22.214.171.124 EvtRpcGetPublisherList(Opnum 22)
The EvtRpcGetPublisherList (Opnum 22) method is used by a client to get the list of publishers.
error_status_t EvtRpcGetPublisherList( [in] RPC_BINDING_HANDLE binding, [in] DWORD flags, [out] DWORD* numPublisherIds, [out, size_is(,*numPublisherIds), range(0, MAX_RPC_PUBLISHER_COUNT), string] LPWSTR** publisherIds );
binding: An RPC binding handle as specified in section 2.2.21.
flags: A 32-bit unsigned integer that MUST be set to zero when sent and MAY be ignored on receipt.<42>
numPublisherIds: A pointer to a 32-bit unsigned integer that contains the number of publisher names.
publisherIds: A pointer to an array of strings that contain publisher names.
Return Values: The method MUST return ERROR_SUCCESS (0x00000000) on success; otherwise, it MUST return an implementation-specific nonzero value as specified in [MS-ERREF].
In response to this request from the client, the server MUST verify that the caller has read access to the publisher table and MUST fail the method with the error ERROR_ACCESS_DENIED (0x00000005) if the caller does not have read access. To perform the access check, the server SHOULD first determine the identity of the caller. Information determining the identity of the caller for the purpose of performing an access check is specified in [MS-RPCE] section 126.96.36.199.2. Then the server MAY get the security descriptor of the publisher table. The server MAY assign a security descriptor when the publisher table is created or if the publisher table is built on the server's file system, it can get its security descriptor from the file system.<43> Next, the server SHOULD be able to perform the read access check using the Access Check algorithm (as specified in [MS-DTYP] section 188.8.131.52).
If the above check succeeds, the server MUST go to its publisher table and read all the publisher names and use the results to fill the publisherIds parameter. The server MUST also set the numberPublisherIds parameter value to be the number of the publisher names it returns. The server SHOULD only fail if it has inadequate memory to allocate for the publisherIds parameter to copy all the publisher names from its publisher table into the buffer that is pointed to by publisherIds. In that case, the server SHOULD return ERROR_OUTOFMEMORY (0x0000000E).
The server MUST return a value indicating success or failure for this operation.