text:  
  /*++
  
  Copyright (c) 1997-1998  Microsoft Corporation
  
  Module Name:
  
      sddl.w
  
  Abstract:
  
      This module defines the support and conversions routines necessary for SDDL.
  
  Revision History:
  
  --*/
  
  #ifdef _MSC_VER
  #pragma once
  #endif // _MSC_VER
  
  #ifndef __SDDL_H__
  #define __SDDL_H__
  
  #include <apiset.h>
  #include <apisetcconv.h>
  
  #ifdef _CONTRACT_GEN
  #include <nt.h>
  #include <ntrtl.h>
  #include <minwindef.h>
  #endif
  
  /* APISET_NAME: api-ms-win-security-sddl-l1 */
  
  #ifndef _APISET_SDDL_VER
  #ifdef _APISET_MINWIN_VERSION
  #if _APISET_MINWIN_VERSION >= 0x0100
  #define _APISET_SDDL_VER 0x0100
  #endif
  #endif // _APISET_MINWIN_VERSION
  #endif // _APISET_SDDL_VER
  
  
  #ifdef __cplusplus
  extern "C" {
  #endif
  
  #pragma region Desktop Family
  
  #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
  
  //
  // SDDL Version information
  //
  #define SDDL_REVISION_1     1
  #define SDDL_REVISION       SDDL_REVISION_1
  
  //
  // SDDL Component tags
  //
  #define SDDL_OWNER                          TEXT("O")       // Owner tag
  #define SDDL_GROUP                          TEXT("G")       // Group tag
  #define SDDL_DACL                           TEXT("D")       // DACL tag
  #define SDDL_SACL                           TEXT("S")       // SACL tag
  
  //
  // SDDL Security descriptor controls
  //
  #define SDDL_PROTECTED                      TEXT("P")       // DACL or SACL Protected
  #define SDDL_AUTO_INHERIT_REQ               TEXT("AR")      // Auto inherit request
  #define SDDL_AUTO_INHERITED                 TEXT("AI")      // DACL/SACL are auto inherited
  #define SDDL_NULL_ACL                       TEXT("NO_ACCESS_CONTROL")    // Null ACL
  
  //
  // SDDL Ace types
  //
  #define SDDL_ACCESS_ALLOWED                 TEXT("A")   // Access allowed
  #define SDDL_ACCESS_DENIED                  TEXT("D")   // Access denied
  #define SDDL_OBJECT_ACCESS_ALLOWED          TEXT("OA")  // Object access allowed
  #define SDDL_OBJECT_ACCESS_DENIED           TEXT("OD")  // Object access denied
  #define SDDL_AUDIT                          TEXT("AU")  // Audit
  #define SDDL_ALARM                          TEXT("AL")  // Alarm
  #define SDDL_OBJECT_AUDIT                   TEXT("OU")  // Object audit
  #define SDDL_OBJECT_ALARM                   TEXT("OL")  // Object alarm
  #define SDDL_MANDATORY_LABEL                TEXT("ML")  // Integrity label
  #define SDDL_CALLBACK_ACCESS_ALLOWED        TEXT("XA")  // Callback access allowed
  #define SDDL_CALLBACK_ACCESS_DENIED         TEXT("XD")  // Callback access denied
  #define SDDL_RESOURCE_ATTRIBUTE             TEXT("RA")  // Resource attribute
  #define SDDL_SCOPED_POLICY_ID               TEXT("SP")  // Scoped policy
  #define SDDL_CALLBACK_AUDIT                 TEXT("XU")  // Callback audit
  #define SDDL_CALLBACK_OBJECT_ACCESS_ALLOWED TEXT("ZA")  // Callback object access allowed
  
  
  //
  // SDDL Resource attribute ace data types
  //
  
  #define SDDL_INT                            TEXT("TI")   // Signed integer
  #define SDDL_UINT                           TEXT("TU")   // Unsigned integer
  #define SDDL_WSTRING                        TEXT("TS")   // Wide string
  #define SDDL_SID                            TEXT("TD")   // SID
  #define SDDL_BLOB                           TEXT("TX")   // Octet String
  #define SDDL_BOOLEAN                        TEXT("TB")   // Boolean
  
  
  //
  // SDDL Ace flags
  //
  #define SDDL_CONTAINER_INHERIT              TEXT("CI")  // Container inherit
  #define SDDL_OBJECT_INHERIT                 TEXT("OI")  // Object inherit
  #define SDDL_NO_PROPAGATE                   TEXT("NP")  // Inherit no propagate
  #define SDDL_INHERIT_ONLY                   TEXT("IO")  // Inherit only
  #define SDDL_INHERITED                      TEXT("ID")  // Inherited
  #define SDDL_AUDIT_SUCCESS                  TEXT("SA")  // Audit success
  #define SDDL_AUDIT_FAILURE                  TEXT("FA")  // Audit failure
  
  
  //
  // SDDL Rights
  //
  #define SDDL_READ_PROPERTY                  TEXT("RP")
  #define SDDL_WRITE_PROPERTY                 TEXT("WP")
  #define SDDL_CREATE_CHILD                   TEXT("CC")
  #define SDDL_DELETE_CHILD                   TEXT("DC")
  #define SDDL_LIST_CHILDREN                  TEXT("LC")
  #define SDDL_SELF_WRITE                     TEXT("SW")
  #define SDDL_LIST_OBJECT                    TEXT("LO")
  #define SDDL_DELETE_TREE                    TEXT("DT")
  #define SDDL_CONTROL_ACCESS                 TEXT("CR")
  #define SDDL_READ_CONTROL                   TEXT("RC")
  #define SDDL_WRITE_DAC                      TEXT("WD")
  #define SDDL_WRITE_OWNER                    TEXT("WO")
  #define SDDL_STANDARD_DELETE                TEXT("SD")
  #define SDDL_GENERIC_ALL                    TEXT("GA")
  #define SDDL_GENERIC_READ                   TEXT("GR")
  #define SDDL_GENERIC_WRITE                  TEXT("GW")
  #define SDDL_GENERIC_EXECUTE                TEXT("GX")
  #define SDDL_FILE_ALL                       TEXT("FA")
  #define SDDL_FILE_READ                      TEXT("FR")
  #define SDDL_FILE_WRITE                     TEXT("FW")
  #define SDDL_FILE_EXECUTE                   TEXT("FX")
  #define SDDL_KEY_ALL                        TEXT("KA")
  #define SDDL_KEY_READ                       TEXT("KR")
  #define SDDL_KEY_WRITE                      TEXT("KW")
  #define SDDL_KEY_EXECUTE                    TEXT("KX")
  #define SDDL_NO_WRITE_UP                    TEXT("NW")
  #define SDDL_NO_READ_UP                     TEXT("NR")
  #define SDDL_NO_EXECUTE_UP                  TEXT("NX")
  
  
  //
  // SDDL User alias max size
  //      - currently, upto two supported eg. "DA"
  //      - modify this if more WCHARs need to be there in future e.g. "DAX"
  //
  
  #define SDDL_ALIAS_SIZE                     2
  
  //
  // SDDL User aliases
  //
  #define SDDL_DOMAIN_ADMINISTRATORS          TEXT("DA")      // Domain admins
  #define SDDL_DOMAIN_GUESTS                  TEXT("DG")      // Domain guests
  #define SDDL_DOMAIN_USERS                   TEXT("DU")      // Domain users
  #define SDDL_ENTERPRISE_DOMAIN_CONTROLLERS  TEXT("ED")      // Enterprise domain controllers
  #define SDDL_DOMAIN_DOMAIN_CONTROLLERS      TEXT("DD")      // Domain domain controllers
  #define SDDL_DOMAIN_COMPUTERS               TEXT("DC")      // Domain computers
  #define SDDL_BUILTIN_ADMINISTRATORS         TEXT("BA")      // Builtin (local ) administrators
  #define SDDL_BUILTIN_GUESTS                 TEXT("BG")      // Builtin (local ) guests
  #define SDDL_BUILTIN_USERS                  TEXT("BU")      // Builtin (local ) users
  #define SDDL_LOCAL_ADMIN                    TEXT("LA")      // Local administrator account
  #define SDDL_LOCAL_GUEST                    TEXT("LG")      // Local group account
  #define SDDL_ACCOUNT_OPERATORS              TEXT("AO")      // Account operators
  #define SDDL_BACKUP_OPERATORS               TEXT("BO")      // Backup operators
  #define SDDL_PRINTER_OPERATORS              TEXT("PO")      // Printer operators
  #define SDDL_SERVER_OPERATORS               TEXT("SO")      // Server operators
  #define SDDL_AUTHENTICATED_USERS            TEXT("AU")      // Authenticated users
  #define SDDL_PERSONAL_SELF                  TEXT("PS")      // Personal self
  #define SDDL_CREATOR_OWNER                  TEXT("CO")      // Creator owner
  #define SDDL_CREATOR_GROUP                  TEXT("CG")      // Creator group
  #define SDDL_LOCAL_SYSTEM                   TEXT("SY")      // Local system
  #define SDDL_POWER_USERS                    TEXT("PU")      // Power users
  #define SDDL_EVERYONE                       TEXT("WD")      // Everyone ( World )
  #define SDDL_REPLICATOR                     TEXT("RE")      // Replicator
  #define SDDL_INTERACTIVE                    TEXT("IU")      // Interactive logon user
  #define SDDL_NETWORK                        TEXT("NU")      // Nework logon user
  #define SDDL_SERVICE                        TEXT("SU")      // Service logon user
  #define SDDL_RESTRICTED_CODE                TEXT("RC")      // Restricted code
  #define SDDL_WRITE_RESTRICTED_CODE          TEXT("WR")      // Write Restricted code
  #define SDDL_ANONYMOUS                      TEXT("AN")      // Anonymous Logon
  #define SDDL_SCHEMA_ADMINISTRATORS          TEXT("SA")      // Schema Administrators
  #define SDDL_CERT_SERV_ADMINISTRATORS       TEXT("CA")      // Certificate Server Administrators
  #define SDDL_RAS_SERVERS                    TEXT("RS")      // RAS servers group
  #define SDDL_ENTERPRISE_ADMINS              TEXT("EA")      // Enterprise administrators
  #define SDDL_GROUP_POLICY_ADMINS            TEXT("PA")      // Group Policy administrators
  #define SDDL_ALIAS_PREW2KCOMPACC            TEXT("RU")      // alias to allow previous windows 2000
  #define SDDL_LOCAL_SERVICE                  TEXT("LS")      // Local service account (for services)
  #define SDDL_NETWORK_SERVICE                TEXT("NS")      // Network service account (for services)
  #define SDDL_REMOTE_DESKTOP                 TEXT("RD")      // Remote desktop users (for terminal server)
  #define SDDL_NETWORK_CONFIGURATION_OPS      TEXT("NO")      // Network configuration operators ( to manage configuration of networking features)
  #define SDDL_PERFMON_USERS                  TEXT("MU")      // Performance Monitor Users
  #define SDDL_PERFLOG_USERS                  TEXT("LU")      // Performance Log Users
  #define SDDL_IIS_USERS                      TEXT("IS")      // Anonymous Internet Users
  #define SDDL_CRYPTO_OPERATORS               TEXT("CY")      // Crypto Operators
  #define SDDL_OWNER_RIGHTS                   TEXT("OW")      // Owner Rights SID
  #define SDDL_EVENT_LOG_READERS              TEXT("ER")      // Event log readers
  #define SDDL_ENTERPRISE_RO_DCs              TEXT("RO")      // Enterprise Read-only domain controllers
  #define SDDL_CERTSVC_DCOM_ACCESS            TEXT("CD")      // Users who can connect to certification authorities using DCOM
  #define SDDL_ALL_APP_PACKAGES               TEXT("AC")      // All applications running in an app package context
  #define SDDL_RDS_REMOTE_ACCESS_SERVERS      TEXT("RA")      // Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources.
  #define SDDL_RDS_ENDPOINT_SERVERS           TEXT("ES")      // Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run.
  #define SDDL_RDS_MANAGEMENT_SERVERS         TEXT("MS")      // Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. 
  #define SDDL_USER_MODE_DRIVERS              TEXT("UD")      // UserMode driver
  #define SDDL_HYPER_V_ADMINS                 TEXT("HA")      // Members of this group have complete and unrestricted access to all features of Hyper-V. 
  #define SDDL_CLONEABLE_CONTROLLERS          TEXT("CN")      // Members of this group that are domain controllers may be cloned. 
  #define SDDL_ACCESS_CONTROL_ASSISTANCE_OPS  TEXT("AA")      // Members of this group can remotely query authorization attributes and permissions for resources on this computer. 
  #define SDDL_REMOTE_MANAGEMENT_USERS        TEXT("RM")      // Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user. 
  #define SDDL_AUTHORITY_ASSERTED             TEXT("AS")      // Authentication Authority Asserted
  #define SDDL_SERVICE_ASSERTED               TEXT("SS")      // Authentication Service Asserted
  
  //
  // Note !! While making the above changes check if ScepReplaceNewAcronymsInSDDL
  // needs to be updated to allow the new SIDs to be translated on downlevel OS.
  //
  
  //
  // Integrity Labels
  //
  #define SDDL_ML_LOW                         TEXT("LW")      // Low mandatory level
  #define SDDL_ML_MEDIUM                      TEXT("ME")      // Medium mandatory level
  #define SDDL_ML_MEDIUM_PLUS                 TEXT("MP")      // Medium Plus mandatory level
  #define SDDL_ML_HIGH                        TEXT("HI")      // High mandatory level
  #define SDDL_ML_SYSTEM                      TEXT("SI")      // System mandatory level
  
  //
  // SDDL Seperators - character version
  //
  #define SDDL_SEPERATORC                     TEXT(';')
  #define SDDL_DELIMINATORC                   TEXT(':')
  #define SDDL_ACE_BEGINC                     TEXT('(')
  #define SDDL_ACE_ENDC                       TEXT(')')
  #define SDDL_SPACEC                              TEXT(' ')
  #define SDDL_ACE_COND_BEGINC           TEXT('(')
  #define SDDL_ACE_COND_ENDC           TEXT(')')
  #define SDDL_ACE_COND_STRING_BEGINC           TEXT('"')
  #define SDDL_ACE_COND_STRING_ENDC           TEXT('"')
  #define SDDL_ACE_COND_COMPOSITEVALUE_BEGINC       TEXT('{')
  #define SDDL_ACE_COND_COMPOSITEVALUE_ENDC           TEXT('}')
  #define SDDL_ACE_COND_COMPOSITEVALUE_SEPERATORC           TEXT(',')
  #define SDDL_ACE_COND_BLOB_PREFIXC          TEXT('#')
  #define SDDL_ACE_COND_SID_BEGINC           TEXT('(')
  #define SDDL_ACE_COND_SID_ENDC           TEXT(')')
  
  //
  // SDDL Seperators - string version
  //
  #define SDDL_SEPERATOR                     TEXT(";")
  #define SDDL_DELIMINATOR                   TEXT(":")
  #define SDDL_ACE_BEGIN                     TEXT("(")
  #define SDDL_ACE_END                       TEXT(")")
  #define SDDL_ACE_COND_BEGIN           TEXT("(")
  #define SDDL_ACE_COND_END           TEXT(")")
  #define SDDL_SPACE                              TEXT(" ")
  #define SDDL_ACE_COND_BLOB_PREFIX          TEXT("#")
  #define SDDL_ACE_COND_SID_PREFIX          TEXT("SID")
  #define SDDL_ACE_COND_ATTRIBUTE_PREFIX          TEXT("@")
  #define SDDL_ACE_COND_USER_ATTRIBUTE_PREFIX          TEXT("@USER.")
  #define SDDL_ACE_COND_RESOURCE_ATTRIBUTE_PREFIX          TEXT("@RESOURCE.")
  #define SDDL_ACE_COND_DEVICE_ATTRIBUTE_PREFIX          TEXT("@DEVICE.")
  
  
  
  
  #if !defined(_NTDDK_)
  
  
  #if (_WIN32_WINNT >= 0x0500)
  
  BOOL
  WINAPI
  ConvertSidToStringSidA(
      _In_  PSID     Sid,
      _Outptr_ LPSTR  *StringSid
      );
  
  BOOL
  WINAPI
  ConvertSidToStringSidW(
      _In_ PSID Sid,
      _Outptr_ LPWSTR * StringSid
      );
  
  #ifdef UNICODE
  #define ConvertSidToStringSid  ConvertSidToStringSidW
  #else
  #define ConvertSidToStringSid  ConvertSidToStringSidA
  #endif // !UNICODE
  
  BOOL
  WINAPI
  ConvertStringSidToSidA(
      _In_ LPCSTR   StringSid,
      _Outptr_ PSID   *Sid
      );
  
  BOOL
  WINAPI
  ConvertStringSidToSidW(
      _In_ LPCWSTR StringSid,
      _Outptr_ PSID * Sid
      );
  
  #ifdef UNICODE
  #define ConvertStringSidToSid  ConvertStringSidToSidW
  #else
  #define ConvertStringSidToSid  ConvertStringSidToSidA
  #endif // !UNICODE
  
  BOOL
  WINAPI
  ConvertStringSecurityDescriptorToSecurityDescriptorA(
      _In_  LPCSTR StringSecurityDescriptor,
      _In_  DWORD StringSDRevision,
      _Outptr_ PSECURITY_DESCRIPTOR  *SecurityDescriptor,
      _Out_opt_ PULONG  SecurityDescriptorSize
      );
  
  BOOL
  WINAPI
  ConvertStringSecurityDescriptorToSecurityDescriptorW(
      _In_ LPCWSTR StringSecurityDescriptor,
      _In_ DWORD StringSDRevision,
      _Outptr_ PSECURITY_DESCRIPTOR * SecurityDescriptor,
      _Out_opt_ PULONG SecurityDescriptorSize
      );
  
  #ifdef UNICODE
  #define ConvertStringSecurityDescriptorToSecurityDescriptor  ConvertStringSecurityDescriptorToSecurityDescriptorW
  #else
  #define ConvertStringSecurityDescriptorToSecurityDescriptor  ConvertStringSecurityDescriptorToSecurityDescriptorA
  #endif // !UNICODE
  
  
  BOOL
  WINAPI
  ConvertSecurityDescriptorToStringSecurityDescriptorA(
      _In_  PSECURITY_DESCRIPTOR  SecurityDescriptor,
      _In_  DWORD RequestedStringSDRevision,
      _In_  SECURITY_INFORMATION SecurityInformation,
      _Outptr_ LPSTR  *StringSecurityDescriptor,
      _Out_opt_ PULONG StringSecurityDescriptorLen
      );
  
  BOOL
  WINAPI
  ConvertSecurityDescriptorToStringSecurityDescriptorW(
      _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
      _In_ DWORD RequestedStringSDRevision,
      _In_ SECURITY_INFORMATION SecurityInformation,
      _Outptr_ LPWSTR * StringSecurityDescriptor,
      _Out_opt_ PULONG StringSecurityDescriptorLen
      );
  
  #ifdef UNICODE
  #define ConvertSecurityDescriptorToStringSecurityDescriptor  ConvertSecurityDescriptorToStringSecurityDescriptorW
  #else
  #define ConvertSecurityDescriptorToStringSecurityDescriptor  ConvertSecurityDescriptorToStringSecurityDescriptorA
  #endif // !UNICODE
  
  
  #endif /* _WIN32_WINNT >=  0x0500 */
  
  #endif /* !defined(_NTDDK_) */
  
  
  #endif // WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
  #pragma endregion
  
  
  #ifdef __cplusplus
  }
  #endif
  
  #endif  // endif __SDDL_H__
  
  
  