Lists available security packages and their capabilities.

Retrieves a pointer to a security support provider (SSP) dispatch table.

Retrieves information about a specified security package. This information includes the bounds on sizes of authentication information, credentials, and contexts.

Acquires a handle to the preexisting credentials of a specified principal.

Exports a security context into a context buffer.

Releases a credential handle and associated resources.

Imports a security context exported by using ExportSecurityContext into the current process.

Retrieves the attributes of a credential, such as the name associated with the credential.

Used by a server to create a security context based on an opaque message received from a client.

Applies a supplemental security message to an existing security context.

Completes an authentication token. This function is used by protocols, such as DCE, that need to revise the security information after the transport application has updated some message parameters.

Frees a security context and associated resources.

Frees a memory buffer allocated by a security package.

Impersonates the security context to appear as the client to the system.

Used by a client to initiate a security context by generating an opaque message to be passed to a server.

Enables a transport application to query a security package for certain attributes of a security context.

Obtains the access token for a client security context and uses it directly.

Enables a transport application to set attributes of a security context for a security package. This function is supported only by the Schannel security package.

Allows a security package to discontinue the impersonation of the caller and restore its own security context.

Decrypts an encrypted message by using the session key from a security context.

Encrypts a message by using the session key from a security context.

Generates a cryptographic checksum of the message, and also includes sequencing information to prevent message loss or insertion.

Verifies the signature of a message received that was signed by the sender by using the MakeSignature function.

Called by the Local Security Authority (LSA) when a logon application with a trusted connection to the LSA calls the LsaCallAuthenticationPackage function and specifies the authentication package's identifier.

The dispatch function for pass-through logon requests sent to the LsaCallAuthenticationPackage function.

Called by the Local Security Authority (LSA) when an application with an untrusted connection to the LSA calls the LsaCallAuthenticationPackage function and specifies the authentication package's identifier.

Called once by the Local Security Authority (LSA) during system initialization to provide the authentication package a chance to initialize itself.

Used to notify an authentication package when a logon session terminates. A logon session terminates when the last token referencing the logon session is deleted.

Authenticates a user's logon credentials.

Authenticates a user's logon credentials.

Used to authenticate a user logon attempt on the user's initial logon. A new logon session is established for the user, and validation information for the user is returned.

Called by the Local Security Authority (LSA) to pass the security package any credentials stored for the authenticated security principal.

Server dispatch function used to create a security context shared by a server and client.

Called to obtain a handle to a principal's credentials.

Used to add credentials for a security principal.

Applies a control token to a security context. This function is not currently called by the Local Security Authority (LSA).

Deletes a security context.

Deletes credentials from a security package's list of primary or supplemental credentials.

Frees credentials acquired by calling the SpAcquireCredentialsHandle function.

Provides extended information about a security package.

Provides general information about the security package, such as its name and capabilities.

Retrieves information about a logon session.

Is called once by the Local Security Authority (LSA) to provide a security package with general security information and a dispatch table of support functions.

The client dispatch function used to establish a security context between a server and client.

Retrieves the attributes of a security context.

Retrieves the attributes for a credential.

Saves a supplemental credential to the user object.

Sets extended information about the security package.

Performs any cleanup required before the SSP/AP is unloaded.

Returns an X509Certificate structure with the information contained in the specified certificate BLOB.

Removes the specified string from the Schannel cache.

Frees a certificate that was allocated by a previous call to the SslCrackCertificate function.

Completes an authentication token.

Implements the SSPI CompleteAuthToken function.

Deletes a security context.

Implements the SSPI DeleteSecurityContext function.

Exports a security context to another process.

Implements the SSPI ExportSecurityContext function.

Formats credentials to be stored in a user object.

Obtains the token to impersonate.

Used by the SSPI ImpersonateSecurityContext function.

Imports a security context from another process.

Implements the SSPI ImportSecurityContext function.

Creates a user-mode security context from a packed Local Security Authority (LSA)-mode context.

Initializes user-mode security packages in an SSP/AP.

Generates a signature based on the specified message and security context.

Implements the SSPI MakeSignature function.

Converts supplemental credentials from a public format into a format suitable for local procedure calls.

Retrieves the attributes of a security context.

Implements the SSPI QueryContextAttributes (General) function.

Encrypts a message exchanged between a client and server.

Implements the SSPI EncryptMessage (General) function.

Decrypts a message that was previously encrypted with the SpSealMessage function.

Implements the SSPI DecryptMessage (General) function.

Called when a security support provider/authentication package (SSP/AP) DLL is loaded into the process space of a client/server application. This function provides the SECPKG_USER_FUNCTION_TABLE tables for each security package in the SSP/AP DLL.

Verifies that the message received is correct according to the signature.

Implements the SSPI VerifySignature function.

Adds user credentials.

Allocates memory in the address space of the package's client.

Allocates memory on the heap. Some information passed back to the LSA is expected to be allocated using this function.

Copies information from the address space of a client process into a buffer in the current process.

Copies information from a buffer in the current process into a client process's address space.

Creates logon sessions.

Deletes user credentials.

Deletes an LSA logon session.

Frees memory in the address space of the package's client.

Deallocates heap memory previously allocated by AllocateLsaHeap.

Retrieves credentials associated with a logon session.

Allocates a section of shared memory.

Creates audit records for attempted logons.

Creates an audit trail for a logon session.

Calls a package.

Calls another package.

Calls one security package from another.

Cancels notification for special events.

Allows a security package to invoke a function in the client process.

For a ClientCallback function prototype, see ClientCallback Function Prototype.

Closes a handle to a Security Accounts Manager database entry.

Converts authorization data to a user token.

Converts a name from one format to another.

Creates a section of memory shared between clients and the SSP/AP.

Creates a new thread.

Creates a token.

Deletes a section of shared memory.

Duplicates a handle.

Frees a buffer allocated by the LSA.

Frees a section of shared memory.

Retrieves authorization data for a user account.

Retrieves information about the most recent function call.

Retrieves information about the security package's user process.

Returns the authorization data for a user.

Lets a security package impersonate its client.

Maps a SecBuffer structure into the address space of the security support provider/authentication package (SSP/AP).

Retrieves a handle to a user account in the Security Accounts Manager (SAM) database.

Provides a mechanism whereby the security package is notified. Notification can occur at fixed intervals, when an event object is signaled, or during certain system events.

Obsolete. Do not use.

Unloads an security support provider/authentication package (SSP/AP).

Provides a mechanism for one security package to notify other packages that the credentials for a logon session have changed.

Allocates memory for buffers that are returned to the Local Security Authority (LSA).

Frees memory that was previously allocated by using AllocateHeap.

Registers user-mode callback functions.

Activates the user shell program.

Allows the GINA to display information about the lock, such as who locked the workstation and when it was locked.

Winlogon calls this function when no user is logged on.

Winlogon calls this function when the GINA DLL should display a message.

Winlogon calls this function to read the currently logged on user's credentials to transparently transfer them to a target session.

Winlogon calls this function to get the status message being displayed by the GINA DLL.

Winlogon calls this function once for each window station present on the computer. Currently, the operating system supports one window station per workstation.

Winlogon calls this function before attempting to lock the workstation.

Winlogon calls this function when the user initiates a logoff operation.

Winlogon calls this function when it receives a secure attention sequence (SAS) event while the user is logged on and the workstation is not locked.

Winlogon calls this function when it receives a secure attention sequence (SAS) event while no user is logged on.

Winlogon calls this function to notify the GINA of a logoff operation on this workstation, allowing the GINA to perform any logoff operations that may be required.

The WlxNegotiate function must be implemented by a replacement GINA DLL. This is the first call made by Winlogon to the GINA DLL. WlxNegotiate allows the GINA to verify that it supports the installed version of Winlogon.

Winlogon calls this function to collect valid authentication and identification information.

Winlogon calls this function to tell the GINA DLL to stop displaying the status message.

Winlogon calls this function immediately before a screen saver is activated, allowing the GINA to interact with the screen saver program.

Winlogon calls this function just before shutting down, allowing the GINA to perform any shutdown tasks, such as ejecting a smart card from a reader.

Winlogon calls this function when the system needs an application to be started in the context of the user.

Winlogon calls this function when it receives a secure attention sequence (SAS) and the workstation is locked.

Attempts to log a user on to the local computer.

Attempts to log a user on to the local computer. This function is an extended version of the LogonUser function and retrieves information about the logged-on user's security identifier (SID), profile, and quota limits.

The LogonUserExExW function attempts to log a user on to the local computer. This function is not declared in a public header and has no associated import library. You must use the LoadLibrary and GetProcAddress functions to dynamically link to Advapi32.dll.

Called by GINA to assign protection to the shell program of a newly logged-on user.

Called by GINA to indicate it has changed a password.

Called by GINA to tell a specific network provider (or all network providers) that a password has changed.

Called by GINA to close an alternate user desktop and clean up after the desktop is closed.

Called by GINA to create alternate application desktops for the user.

Called by the GINA to create a modal dialog box from a dialog box template.

Called by GINA to create a modal dialog box from a dialog box template in memory.

Called by GINA to initialize dialog box controls and then create a modal dialog box from a dialog box template in memory.

Called by GINA to initialize dialog box controls and then create a modal dialog box from a dialog box template resource.

Called by a replacement GINA DLL if Terminal Services is enabled. GINA calls this function to disconnect from a Terminal Services network session.

Called by GINA to retrieve the current value of an option.

Called by GINA to determine the name and handle of the desktop that was current before Winlogon switched to the Winlogon desktop.

Called by GINA to create, display, and operate a message box.

Called by a replacement GINA DLL if Terminal Services is enabled. GINA calls this function to retrieve the credentials of remote Terminal Services clients that are not using an Internet connector license.

Called by GINA to read the credentials transferred from the Winlogon of the temporary session to the Winlogon of the destination session.

Called by a replacement GINA DLL if Terminal Services is enabled. GINA calls this function to determine whether the terminal server is using Internet connector licensing and to retrieve credentials information.

Called by GINA to retrieve Terminal Services user configuration information after a user has logged on.

Called by GINA to notify Winlogon of a secure attention sequence (SAS) event.

Called by GINA to specify the context pointer passed by Winlogon as the first parameter to all future calls to GINA functions.

Called by GINA to set the value of an option.

Called by GINA to specify the alternate application desktop that Winlogon will switch to when the current secure attention sequence (SAS) event processing function is complete.

Called by GINA to change the time-out associated with a dialog box. The default time-out is two minutes.

Called by GINA to switch to the application desktop.

Lets the GINA DLL switch to the Winlogon desktop.

Called by GINA to tell Winlogon to use the standard CTRL+ALT+DEL key combination as a secure attention sequence (SAS).

Called by a replacement GINA DLL if Terminal Services is enabled. GINA calls this function to complete the setup of the Terminal Services client.

Details functions that can be implemented by network providers.

Details a function that is implemented by the operating system and can be called by network providers.

Details functions that are implemented by applications that need to receive notification from the Multiple Provider Router (MPR) when a network resource is connected or disconnected.

Connects a local device to a network resource.

Connects a local device to a network resource.

Disconnects a network connection.

Closes an enumeration.

Specifies the parent window of a device. This window owns any dialog boxes that originate from the device.

Notifies the network provider of certain directory operations.

Performs an enumeration based on a handle returned by NPOpenEnum.

Formats a network name in a provider-specific format for display in a control.

Returns information about which services are supported on the network.

Retrieves information about a connection.

Retrieves information about a network connection, even if it is currently disconnected.

Returns information about the expected performance of a connection used to access a network resource. The request can only be for a network resource that is currently connected.

Determines the type of a network directory.

Retrieves the names of buttons to add to a property dialog box for a network resource.

Separates the part of a network resource accessed through the WNet API from the part accessed through APIs specific to the resource type.

Retrieves the parent of a specified network resource in the browse hierarchy.

Retrieves the universal name of a network resource. The NPGetUniversalName function can retrieve this universal name in UNC format or in the older, remote-name format.

Retrieves the value of the current default user name or the user name used to establish a network connection.

Opens an enumeration of network resources or existing connections. The NPOpenEnum function must be called to obtain a valid handle for an enumeration.

Called when the user clicks a button added by using the NPPropertyDialog function. The NPPropertyDialog function is called only for file and directory network properties.

Enables network vendors to supply their own form of browsing and search, beyond the hierarchical view presented in the Connection dialog box.

Sets extended error information. Network providers should call this function instead of SetLastError.

Called before and after each add connection operation (WNetAddConnection, WNetAddConnection2, and WNetAddConnection3).

Called before and after each cancel connection operation (WNetCancelConnection or WNetCancelConnection2).

Requests a package-specific service from an authentication package.

Establishes an untrusted connection to the LSA.

Disconnects from the LSA and frees resources allocated to the caller's context.

Retrieves locally unique identifiers (LUIDs) for existing logon sessions.

Frees memory allocated for a buffer returned to a caller.

Retrieves information about a specified logon session.

Authenticates user logon data against stored credentials. If successful, it creates a new logon session and returns a user token.

Obtains the unique identifier of an authentication package.

Retrieves domain information from the Policy object.

Retrieves forest trust information for the specified Local Security Authority TrustedDomain object.

Establishes a connection to the LSA server and verifies that the caller is a logon application.

Sets domain information to the Policy object.

sets the forest trust information for a specified Local Security Authority TrustedDomain object.

Called when the authentication package's identifier has been specified in a call to LsaCallAuthenticationPackage by an application that is using a trusted connection.

This function provides a way for logon applications to communicate directly with authentication packages.

Called when the authentication package's identifier has been specified in a call to LsaCallAuthenticationPackage for a pass-through logon request.

Called when the authentication package's identifier has been specified in a call to LsaCallAuthenticationPackage by an application using an untrusted connection. This function is used for communicating with processes that do not have the SeTcbPrivilege privilege.

Called during system initialization to permit the authentication package to perform initialization tasks.

Called when a logon session ends to permit the authentication package to free any resources allocated for the logon session.

Called when the authentication package has been specified in a call to LsaLogonUser. This function authenticates a security principal's logon data.

Identical to LsaApLogonUser except that it returns the workstation name for audit purposes.

An authentication package can implement LsaApLogonUser, LsaApLogonUserEx, or LsaApLogonUserEx2. It does not need to implement them all.

Identical to LsaApLogonUserEx except that it returns the security principal's primary and supplemental credentials. An authentication package can implement LsaApLogonUser, LsaApLogonUserEx, or LsaApLogonUserEx2. It does not need to implement them all.

Adds credentials to a logon session.

Allocates a buffer in the client's address space.

Allocates buffers that must be returned from the authentication package to the LSA.

Copies the contents of a buffer in the client's address space into a local buffer.

Copies the contents of a local buffer into the client's address space.

Used by authentication packages to create a logon session.

Deletes an existing credential.

Cleans up any logon sessions created while determining whether a user's authentication information is legitimate.

Frees a client buffer previously allocated with the AllocateClientBuffer function.

Frees buffers previously allocated by using the AllocateLsaHeap function.

Retrieves credentials previously cached by AddCredential.

Performs user logon authentication that is specific to domain controllers.

Performs client/server-specific authentication.

Details functions used for credentials management UI.

Details functions used for low-level credentials management.

Details functions that are implemented by credential managers to receive notifications when authentication information changes.

Prompt for and accept user credentials information from a user working in a command-line program.

Confirm the validity of credentials returned by CredUIPromptForCredentials or CredUICmdLinePromptForCredentials.

Extract the domain and user account name from a fully qualified user name.

Display a dialog box that accepts credentials information from a user.

Creates and displays a configurable dialog box that allows users to supply credential information by using any credential provider installed on the local computer.

Retrieves the user name for a single logon credential.

Stores a single logon credential.

Delete a credential from a user's credentials set.

List the credentials in a user's credentials set.

Searches the Credentials Management (CredMan) database for the set of generic credentials that are associated with the current logon session and that best match the specified target resource.

Free the memory used for a buffer returned by any of the credentials management functions.

Retrieve the maximum persistence supported by the current logon session.

Retrieve all known target name information for a named resource.

Determines whether a specified user name string is a marshaled credential previously marshaled by CredMarshalCredential.

Specifies whether the specified credentials are encrypted by a previous call to the CredProtect function.

Transform a credential into a text string.

Converts a string user name and password into an authentication buffer.

Encrypts the specified credentials so that only the current security context can decrypt them.

Read a credential from a user's credentials set.

Read the domain credentials from a user's credentials set.

Rename a credential from a user's credentials set.

Transform a marshaled credential string back into its nonmarshaled form.

Converts an authentication buffer returned by a call to the CredUIPromptForWindowsCredentials function into a string user name and password.

Decrypts credentials that were previously encrypted by using the CredProtect function.

Create a new credential or modify an existing credential in a user's credentials set.

Write domain credentials to a user's credentials set.

MPR calls this function to notify the credential manager that a logon event has occurred, allowing the credential manager to return a logon script.

MPR calls this function to notify the credential manager of a password change event.

Replaced by SCardUIDlgSelectCard, which displays the smart card Select Card dialog box.

Adds a security support provider to the list of providers supported by Microsoft Negotiate.

Changes the password for a Windows domain account by using the specified Security Support Provider.

Serializes the specified target into an array of byte values.

Deletes a security support provider from the list of providers supported by Microsoft Negotiate.

Opens a handle to the Policy object on a local or remote system.

Retrieves information about a Policy object.

Modifies information in a Policy object.

Enables network vendors to supply their own permission editor dialog boxes.

Retrieves the capabilities of the permission editor. The return value is a bitmask that indicates which of the Security menu items in File Manager are to be enabled.

Retrieves the help file and help context of the permission editor dialog boxes when a menu item in the Security menu of File Manager is selected and F1 is pressed.

Retrieves context information from a credential provider.

Provides the LSA with pointers to the functions implemented by each security package in the SSP/AP DLL.

Gets metadata from a security support provider (SSP) when it is initiating a security context.

Updates the credentials associated with the specified context.

Compares the two specified credentials.

Creates a copy of the specified opaque credential structure.

Decrypts the specified encrypted credential.

Encodes the specified authentication identity as three strings.

Encodes a set of three credential strings as an authentication identity structure.

Encrypts the specified identity structure.

Creates a new identity structure that is a copy of the specified identity structure modified to exclude the specified security support provider (SSP).

Frees the memory allocated for the specified identity structure.

Retrieves context information from a credential provider.

Gets the host name associated with the specified target.

Indicates whether the specified identity structure is encrypted.

Indicates whether an error returned after a call to either the InitializeSecurityContext or the AcceptSecurityContext function requires an additional call to the SspiPromptForCredentials function.

Frees the memory associated with the specified buffer.

Serializes the specified identity structure into a byte array.

Generates a target name and credential type from the specified identity structure.

Generates values from an identity structure that can be passed as the values of parameters in a call to the CredWrite function.

Allows a Security Support Provider Interface (SSPI) application to prompt a user to enter credentials.

Deserializes the specified array of byte values into an identity structure.

Deserializes credential information obtained by a credential provider during a previous call to the ICredentialProvider::SetSerialization method.

Updates the credentials associated with the specified context.

Indicates whether the specified identity structure is valid.

Fills the block of memory associated with the specified identity structure with zeros.

Called by a replacement GINA DLL to retrieve credentials information if Terminal Services is enabled. The GINA DLL can then use this information to fill in a logon box automatically and attempt to log the user in.