如何在C ++中调用LsaRemoveAccountRights

Question

我正在尝试创建一个代码，使管理员（管理员）无法关闭计算机。 我正在学习，这很容易看出它是否有效。 问题是我从LsaRemoveAccountRights中收到未处理的异常。 我从日语站点获得了大部分代码，但是所有示例都做的差不多。 那为什么不开矿呢？

// This is how I call the function
bool f = DelRights(SE_SHUTDOWN_NAME, true);

bool DelRights(wchar_t *szPrivilege, bool bRevoke)
{
    LSA_UNICODE_STRING Rights = {0};
    LSA_OBJECT_ATTRIBUTES Attr = {0};
    SECURITY_QUALITY_OF_SERVICE Quality = {0};
    bool bRet = false;

    DWORD SidSize = SECURITY_MAX_SID_SIZE;

    Rights.Buffer = szPrivilege;
    Rights.Length = wcslen(szPrivilege) * sizeof(WCHAR);
    Rights.MaximumLength = (wcslen(szPrivilege) + 1) * sizeof(WCHAR);


// Allocate enough memory for the largest possible SID.
    PSID AdminSID = LocalAlloc(LMEM_FIXED, SidSize);

    if (AdminSID) {
        ::SecureZeroMemory(AdminSID, SidSize);

        if (CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &AdminSID, &SidSize)) {
            LSA_HANDLE hPolicy = 0;


            Attr.Length = sizeof(Attr);
            Attr.RootDirectory = NULL;
            Attr.ObjectName = NULL;
            Attr.Attributes = 0;
            Attr.SecurityDescriptor = NULL;
            Attr.SecurityQualityOfService = &Quality;

            Quality.Length = sizeof(Quality);
            Quality.ImpersonationLevel = SecurityImpersonation;
            Quality.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
            Quality.EffectiveOnly = FALSE;

            if (ERROR_SUCCESS == LsaOpenPolicy(NULL, &Attr, POLICY_ALL_ACCESS, &hPolicy)) {
                NTSTATUS status = 0;

                if (bRevoke) {
                    status = LsaRemoveAccountRights(hPolicy, AdminSID, FALSE, &Rights, 1);

                    if (ERROR_SUCCESS == status) {
                        bRet = true;
                    }
                }
                else {
                    status = LsaAddAccountRights(hPolicy, AdminSID, FALSE, 1);

                    if (ERROR_SUCCESS == status) {
                        bRet = true;
                    }
                }

                LsaClose(hPolicy);
            }
        }

        GlobalFree(AdminSID);
    }

    return bRet;
}

Answer 1

你传递一个PPSID（ PSID* ），以CreateWellKnownSid而它正在等待只是一个PSID 。 这不会崩溃，因为我猜想指针只会在稍后在LsaRemoveAccountRights取消引用。

正确的代码应为：

PSID AdminSID = LocalAlloc(LMEM_FIXED, SidSize);

if (AdminSID) {
    ::SecureZeroMemory(AdminSID, SidSize);

    // pass AdminSID, not &AdminSID
    if (CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, AdminSID, &SidSize))