Determining client privileges

To determine access rights, the client access token is retrieved from the RPC transport, as described for RpcImpersonationAccessToken in [MS-RPCE] section

Method Access Control Algorithm: During processing of methods that implement access checks, the server implementing this protocol SHOULD perform access security verification on the client's identity, using the algorithm specified by the Access Check Algorithm Pseudo code ([MS-DTYP] section For this protocol, the input parameters of that algorithm are mapped as follows:

  • SecurityDescriptor: This MUST be the NetlogonSecurityDescriptor ADM element.

  • Token / Authorization Context: This MUST be the identity of the client from the ADM element RpcImpersonationAccessToken, retrieved as specified in [MS-RPCE] section

  • Access Request mask: This is specified by each method's processing logic and MUST be one or more of the Access Rights specified previously in section

  • Object Tree: This parameter MUST be NULL.

  • PrincipalSelfSubst SID: This parameter MUST be NULL.