<div class="content" name="LsarSetInformationTrustedDomain" uuid="9ea46cef-cc72-4109-ba13-91eda6b713bc"><p>The LsarSetInformationTrustedDomain method is invoked to set
information on a <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4" data-linktype="relative-path">trusted domain object</a></span>.</p><dl>
<dd>
<div><pre> NTSTATUS LsarSetInformationTrustedDomain(
   [in] LSAPR_HANDLE TrustedDomainHandle,
   [in] TRUSTED_INFORMATION_CLASS InformationClass,
   [in, switch_is(InformationClass)] 
     PLSAPR_TRUSTED_DOMAIN_INFO TrustedDomainInformation
 );
</pre></div>
</dd></dl><p><b>TrustedDomainHandle:</b> A handle to a trusted
domain object.</p><p><b>InformationClass: </b>A value indicating the type
of information requested by the caller.</p><p><b>TrustedDomainInformation: </b>Used to supply the
information to be set.</p><p><b>Return Values: </b>The following is a summary of
the return values that an implementation MUST return, as specified by the
message processing that follows.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Return value/code</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000000 STATUS_SUCCESS</td>
  <td>The request was successfully completed.</td>
 </tr><tr>
  <td>0xC0000022 STATUS_ACCESS_DENIED</td>
  <td>The caller does not have the permissions to perform this operation.</td>
 </tr><tr>
  <td>0xC000000D STATUS_INVALID_PARAMETER</td>
  <td>One of the arguments supplied to the function was invalid.</td>
 </tr><tr>
  <td>0xC00000DD STATUS_INVALID_DOMAIN_STATE</td>
  <td>The domain is in the wrong state to perform the stated operation.</td>
 </tr><tr>
  <td>0xC0000008 STATUS_INVALID_HANDLE</td>
  <td>TrustedDomainHandle is not a valid handle.</td>
 </tr></tbody></table>
</dd></dl><p>Processing:</p><p>This message takes three arguments:</p><p><i>TrustedDomainHandle</i>: An open handle to a trusted
domain object. If the handle is not a valid context handle to a trusted domain
object or <i>TrustedDomainHandle</i>.HandleType does not equal &#34;Trusted
Domain&#34;, the server MUST return STATUS_INVALID_HANDLE. The server MUST
verify that <i>TrustedDomainHandle</i> grants access as specified in section <span><a href="d1c2802a-70d5-4f81-843c-6523ab0c5e03" data-linktype="relative-path">3.1.4.2.2</a></span>.
The following table specifies the RequiredAccess value to use in this access
check for each <i>InformationClass</i> value, or indicates if no processing is
supported, regardless of access granted. There are several methods in the Local
Security Authority (Domain Policy) Remote Protocol that set <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_f2f00d47-6cf2-4b32-b8f7-b63e38e2e9c4" data-linktype="relative-path">trusted
domain</a></span> information. All of them enforce the same rights assignments
based on information class.</p><table><thead>
  <tr>
   <th>
   <p>Value of InformationClass parameter</p>
   </th>
   <th>
   <p>RequiredAccess value</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TrustedPosixOffsetInformation TrustedDomainInformationEx</td>
  <td>TRUSTED_SET_POSIX</td>
 </tr><tr>
  <td>TrustedDomainFullInformation TrustedDomainFullInformationInternal</td>
  <td>TRUSTED_SET_POSIX | TRUSTED_SET_AUTH</td>
 </tr><tr>
  <td>TrustedDomainAuthInformation TrustedDomainAuthInformationInternal</td>
  <td>TRUSTED_SET_AUTH</td>
 </tr><tr>
  <td>TrustedDomainSupportedEncryptionTypes</td>
  <td>TRUSTED_SET_POSIX</td>
 </tr></tbody></table><p><i>InformationClass</i>: A value from the <span><a href="36069113-6c38-45e8-920e-17f8ef36f578" data-linktype="relative-path">TRUSTED_INFORMATION_CLASS</a></span>
enumeration specifying what type of information the caller is setting. Not all
values are valid. For values outside the TRUSTED_INFORMATION_CLASS range, the
server MUST reject the request with STATUS_INVALID_PARAMETER. Information class
values other than the following set SHOULD<a id="Appendix_A_Target_107"></a><a aria-label="Product behavior note 107" href="2a769a08-e023-459f-aebe-4fb3f595c0b7#Appendix_A_107" data-linktype="relative-path">&lt;107&gt;</a> be
rejected with STATUS_INVALID_PARAMETER. The set of allowed information class
values is:</p><ul><li><p><span><span> 
</span></span>TrustedPosixOffsetInformation</p>
</li><li><p><span><span> 
</span></span>TrustedDomainInformationEx</p>
</li><li><p><span><span> 
</span></span>TrustedDomainAuthInformation</p>
</li><li><p><span><span> 
</span></span>TrustedDomainFullInformation</p>
</li><li><p><span><span> 
</span></span>TrustedDomainAuthInformationInternal</p>
</li><li><p><span><span> 
</span></span>TrustedDomainFullInformationInternal</p>
</li><li><p><span><span> 
</span></span>TrustedDomainSupportedEncryptionTypes</p>
</li></ul><p><i>TrustedDomainInformation</i>: Contains information to be
set, appropriate for the <i>InformationClass</i> parameter. The server MUST
validate the <i>TrustedDomainInformation</i> parameter according to information
class–specific rules. The rules for internal consistency checking of trusted domain
objects are specified in <span><a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a></span>
section <span><a href="../ms-adts/fe369d31-cc17-4ad7-849e-769403bc2c41" data-linktype="relative-path">6.1.6</a></span>.</p><p>Information in the abstract data model specified in section <span><a href="0228f75e-9725-479c-b4cd-1cacd667343c" data-linktype="relative-path">3.1.1.5</a></span>
MUST be updated using <i>TrustedDomainInformation</i> and <i>InformationClass</i>
parameters as follows:</p><table><thead>
  <tr>
   <th>
   <p>Value of InformationClass parameter </p>
   </th>
   <th>
   <p>Information to set</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TrustedPosixOffsetInformation</td>
  <td>Posix Offset</td>
 </tr><tr>
  <td>TrustedDomainInformationEx</td>
  <td>Trust Type Trust Direction Trust Attributes Forest Trust Attributes MUST be set to 0 if new trust attributes do not contain TRUST_ATTRIBUTE_FOREST_TRANSITIVE flag.</td>
 </tr><tr>
  <td>TrustedDomainAuthInformation TrustedDomainAuthInformationInternal</td>
  <td>Trust Incoming Password Trust Outgoing Password</td>
 </tr><tr>
  <td>TrustedDomainFullInformation TrustedDomainFullInformationInternal</td>
  <td>Posix Offset Trust Type Trust Direction Trust Attributes Trust Incoming Password Trust Outgoing Password Forest Trust Attributes MUST be set to 0 if new trust attributes do not contain TRUST_ATTRIBUTE_FOREST_TRANSITIVE flag.</td>
 </tr><tr>
  <td>TrustedDomainSupportedEncryptionTypes</td>
  <td>Supported Encryption Types</td>
 </tr><tr>
  <td>Other values</td>
  <td>Server MUST return STATUS_INVALID_PARAMETER.</td>
 </tr></tbody></table><p>The server MUST return STATUS_INVALID_DOMAIN_STATE in the
following cases:</p><ul><li><p><span><span> 
</span></span>The TrustAttributes TRUST_ATTRIBUTE_FOREST_TRANSITIVE flag is set
and the forestFunctionality specified in [MS-ADTS] section <span><a href="../ms-adts/d49624d0-9320-4368-8b0c-a7998ac2abdb" data-linktype="relative-path">3.1.1.3.2.27</a></span>
is DS_BEHAVIOR_WIN2003 or higher.</p>
</li><li><p><span><span> 
</span></span>The TrustAttributes TRUST_ATTRIBUTE_FOREST_TRANSITIVE flag is set
and the <b>DnsForestName</b> and <b>DnsDomainName</b> fields in DNS Domain
Information (see section <span><a href="c939c70e-8cf0-4d90-a9cc-1c5002951723" data-linktype="relative-path">3.1.1.1</a></span>) do not
contain the same value.</p>
</li><li><p><span><span> 
</span></span>The TrustAttributes TRUST_ATTRIBUTE_CROSS_ORGANIZATION flag is
set and the forestFunctionality specified in [MS-ADTS] section 3.1.1.3.2.27 is
DS_BEHAVIOR_WIN2003 or higher.</p>
</li></ul><p>If the server is a <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_8b0a073b-3099-4efe-8b81-c2886b66a870" data-linktype="relative-path">read-only domain controller</a></span>,
it MUST return an error.<a id="Appendix_A_Target_108"></a><a aria-label="Product behavior note 108" href="2a769a08-e023-459f-aebe-4fb3f595c0b7#Appendix_A_108" data-linktype="relative-path">&lt;108&gt;</a></p><p>If the <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_5ee032d0-d944-4acb-bbb5-b1cfc7df6db6" data-linktype="relative-path">trust</a></span> direction is
being set to incoming or bidirectional, then the server MUST create an <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_ba0d31d7-aa03-4e10-936a-a0ebd276ebc9" data-linktype="relative-path">interdomain
trust account</a></span> for this trust, if such an account does not yet exist,
and populate it as specified in [MS-ADTS] section <span><a href="../ms-adts/ac527b5b-0e88-48a1-8c73-497d40388d04" data-linktype="relative-path">6.1.6.8</a></span>.
The <span><a href="../ms-ada3/71e64720-be27-463f-9cc5-117f4bc849e1" data-linktype="relative-path">unicodePwd</a></span>
attribute of the account is updated (as specified in <span><a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a></span>
section <span><a href="../ms-samr/22b79fa8-13bd-4952-a399-9d5a93b2256f" data-linktype="relative-path">3.1.1.8.7</a></span>)
with the clear text password (that is, the password value with AuthType being
equal to 0x2) in the &#34;Trust Incoming Passwords&#34; information provided.</p></div>