3.7.4.1.23 RpcWinStationGetProcessSid (Opnum 44)

The RpcWinStationGetProcessSid method retrieves the process security identifier (SID), as specified in [MS-DTYP] section 2.4.2, for a given process ID and process start time combination.<191>The caller MUST have the PROCESS_QUERY_INFORMATION access right to the process being queried and the TOKEN_QUERY access right to the access token associated with the process. For more information on the process access rights, see [MSDN-PROCRIGHTS]. For more information on access rights for access tokens, see [MSDN-TOKENRIGHTS].

 BOOLEAN RpcWinStationGetProcessSid(
   [in] SERVER_HANDLE hServer,
   [in] DWORD dwUniqueProcessId,
   [in] LARGE_INTEGER ProcessStartTime,
   [out] LONG* pResult,
   [in, out, unique, size_is(dwSidSize)] 
     PBYTE pProcessUserSid,
   [in, range(0, 1024 )] DWORD dwSidSize,
   [in, out] DWORD* pdwSizeNeeded
 );

hServer: Handle to the server object. This is of type SERVER_HANDLE. The hServer argument MUST be obtained from a previous call to RpcWinStationOpenServer.

dwUniqueProcessId:  The process ID to retrieve the SID.

ProcessStartTime:  The start time of the process indicated by dwUniqueProcessId. This is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). ProcessStartTime combined with dwUniqueProcessId is used to identify a process.

pResult:  Failure error code if the call to RpcWinStationGetProcessSid failed. If the call was successful, this parameter MUST be STATUS_SUCCESS (0x00000000).

Value	Meaning
STATUS_SUCCESS 0x00000000	The call succeeded.
0x8007007A	The size of pProcessUserSid buffer is too small.<192>
STATUS_BUFFER_TOO_SMALL 0xC0000023	The size of pProcessUserSid buffer is too small.<193>
0x80070005	The caller does not have necessary permissions.<194>
STATUS_ACCESS_DENIED 0xC0000022	The caller does not have necessary permissions.<195>

pProcessUserSid:  The buffer into which the method MUST copy the SID of the process. MUST be NULL if dwSidSize is zero, in which case the correct size will be returned in pdwSizeNeeded.

dwSidSize:  The size of the buffer, in bytes, pointed to by pProcessUserSid. If the buffer is too small, STATUS_BUFFER_TOO_SMALL<196> or 0x8007007A<197> is returned in pResult.

pdwSizeNeeded:  Indicates the length of the SID. If STATUS_BUFFER_TOO_SMALL<198> or 0x8007007A<199> is returned in pResult, this indicates to the caller the correct size to allocate to a buffer prior to calling the method again.

Return Values:  Returns TRUE if the call succeeded, and FALSE if the method failed. On failure, pResult indicates the failure status code.

Return value/code	Description
0x01 TRUE	Successful completion.
0x00 FALSE	Method call failed.