OpenThreadToken function
Applies to: desktop apps only
The OpenThreadToken function opens the access token associated with a thread.
Syntax
BOOL WINAPI OpenThreadToken( __in HANDLE ThreadHandle, __in DWORD DesiredAccess, __in BOOL OpenAsSelf, __out PHANDLE TokenHandle );
Parameters
- ThreadHandle [in]
-
A handle to the thread whose access token is opened.
- DesiredAccess [in]
-
Specifies an access mask that specifies the requested types of access to the access token. These requested access types are reconciled against the token's discretionary access control list (DACL) to determine which accesses are granted or denied.
For a list of access rights for access tokens, see Access Rights for Access-Token Objects.
- OpenAsSelf [in]
-
TRUE if the access check is to be made against the process-level security context.
FALSE if the access check is to be made against the current security context of the thread calling the OpenThreadToken function.
The OpenAsSelf parameter allows the caller of this function to open the access token of a specified thread when the caller is impersonating a token at SecurityIdentification level. Without this parameter, the calling thread cannot open the access token on the specified thread because it is impossible to open executive-level objects by using the SecurityIdentification impersonation level.
- TokenHandle [out]
-
A pointer to a variable that receives the handle to the newly opened access token.
Return value
If the function succeeds, the return value is nonzero.
If the function fails, the return value is zero. To get extended error information, call GetLastError. If the token has the anonymous impersonation level, the token will not be opened and OpenThreadToken sets ERROR_CANT_OPEN_ANONYMOUS as the error.
Remarks
Tokens with the anonymous impersonation level cannot be opened.
Close the access token handle returned through the TokenHandle parameter by calling CloseHandle.
Requirements
|
Minimum supported client | Windows XP |
|---|---|
|
Minimum supported server | Windows Server 2003 |
|
Header |
|
|
Library |
|
|
DLL |
|
See also
- Access Control Overview
- Basic Access Control Functions
- AccessCheck
- AdjustTokenGroups
- AdjustTokenPrivileges
- CloseHandle
- GetTokenInformation
- OpenProcessToken
- SECURITY_IMPERSONATION_LEVEL
- SetThreadToken
- SetTokenInformation
Send comments about this topic to Microsoft
Build date: 3/7/2012
For a 32 bit application running under Windows 7 x64 (other OS's may also have the issue), OpenThreadToken may set the TokenHandle value to NULL (rather than leaving it unaffected, or setting it to INVALID_HANDLE_VALUE). So, if like the ATL code mentioned you're assuming the value of TokenHandle is INVALID_HANDLE_VALUE on a failure case, beware!
- 1/23/2011
- David Lowndes
When the thread is not currently impersonating, the thread will not have any token assigned.
- 3/11/2009
- Christoph Lindemann
- 4/2/2007
- ddaS-edEn
