The GetTokenInformation function retrieves a specified type of information about an access token. The calling process must have appropriate access rights to obtain the information.

To determine if a user is a member of a specific group, use the CheckTokenMembership function.

Syntax

BOOL WINAPI GetTokenInformation(
  __in       HANDLE TokenHandle,
  __in       TOKEN_INFORMATION_CLASS TokenInformationClass,
  __out_opt  LPVOID TokenInformation,
  __in       DWORD TokenInformationLength,
  __out      PDWORD ReturnLength
);

Parameters

TokenHandle [in]

A handle to an access token from which information is retrieved. If TokenInformationClass specifies TokenSource, the handle must have TOKEN_QUERY_SOURCE access. For all other TokenInformationClass values, the handle must have TOKEN_QUERY access.

TokenInformationClass [in]

Specifies a value from the TOKEN_INFORMATION_CLASS enumerated type to identify the type of information the function retrieves.

TokenInformation [out, optional]

A pointer to a buffer the function fills with the requested information. The structure put into this buffer depends upon the type of information specified by the TokenInformationClass parameter, as shown in the following table.

Value	Meaning
NULL	The function returns FALSE and stores the size required for the buffer in ReturnLength. A call to the GetLastError function returns ERROR_INSUFFICIENT_BUFFER. The caller can then allocate a buffer with the required size and pass the address of the buffer as TokenInformation in another call to this function.
TokenDefaultDacl	The buffer receives a TOKEN_DEFAULT_DACL structure containing the default DACL for newly created objects.
TokenGroups	The buffer receives a TOKEN_GROUPS structure containing the group accounts associated with the token.
TokenGroupsAndPrivileges	The buffer receives a TOKEN_GROUPS_AND_PRIVILEGES structure containing the user SID, the group accounts, the restricted SIDs, and the authentication ID associated with the token.
TokenImpersonationLevel	The buffer receives a SECURITY_IMPERSONATION_LEVEL value indicating the impersonation level of the token. If the access token is not an impersonation token, the function fails.
TokenOrigin	The buffer receives a TOKEN_ORIGIN value that contains information about the logon session ID.
TokenOwner	The buffer receives a TOKEN_OWNER structure containing the default owner SID for newly created objects.
TokenPrimaryGroup	The buffer receives a TOKEN_PRIMARY_GROUP structure containing the default primary group SID for newly created objects.
TokenPrivileges	The buffer receives a TOKEN_PRIVILEGES structure containing the token's privileges.
TokenRestrictedSids	The buffer receives a TOKEN_GROUPS structure containing the list of restricting SIDs in a restricted token.
TokenSandBoxInert	The buffer receives a DWORD value that is nonzero if the token includes the SANDBOX_INERT flag.
TokenSessionId	The buffer receives a DWORD value that contains the Terminal Services session identifier associated with the token.
TokenSource	The buffer receives a TOKEN_SOURCE structure containing the source of the token. TOKEN_QUERY_SOURCE access is needed to retrieve this information.
TokenStatistics	The buffer receives a TOKEN_STATISTICS structure containing various token statistics.
TokenType	The buffer receives a TOKEN_TYPE value indicating whether the token is a primary or impersonation token.
TokenUser	The buffer receives a TOKEN_USER structure containing the token's user account.

 

TokenInformationLength [in]

Specifies the size, in bytes, of the buffer pointed to by the TokenInformation parameter. If TokenInformation is NULL, this parameter must be zero.

ReturnLength [out]

A pointer to a variable that receives the number of bytes needed for the buffer pointed to by the TokenInformation parameter. If this value is larger than the value specified in the TokenInformationLength parameter, the function fails and stores no data in the buffer.

If the value of the TokenInformationClass parameter is TokenDefaultDacl and the token has no default DACL, the function sets the variable pointed to by ReturnLength to sizeof(TOKEN_DEFAULT_DACL) and sets the DefaultDacl member of the TOKEN_DEFAULT_DACL structure to NULL.

Return Value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Examples

For an example that uses this function, see Getting the Logon SID or Searching for a SID in an Access Token.

Requirements

See Also

Access Control Overview

Basic Access Control Functions

AdjustTokenGroups

AdjustTokenPrivileges

CheckTokenMembership

OpenProcessToken

OpenThreadToken

SECURITY_IMPERSONATION_LEVEL

SetTokenInformation

TOKEN_DEFAULT_DACL

TOKEN_GROUPS

TOKEN_GROUPS_AND_PRIVILEGES

TOKEN_INFORMATION_CLASS

TOKEN_OWNER

TOKEN_PRIMARY_GROUP

TOKEN_PRIVILEGES

TOKEN_SOURCE

TOKEN_STATISTICS

TOKEN_TYPE

TOKEN_USER

Send comments about this topic to Microsoft

Build date: 6/26/2009