261 lines
11 KiB
Plaintext
261 lines
11 KiB
Plaintext
|
/*++
|
|||
|
|
|
|||
|
|
Copyright (c) 1990 Microsoft Corporation
|
|||
|
|
|
|||
|
|
Module Name:
|
|||
|
|
|
|||
|
|
regnames.txt
|
|||
|
|
|
|||
|
|
Abstract:
|
|||
|
|
|
|||
|
|
This file describes the registry namespace used to back-store the SAM
|
|||
|
|
database.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Author:
|
|||
|
|
|
|||
|
|
Jim Kelly (JimK) 3-June-1991
|
|||
|
|
|
|||
|
|
Revision History:
|
|||
|
|
|
|||
|
|
|
|||
|
|
1.0 - Initial implementation
|
|||
|
|
1.1 - Conversion to FlexAdmin model
|
|||
|
|
|
|||
|
|
--*/
|
|||
|
|
|
|||
|
|
/*
|
|||
|
|
|
|||
|
|
The following notation is used:
|
|||
|
|
|
|||
|
|
Xxx is the unicode name of a registry key.
|
|||
|
|
For example, "PasswordExpires".
|
|||
|
|
|
|||
|
|
(Xxx) is a description of a registry key's name.
|
|||
|
|
For example, "(UserName)" might indicate that the key name
|
|||
|
|
is a user's name.
|
|||
|
|
|
|||
|
|
[kvt,Value] kvt is the key value type, and Value describes the
|
|||
|
|
value of a registry key. If no specific key value type is used,
|
|||
|
|
then [,Value] references just the value. If the key has a
|
|||
|
|
key value type, but no key value, then [kvt,] notation is used.
|
|||
|
|
|
|||
|
|
Individual keys or key values may be referenced in the description
|
|||
|
|
as follows:
|
|||
|
|
|
|||
|
|
SAM/Domains/(DomainName)/Users/(UserName)
|
|||
|
|
- references a particular user name in a particular domain.
|
|||
|
|
|
|||
|
|
SAM/Domains/(DomainName)/Users/(UserName)[,Rid]
|
|||
|
|
- references a value of a named key.
|
|||
|
|
|
|||
|
|
.../(UserName) or
|
|||
|
|
.../(UserName)[Rid] may also be used as a shorthand notation when
|
|||
|
|
I get tired of typing out the whole name.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
NOTE: In several instances, and RID is used as a key name. In this
|
|||
|
|
case an ASCII conversion of the ULONG value is used. The name
|
|||
|
|
is printable and contains no zero bytes.
|
|||
|
|
|
|||
|
|
///////////////////////////////////////////////////////////////////////////////
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure of the registry namespace used to back-store the SAM
|
|||
|
|
database is as follows:
|
|||
|
|
|
|||
|
|
SAM [Revision,SecurityDescriptor]
|
|||
|
|
--+-
|
|||
|
|
+-- Domains
|
|||
|
|
----+--
|
|||
|
|
+-- (DomainName1) [,SecurityDescriptor]
|
|||
|
|
| (...)
|
|||
|
|
+-- (DomainNameN) [,SecurityDescriptor]
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure under each named domain is as follows:
|
|||
|
|
|
|||
|
|
(DomainName) [Revision, SecurityDescriptor]
|
|||
|
|
----+-------
|
|||
|
|
+-- V1_Fixed [, SAMP_V1_FIXED_LENGTH_DOMAIN]
|
|||
|
|
+-- DomainSid [,SidValue]
|
|||
|
|
+-- OemInformation [,unicode string]
|
|||
|
|
+-- ReplicaSourceNodeName [,unicode string]
|
|||
|
|
|
|
|||
|
|
+-- Users [Count,]
|
|||
|
|
| ---+-
|
|||
|
|
| +-- Names
|
|||
|
|
| | --+---
|
|||
|
|
| | +-- (UserName1) [UserRid,]
|
|||
|
|
| | | (...)
|
|||
|
|
| | +-- (UserNameL) [UserRid,]
|
|||
|
|
| |
|
|||
|
|
| +-- (UserRid1) [Revision,SecurityDescriptor]
|
|||
|
|
| | (...)
|
|||
|
|
| +-- (UserRidL) [Revision,SecurityDescriptor]
|
|||
|
|
|
|
|||
|
|
+-- Groups [Count,]
|
|||
|
|
| ---+--
|
|||
|
|
| +-- Names
|
|||
|
|
| | --+---
|
|||
|
|
| | +-- (GroupName1) [GroupRid,]
|
|||
|
|
| | | (...)
|
|||
|
|
| | +-- (GroupNameM) [GroupRid,]
|
|||
|
|
| |
|
|||
|
|
| +-- (GroupRid1) [Revision,SecurityDescriptor]
|
|||
|
|
| | (...)
|
|||
|
|
| +-- (GroupRidM) [Revision,SecurityDescriptor]
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
+-- Aliases [Count,]
|
|||
|
|
---+---
|
|||
|
|
+-- Names
|
|||
|
|
| --+---
|
|||
|
|
| +-- (AliasName1) [AliasRid,]
|
|||
|
|
| | (...)
|
|||
|
|
| +-- (AliasNameN) [AliasRid,]
|
|||
|
|
|
|
|||
|
|
+-- (AliasRid1) [Revision,SecurityDescriptor]
|
|||
|
|
| (...)
|
|||
|
|
+-- (AliasRidN) [Revision,SecurityDescriptor]
|
|||
|
|
|
|
|||
|
|
|
|
|||
|
|
+-- Members [DomainCount,]
|
|||
|
|
--+----
|
|||
|
|
+-- (DomainSid1) [RidCount,]
|
|||
|
|
| -------+----
|
|||
|
|
| +-- (AccountRid0) [AliasCount,(Alias0Rid, (...), AliasX-1Rid)]
|
|||
|
|
| | (...)
|
|||
|
|
| +-- (AccountRidY) [AliasCount,(Alias0Rid, (...), AliasX-1Rid)]
|
|||
|
|
|
|
|||
|
|
+-- (DomainSid2) [RidCount,]
|
|||
|
|
| ------------
|
|||
|
|
| +-- (AccountRid0) [AliasCount,(Alias0Rid, (...), AliasX-1Rid)]
|
|||
|
|
| | (...)
|
|||
|
|
| +-- (AccountRidZ) [AliasCount,(Alias0Rid, (...), AliasX-1Rid)]
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure under each (UserRid) is as follows:
|
|||
|
|
|
|||
|
|
(UserRid) [Revision,SecurityDescriptor]
|
|||
|
|
+-- V1_Fixed [,SAMP_V1_FIXED_LENGTH_USER]
|
|||
|
|
+-- AccountName [,unicode string]
|
|||
|
|
+-- FullName [,unicode string]
|
|||
|
|
+-- AdminComment [,unicode string]
|
|||
|
|
+-- UserComment [,unicode string]
|
|||
|
|
+-- Parameters [,unicode string]
|
|||
|
|
+-- HomeDirectory [,unicode string]
|
|||
|
|
+-- HomeDirectoryDrive [,unicode string]
|
|||
|
|
+-- ScriptPath [,unicode string]
|
|||
|
|
+-- Workstations [,unicode string]
|
|||
|
|
+-- CaseInsensitiveDbcs [,dbcs string]
|
|||
|
|
+-- CaseSensitiveUnicode [,unicode string]
|
|||
|
|
+-- LmPasswordHistory [,unicode string]
|
|||
|
|
+-- NtPasswordHistory [,unicode string]
|
|||
|
|
+-- LogonHours [See Note On Logon Hours]
|
|||
|
|
+-- ProfilePath [,unicode string]
|
|||
|
|
+-- Groups [Count,(Group0Rid/Attributes, (...), GroupY-1Rid/Attributes)]
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure under each (GroupRid) is as follows:
|
|||
|
|
|
|||
|
|
(GroupRid) [Revision,SecurityDescriptor]
|
|||
|
|
---+-----
|
|||
|
|
+-- V1_Fixed [,SAM_V1_FIXED_LENGTH_GROUP]
|
|||
|
|
+-- Name [,Name]
|
|||
|
|
+-- AdminComment [,unicode string]
|
|||
|
|
+-- Members [Count,(Member0Rid, (...), MemberX-1Rid)]
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure under each (AliasRid) is as follows:
|
|||
|
|
|
|||
|
|
(AliasRid) [Revision,SecurityDescriptor]
|
|||
|
|
---+-----
|
|||
|
|
+-- V1_Fixed [,SAM_V1_FIXED_LENGTH_ADMIN]
|
|||
|
|
+-- Name [,Name]
|
|||
|
|
+-- AdminComment [,unicode string]
|
|||
|
|
+-- Members [Count,(Member0Sid, (...), MemberX-1Sid)]
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
The structure under the Alias\Members key is used for looking up the aliases
|
|||
|
|
an SID is a member of (at logon time). These keys have the following
|
|||
|
|
description:
|
|||
|
|
|
|||
|
|
- keyValueType of Alias\Members - This field contains a count of
|
|||
|
|
domains whose accounts are included as alias members. For
|
|||
|
|
example, if there are three aliases, and these aliases collectively
|
|||
|
|
have the following members:
|
|||
|
|
|
|||
|
|
\MS\SYS\NTDEV\JIMK
|
|||
|
|
\MS\SYS\NTDEV\DAVEC
|
|||
|
|
\MS\SYS\NTDEV\CHADS
|
|||
|
|
\MS\SYS\NTPGM\BOBMU
|
|||
|
|
\MS\EXEC\BILLG
|
|||
|
|
\MS\EXEC\PAULMA
|
|||
|
|
\MS\EXEC\STEVEB
|
|||
|
|
|
|||
|
|
then this represents accounts from 3 domains ("\MS\SYS\NTDEV",
|
|||
|
|
"\MS\SYS\NTPGM", and "\MS\EXEC"). So, the DomainCount would
|
|||
|
|
be three.
|
|||
|
|
|
|||
|
|
- Each Alias\Members\(DomainSid) key - These each have a name representing
|
|||
|
|
the SID of the domains counted in the DomainCount.
|
|||
|
|
|
|||
|
|
- Under each Alias\Members\(DomainSid) key - There is a single key for each
|
|||
|
|
account in that domain that is a member of an alias. The name of these
|
|||
|
|
keys are printable representations of their RIDs. The KeyValueType
|
|||
|
|
field of these keys contains a count of the aliases the SID is a member
|
|||
|
|
of. The KeyValue field contains an array of RIDs of the Aliases that
|
|||
|
|
the SID is a member of.
|
|||
|
|
|
|||
|
|
|
|||
|
|
===============================================================================
|
|||
|
|
|
|||
|
|
Logon Hours are stored as follows:
|
|||
|
|
|
|||
|
|
|
|||
|
|
The KeyValueType is used to store the UnitsPerWeek value.
|
|||
|
|
This value may not exceed SAM_MINUTES_PER_WEEK (10080).
|
|||
|
|
|
|||
|
|
The actual bitmask of legitimate logon times is stored as
|
|||
|
|
the key value. The number of bytes stored is
|
|||
|
|
((KeyValueType + 1) / 8).
|
|||
|
|
|
|||
|
|
If there are no logon time restrictions, the key will have
|
|||
|
|
a KeyValueType of zero and there will be no KeyValue.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
REVISION HISTORY
|
|||
|
|
----------------
|
|||
|
|
|
|||
|
|
Revision 1.0, 3-June-1991, Jim Kelly (JimK)
|
|||
|
|
|
|||
|
|
- Initial implementation
|
|||
|
|
|
|||
|
|
|
|||
|
|
Revision 1.1, 4-Jan-1992, Jim Kelly (JimK)
|
|||
|
|
|
|||
|
|
- Conversion to FlexAdmin model.
|
|||
|
|
|
|||
|
|
- Added all Alias fields. Notice that the members of aliases
|
|||
|
|
are SIDs, not RIDs. This makes alias membership marshalling
|
|||
|
|
much more difficult than for Group objects.
|
|||
|
|
|
|||
|
|
- Drop the following fields:
|
|||
|
|
|
|||
|
|
(UserRid)/LogonServer
|
|||
|
|
|
|||
|
|
- Added the following fields:
|
|||
|
|
|
|||
|
|
(UserRid)/ProfilePath
|