Direction and Parameter method field Parameter value Receive Status STATUS_OBJECT_NAME_COLLISION LsarCreateAccount Receive AccountHandle NULL LsarCreateAccount Message 5: Attempt to open the account object with SID S-1-5-21-123-123-123-1005. Direction and method field Parameter value Send [Implementation-specific value] Send "S-1-5-21-123-123-123-1005" Send READ_CONTROL | WRITE_DAC | ACCOUNT_ADJUST_PRIVILEGES | ACCOUNT_ADJUST_SYSTEM_ACCESS | ACCOUNT_VIEW Message 6: Success: Return the account object handle. Direction and method Parameter field Parameter value Receive Status STATUS_SUCCESS LsarOpenAccount Receive AccountHandle [Implementation-specific value] LsarOpenAccount Message 7: Retrieve the of the account object. Direction and method Parameter field Parameter value Send ObjectHandle [Implementation-specific value returned in Step 6.] LsarQuerySecurityObject Send SecurityInformation DACL_SECURITY_INFORMATION LsarQuerySecurityObject Message 8: Success: Return the security descriptor. Parameter Direction and method Parameter value Receive Status STATUS_SUCCESS LsarQuerySecurityObject Receive Security descriptor of the account object in self-relative form. LsarQuerySecurityObject
Direction and method Parameter field Parameter value Receive LsarCreateAccount Status STATUS_OBJECT_NAME_COLLISION Receive LsarCreateAccount AccountHandle NULL Message 5: Attempt to open the account object with SID S-1-5-21-123-123-123-1005. Direction and method field Parameter value Send [Implementation-specific value] Send "S-1-5-21-123-123-123-1005" Send READ_CONTROL | WRITE_DAC | ACCOUNT_ADJUST_PRIVILEGES | ACCOUNT_ADJUST_SYSTEM_ACCESS | ACCOUNT_VIEW Message 6: Success: Return the account object handle. Direction and method Parameter field Parameter value Receive LsarOpenAccount Status STATUS_SUCCESS Receive LsarOpenAccount AccountHandle [Implementation-specific value] Message 7: Retrieve the of the account object. Direction and method Parameter field Parameter value Send LsarQuerySecurityObject ObjectHandle [Implementation-specific value returned in Step 6.] Send LsarQuerySecurityObject SecurityInformation DACL_SECURITY_INFORMATION Message 8: Success: Return the security descriptor. Direction and method Parameter Parameter value Receive LsarQuerySecurityObject Status STATUS_SUCCESS Receive LsarQuerySecurityObject Security descriptor of the account object in self-relative form.