateDesc;
    SecBuffer NegotiateBuffer;

    SecBufferDesc ChallengeDesc;
    SecBuffer ChallengeBuffer;


    HANDLE hImpersonationToken;
    BOOL bSuccess = FALSE ; // assume this function will fail

    NegotiateBuffer.pvBuffer = NULL;
    ChallengeBuffer.pvBuffer = NULL;
    sNames.sUserName = NULL;
    ClientContextHandle.dwUpper = -1;
    ClientContextHandle.dwLower = -1;
    ServerContextHandle.dwUpper = -1;
    ServerContextHandle.dwLower = -1;
    CredentialHandle1.dwUpper = -1;
    CredentialHandle1.dwLower = -1;
    CredentialHandle2.dwUpper = -1;
    CredentialHandle2.dwLower = -1;


//
// << this section could be cached in a repeat caller scenario >>
//

    //
    // Get info about the security packages.
    //

    if(EnumerateSecurityPackages(
        &PackageCount,
        &PackageInfo
        ) != NO_ERROR) return FALSE;

    //
    // loop through the packages looking for NTLM
    //

    for(PackageIndex = 0 ; PackageIndex < PackageCount ; PackageIndex++ ) {
        if(PackageInfo[PackageIndex].Name != NULL) {
            if(lstrcmpi(PackageInfo[PackageIndex].Name, MICROSOFT_KERBEROS_NAME) == 0) {
                cbMaxToken = PackageInfo[PackageIndex].cbMaxToken;
                bSuccess = TRUE;
                break;
            }
        }
    }

    FreeContextBuffer( PackageInfo );

    if(!bSuccess) return FALSE;

    bSuccess = FALSE; // reset to assume failure

//
// << end of cached section >>
//

    //
    // Acquire a credential handle for the server side
    //

    SecStatus = AcquireCredentialsHandle(
                    NULL,           // New principal
                    MICROSOFT_KERBEROS_NAME,    // Package Name
                    SECPKG_CRED_INBOUND,
                    NULL,
                    NULL,
                    NULL,
                    NULL,
                    &CredentialHandle1,
                    &Lifetime
                    );

    if ( SecStatus != NO_ERROR ) {
        goto cleanup;
    }


    //
    // Acquire a credential handle for the client side
    //

    ZeroMemory( &AuthIdentity, sizeof(AuthIdentity) );

    if ( DomainName != NULL ) {
        AuthIdentity.Domain = DomainName;
        AuthIdentity.DomainLength = lstrlen(DomainName);
    }

    if ( UserName != NULL ) {
        AuthIdentity.User = UserName;
        AuthIdentity.UserLength = lstrlen(UserName);
    }

    if ( Password != NULL ) {
        AuthIdentity.Password = Password;
        AuthIdentity.PasswordLength = lstrlen(Password);
    }

    AuthIdentity.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;

    SecStatus = AcquireCredentialsHandle(
                    NULL,           // New principal
                    MICROSOFT_KERBEROS_NAME,    // Package Name
                    SECPKG_CRED_OUTBOUND,
                    NULL,
                    (DomainName == NULL && UserName == NULL && Password == NULL) ?
                        NULL : &AuthIdentity,
                    NULL,
                    NULL,
                    &CredentialHandle2,
                    &Lifetime
                    );

    if ( SecStatus != NO_ERROR ) {
        goto cleanup;
    }

    SecStatus =  QueryCredentialsAttributes(&CredentialHandle1, SECPKG_CRED_ATTR_NAMES, &sNames);
    if ( SecStatus != NO_ERROR ) {
        goto cleanup;
    }
    //
    // Get the NegotiateMessage (ClientSide)
    //

    NegotiateDesc.ulVersion = 0;
    NegotiateDesc.cBuffers = 1;
    NegotiateDesc.pBuffers = &NegotiateBuffer;

    NegotiateBuffer.cbBuffer = cbMaxToken;
    NegotiateBuffer.BufferType = SECBUFFER_TOKEN;
    NegotiateBuffer.pvBuffer = LocalAlloc( LMEM_FIXED, NegotiateBuffer.cbBuffer );

    if ( NegotiateBuffer.pvBuffer == NULL ) {
        goto cleanup;
    }

    SecStatus = InitializeSecurityContext(
                    &CredentialHandle2,
                    NULL,                       // No Client context yet
                    sNames.sUserName,                       // target name
                    ISC_REQ_SEQUENCE_DETECT,
                    0,                          // Reserved 1
                    SECURITY_NATIVE_DREP,
                    NULL,                       // No initial input token
                    0,                          // Reserved 2
                    &ClientContextHandle,
                    &NegotiateDesc,
                    &ContextAttributes,
                    &Lifetime
                    );
    if(SecStatus != NO_ERROR)
    {
        goto cleanup;
    }


    //
    // Get the ChallengeMessage (ServerSide)
    //

    NegotiateBuffer.BufferType |= SECBUFFER_READONLY;
    ChallengeDesc.ulVersion = 0;
    ChallengeDesc.cBuffers = 1;
    ChallengeDesc.pBuffers = &ChallengeBuffer;

    ChallengeBuffer.cbBuffer = cbMaxToken;
    ChallengeBuffer.BufferType = SECBUFFER_TOKEN;
    ChallengeBuffer.pvBuffer = LocalAlloc( LMEM_FIXED, ChallengeBuffer.cbBuffer );

    if ( ChallengeBuffer.pvBuffer == NULL ) {
        goto cleanup;
    }

    SecStatus = AcceptSecurityContext(
                    &CredentialHandle1,
                    NULL,               // No Server context yet
                    &NegotiateDesc,
                    ISC_REQ_SEQUENCE_DETECT,
                    SECURITY_NATIVE_DREP,
                    &ServerContextHandle,
                    &ChallengeDesc,
                    &ContextAttributes,
                    &Lifetime
                    );
    if(SecStatus != NO_ERROR)
    {
        goto cleanup;
    }


    if(QuerySecurityContextToken(&ServerContextHandle, phToken) != NO_ERROR)
        goto cleanup;

    bSuccess = TRUE;

cleanup:

    //
    // Delete context
    //

    if((ClientContextHandle.dwUpper != -1) ||
        (ClientContextHandle.dwLower != -1))
    {
        DeleteSecurityContext( &ClientContextHandle );
    }
    if((ServerContextHandle.dwUpper != -1) ||
        (ServerContextHandle.dwLower != -1))
    {
        DeleteSecurityContext( &ServerContextHandle );
    }

    //
    // Free credential handles
    //
    if((CredentialHandle1.dwUpper != -1) ||
        (CredentialHandle1.dwLower != -1))
    {
        FreeCredentialsHandle( &CredentialHandle1 );
    }
    if((CredentialHandle2.dwUpper != -1) ||
        (CredentialHandle2.dwLower != -1))
    {
        FreeCredentialsHandle( &CredentialHandle2 );
    }

    if ( NegotiateBuffer.pvBuffer != NULL ) {
        ZeroMemory( NegotiateBuffer.pvBuffer, NegotiateBuffer.cbBuffer );
        LocalFree( NegotiateBuffer.pvBuffer );
    }

    if ( ChallengeBuffer.pvBuffer != NULL ) {
        ZeroMemory( ChallengeBuffer.pvBuffer, ChallengeBuffer.cbBuffer );
        LocalFree( ChallengeBuffer.pvBuffer );
    }

    if ( sNames.sUserName != NULL ) {
        FreeContextBuffer( sNames.sUserName );
    }

    return bSuccess;
}

//--------------------------------------------------------------------------
//
//  AEDebugLog
//
//--------------------------------------------------------------------------
#if DBG
void
AEDebugLog(long Mask,  LPCWSTR Format, ...)
{
    va_list ArgList;
    int     Level = 0;
    int     PrefixSize = 0;
    int     iOut;
    WCHAR    wszOutString[MAX_DEBUG_BUFFER];
    long    OriginalMask = Mask;

    if (Mask & g_AutoenrollDebugLevel)
    {

        // Make the prefix first:  "Process.Thread> GINA-XXX"

        iOut = wsprintfW(
                wszOutString,
                L"%3d.%3d> AUTOENRL: ",
                GetCurrentProcessId(),
                GetCurrentThreadId());

        va_start(ArgList, Format);

        if (wvsprintfW(&wszOutString[iOut], Format, ArgList) < 0)
        {
            static WCHAR wszOverFlow[] = L"\n<256 byte OVERFLOW!>\n";

            // Less than zero indicates that the string would not fit into the
            // buffer.  Output a special message indicating overflow.

            wcscpy(
            &wszOutString[(sizeof(wszOutString) - sizeof(wszOverFlow))/sizeof(WCHAR)],
            wszOverFlow);
        }
        va_end(ArgList);
        OutputDebugStringW(wszOutString);
    }
}
#endif
//--------------------------------------------------------------------------
//
//	AERemoveRegKey
//
//		Remove the registry key for local system and all its sub keys.
//
//--------------------------------------------------------------------------
DWORD AERemoveRegKey(LPWSTR	pwszRegKey)
{
    DWORD           dwLastError=0;      //we should try to clean up as much as possible
	DWORD			dwIndex=0;
    DWORD           dwSubKey=0;
    DWORD           dwSubKeyLen=0;
    DWORD           dwData=0;
	
    HKEY            hDSKey=NULL;
    LPWSTR          pwszSubKey=NULL;

    //remove the optimization registry.  OK if the key does not exist 
    if(ERROR_SUCCESS != RegOpenKeyEx(
                HKEY_LOCAL_MACHINE,
                pwszRegKey, 
                0,
                KEY_ALL_ACCESS,
                &hDSKey))
        goto Ret;

    //remove all subkeys of hDSKey
    if(ERROR_SUCCESS != (dwLastError = RegQueryInfoKey(
                      hDSKey,
                      NULL,
                      NULL,
                      NULL,
                      &dwSubKey,
                      &dwSubKeyLen,
                      NULL,
                      NULL,
                      NULL,
                      NULL,
                      NULL,
                      NULL)))
        goto Ret;

    //terminating NULL
    dwSubKeyLen++;

    pwszSubKey=(LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR) * dwSubKeyLen);
    
    if(NULL == pwszSubKey)
    {
        dwLastError=ERROR_NOT_ENOUGH_MEMORY;
        goto Ret;
    }

    for(dwIndex=0; dwIndex < dwSubKey; dwIndex++)
    {
        dwData = dwSubKeyLen; 

        if(ERROR_SUCCESS == (dwLastError = RegEnumKeyEx(
                           hDSKey,
                           0,           // As we delete, the index changes
                           pwszSubKey,
                           &dwData,
                           NULL,
                           NULL,
                           NULL,
                           NULL)))
        {
            RegDeleteKey(hDSKey, pwszSubKey);
        }
	}

	//remove the root registry key
	dwLastError=RegDeleteKey(HKEY_LOCAL_MACHINE, pwszRegKey);

Ret:

    if(pwszSubKey)
        LocalFree(pwszSubKey);

    if(hDSKey)
        RegCloseKey(hDSKey);

    return dwLastError;
}

//--------------------------------------------------------------------------
//
//  CertAutoRemove
//
//      Function to remove enterprise specific public key trust upon domain disjoin.
//      Should be called under local admin's context.
//
//      The function will:
//          remove autoenrollment directory cache registry;
//          remove certificates under root enterprise store;
//          remove certificates under NTAuth enterprise store;
//          remove certificates under CA enterprise store;
//
//     
//      Parameters:
//          IN  dwFlags:        
//                              CERT_AUTO_REMOVE_COMMIT
//                              CERT_AUTO_REMOVE_ROLL_BACK
//
//      Return Value:
//          BOOL:               TURE is upon success
//
//--------------------------------------------------------------------------
BOOL 
WINAPI
CertAutoRemove(IN DWORD    dwFlags)
{
	DWORD			dwError=0;
    DWORD           dwLastError=0;      //we should try to clean up as much as possible
    DWORD           dwIndex=0;
    PCCERT_CONTEXT  pContext=NULL;
    WCHAR           wszNameBuf[64];

    HANDLE          hEvent=NULL;
    HCERTSTORE      hLocalStore=NULL;

    if((CERT_AUTO_REMOVE_COMMIT != dwFlags)  &&
        (CERT_AUTO_REMOVE_ROLL_BACK != dwFlags))
    {
        dwLastError=ERROR_INVALID_PARAMETER;
        goto Ret;
    }

    if(CERT_AUTO_REMOVE_ROLL_BACK == dwFlags)
    {
        //start machine autoenrollment
        wcscpy(wszNameBuf, L"Global\\");
        wcscat(wszNameBuf, MACHINE_AUTOENROLLMENT_TRIGGER_EVENT);

        hEvent=OpenEvent(EVENT_MODIFY_STATE, FALSE, wszNameBuf);
        if (NULL == hEvent) 
        {
            dwLastError=GetLastError();
            goto Ret;
        }

        if (!SetEvent(hEvent)) 
        {
            dwLastError=GetLastError();
            goto Ret;
        }
    }
    else
    {
        //remove all downloaded certificates
        for(dwIndex =0; dwIndex < g_dwStoreInfo; dwIndex++)
        {
            hLocalStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_REGISTRY_W, 
                                        0, 
                                        0, 
                                        CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE, 
                                        g_rgStoreInfo[dwIndex].pwszStoreName);

            if(hLocalStore)
            {
                while(pContext = CertEnumCertificatesInStore(hLocalStore, pContext))
                {
                    CertDeleteCertificateFromStore(CertDuplicateCertificateContext(pContext));
                }

                CertCloseStore(hLocalStore,0);
                hLocalStore=NULL;
            }
        }

		//remove the local machine's DC GUID cache
		dwLastError=AERemoveRegKey(AUTO_ENROLLMENT_DS_KEY);

		dwError=AERemoveRegKey(AUTO_ENROLLMENT_TEMPLATE_KEY);

		if(0 == dwLastError)
			dwLastError=dwError;
    }

Ret:

    if(hLocalStore)
        CertCloseStore(hLocalStore,0);

    if (hEvent) 
        CloseHandle(hEvent);


    if(0 != dwLastError)
    {
        SetLastError(dwLastError);
        return FALSE;
    }

    return TRUE;
}


//--------------------------------------------------------------------------
//
//  DLLMain
//
//
//--------------------------------------------------------------------------
extern "C"
BOOL WINAPI
DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
    BOOL                        fResult=TRUE;
    INITCOMMONCONTROLSEX        initcomm = {
        sizeof(initcomm), ICC_NATIVEFNTCTL_CLASS | ICC_LISTVIEW_CLASSES | ICC_PROGRESS_CLASS 
    };

    switch( dwReason )
    {
        case DLL_PROCESS_ATTACH:
                g_hmodThisDll=hInstance;
                DisableThreadLibraryCalls( hInstance );

                //Init common control for progress bar
                InitCommonControlsEx(&initcomm);

            break;

        case DLL_PROCESS_DETACH:
            break;
    }

    return fResult;
}