Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

ZwDuplicateToken function

The ZwDuplicateToken function creates a handle to a new access token that duplicates an existing token. This function can create either a primary token or an impersonation token.

Syntax


NTSTATUS ZwDuplicateToken(
  _In_   HANDLE ExistingTokenHandle,
  _In_   ACCESS_MASK DesiredAccess,
  _In_   POBJECT_ATTRIBUTES ObjectAttributes,
  _In_   BOOLEAN EffectiveOnly,
  _In_   TOKEN_TYPE TokenType,
  _Out_  PHANDLE NewTokenHandle
);

Parameters

ExistingTokenHandle [in]

A handle to an existing access token that was opened with the TOKEN_DUPLICATE access right. This parameter is required and cannot be NULL.

DesiredAccess [in]

Bitmask that specifies the requested access rights for the new token. ZwDuplicateToken compares the requested access rights with the existing token's discretionary access control list (DACL) to determine which rights are granted or denied to the new token. To request the same access rights as the existing token, specify zero. To request all access rights that are valid for the caller, specify MAXIMUM_ALLOWED. This parameter is optional and can either be zero, MAXIMUM_ALLOWED, or a bitwise OR combination of one or more of the following values:

ValueMeaning

DELETE

Required to delete the object.

READ_CONTROL

Required to read the DACL and ownership information for the object. For access to the system access control list (SACL), see ACCESS_SYSTEM_SECURITY later in this table.

WRITE_DAC

Required to change the DACL information for the object.

WRITE_OWNER

Required to change the ownership information in the object's security descriptor (SECURITY_DESCRIPTOR).

ACCESS_SYSTEM_SECURITY

Required to get or set the SACL in an object's ACL. The operating system grants this right to the new token only if the SE_SECURITY_NAME privilege is enabled in the access token of the calling thread.

STANDARD_RIGHTS_READ

Currently defined to equal READ_CONTROL.

STANDARD_RIGHTS_WRITE

Currently defined to equal READ_CONTROL.

STANDARD_RIGHTS_EXECUTE

Currently defined to equal READ_CONTROL.

STANDARD_RIGHTS_REQUIRED

Combines DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER access.

STANDARD_RIGHTS_ALL

Combines DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, and SYNCHRONIZE access. However, the SYNCHRONIZE value is not applicable to token objects. Thus, STANDARD_RIGHTS_ALL has a functionally equivalent to STANDARD_RIGHTS_REQUIRED.

TOKEN_ADJUST_DEFAULT

Required to change the default owner, primary group, or DACL of an access token.

TOKEN_ADJUST_GROUPS

Required to adjust the attributes of the groups in an access token.

TOKEN_ADJUST_PRIVILEGES

Required to enable or disable the privileges in an access token.

TOKEN_ADJUST_SESSIONID

Required to adjust the session ID (SID) of an access token. The operating system grants this right to the new token only if the SE_TCB_NAME privilege is enabled in the access token of the calling thread.

TOKEN_ASSIGN_PRIMARY

Required to attach a primary token to a process. The operating system grants this right to the new token only if the SE_ASSIGNPRIMARYTOKEN_NAME privilege is enabled in the access token of the calling thread.

TOKEN_DUPLICATE

Required to duplicate an access token. Note that the given ExistingTokenHandle token must contain this right in order to successfully use this routine.

TOKEN_EXECUTE

Combines STANDARD_RIGHTS_EXECUTE and TOKEN_IMPERSONATE.

TOKEN_IMPERSONATE

Required to attach an impersonation access token to a process.

TOKEN_QUERY

Required to query an access token.

TOKEN_QUERY_SOURCE

Required to query the source of an access token.

TOKEN_READ

Combines STANDARD_RIGHTS_READ and TOKEN_QUERY.

TOKEN_WRITE

Combines STANDARD_RIGHTS_WRITE, TOKEN_ADJUST_PRIVILEGES, TOKEN_ADJUST_GROUPS, and TOKEN_ADJUST_DEFAULT.

TOKEN_ALL_ACCESS

Combines all possible token access permissions for a token.

 

For additional information, see Access Rights for Access-Token Objects in the Microsoft Windows SDK. Note that access tokens do not support the SYNCHRONIZE right.

ObjectAttributes [in]

Pointer to an OBJECT_ATTRIBUTES structure that describes the requested properties for the new token. The ObjectAttributes parameter is optional and can be NULL. If the ObjectAttributes parameter is NULL or if the SecurityDescriptor member of the structure pointed to by the ObjectAttributes parameter is NULL, the new token receives a default security descriptor and the new token handle cannot be inherited. In that case, this default security descriptor is created from the user group, primary group, and DACL information that is stored in the caller's token.

When the TokenType parameter is set to TokenImpersonation:

  • The ObjectAttributes parameter may be used to specify the impersonation level of the new token. This can be accomplished by setting ObjectAttributes->SecurityQualityOfService.ImpersonationLevel to an appropriate SECURITY_IMPERSONATION_LEVEL enumeration value. For more information, see SECURITY_QUALITY_OF_SERVICE in the Microsoft Windows SDK documentation.

  • If the existing token is an impersonation token and the ObjectAttributes parameter provides no impersonation information, the new token's impersonation level is set to the existing token's impersonation level.

  • If the existing token is a primary token and no impersonation level information is provided, the new impersonation token will have a SECURITY_IMPERSONATION_LEVEL impersonation level.

EffectiveOnly [in]

A Boolean value that indicates whether the entire existing token should be duplicated into the new token or just the effective (currently enabled) part of the token. If set to TRUE, only the currently enabled parts of the source token will be duplicated. If set to FALSE, the entire existing token will be duplicated. This provides a means for a caller of a protected subsystem to limit which optional groups and privileges are made available to the protected subsystem. For example, if EffectiveOnly is TRUE, the caller could duplicate a token but remove the Administrators group and the SeTcbPrivilege right. The resulting token could then be passed to a child process (CreateProcessAsUser), which would restrict what the child process can do. This parameter is required.

TokenType [in]

Specifies one of the following values from the TOKEN_TYPE enumeration.

ValueMeaning

TokenPrimary

The new token is a primary token. If the existing token is an impersonation token, the existing impersonation token must have an impersonation level (as provided by the ObjectAttributes parameter) of SecurityImpersonation or SecurityDelegation. Otherwise, ZwDuplicateToken returns STATUS_BAD_IMPERSONATION_LEVEL is returned.

TokenImpersonation

The new token is an impersonation token. If the existing token is an impersonation token, the requested impersonation level (as provided by the ObjectAttributes parameter) of the new token must not be greater than the impersonation level of the existing token. Otherwise, ZwDuplicateToken returns STATUS_BAD_IMPERSONATION_LEVEL.

 

The TokenType parameter is required and cannot be NULL.

NewTokenHandle [out]

A pointer to a caller-allocated variable, of type HANDLE, that receives a handle to the new token. This parameter is required and cannot be NULL.

Return value

ZwDuplicateToken returns STATUS_SUCCESS if the call is successfull. Possible error return codes include the following:

Return codeDescription
STATUS_ACCESS_VIOLATION

A memory access violation occurred. For example, if the previous mode was user-mode and invalid user-mode memory was provided, ZwDuplicateToken returns STATUS_ACCESS_VIOLATION.

STATUS_INSUFFICIENT_RESOURCES

Sufficient memory could not be allocated to duplicate the new token.

STATUS_INVALID_PARAMETER

An invalid parameter was detected.

STATUS_BAD_IMPERSONATION_LEVEL

The requested impersonation level for the new token is greater than the impersonation level of the existing token.

STATUS_ACCESS_DENIED

ZwDuplicateToken returns STATUS_ACCESS_DENIED if it couldn't access ExistingTokenHandle. This would occur if the existing token does not have the TOKEN_DUPLICATE access right.

STATUS_INVALID_HANDLE

ZwDuplicateToken returns STATUS_INVALID_HANDLE if ExistingTokenHandle refers to an invalid handle.

 

Remarks

If no impersonation level information was provided by the ObjectAttributes parameter, the existing token's impersonation level will be used for the new token.

With regard to the structure pointed to by the optional ObjectAttributes parameter, the SecurityQualityOfService member of OBJECT_ATTRIBUTES points to a structure of type SECURITY_QUALITY_OF_SERVICE. See SECURITY_QUALITY_OF_SERVICE in the Microsoft Windows SDK documentation for information on the members of this structure.

Note   The SecurityQualityOfService member must be set after calling the InitializeObjectAttributes macro because InitializeObjectAttributes currently sets SecurityQualityOfService to NULL.

For information on the user-mode analog of ZwDuplicateToken, see DuplicateTokenEx in the Windows SDK documentation.

When you have finished using the new token, call the ZwClose function to close the token handle.

Note  If the call to the ZwDuplicateToken function occurs in user mode, you should use the name "NtDuplicateToken" instead of "ZwDuplicateToken".

Requirements

Version

Available starting with Windows 2000.

Header

Ntifs.h (include Ntifs.h or FltKernel.h)

Library

Ntoskrnl.lib

IRQL

PASSIVE_LEVEL

DDI compliance rules

PowerIrpDDis, HwStorPortProhibitedDDIs

See also

ACCESS_MASK
InitializeObjectAttributes
OBJECT_ATTRIBUTES
SECURITY_IMPERSONATION_LEVEL

 

 

Send comments about this topic to Microsoft

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.