<div class="content" name="LsarQueryInfoTrustedDomain" uuid="e74460c7-db03-45c3-ac3c-a72a840e4943"><p>The LsarQueryInfoTrustedDomain method is invoked to retrieve
information about the <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_f2ceef4e-999b-4276-84cd-2e2829de5fc4" data-linktype="relative-path">trusted domain object</a></span>.</p><dl>
<dd>
<div><pre> NTSTATUS LsarQueryInfoTrustedDomain(
   [in] LSAPR_HANDLE TrustedDomainHandle,
   [in] TRUSTED_INFORMATION_CLASS InformationClass,
   [out, switch_is(InformationClass)] 
     PLSAPR_TRUSTED_DOMAIN_INFO* TrustedDomainInformation
 );
</pre></div>
</dd></dl><p><b>TrustedDomainHandle:</b> An open trusted domain
object handle.</p><p><b>InformationClass: </b>One of the <span><a href="36069113-6c38-45e8-920e-17f8ef36f578" data-linktype="relative-path">TRUSTED_INFORMATION_CLASS</a></span>
values indicating the type of information the caller is interested in.</p><p><b>TrustedDomainInformation: </b>Used to return
requested information about the trusted domain object.</p><p><b>Return Values: </b>The following is a summary of
the return values that an implementation MUST return, as specified by the
message processing that follows.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Return value/code</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000000 STATUS_SUCCESS</td>
  <td>The request was successfully completed.</td>
 </tr><tr>
  <td>0xC0000022 STATUS_ACCESS_DENIED</td>
  <td>The caller does not have the permissions to perform this operation.</td>
 </tr><tr>
  <td>0xC000000D STATUS_INVALID_PARAMETER</td>
  <td>One of the arguments supplied to the function was invalid.</td>
 </tr><tr>
  <td>0xC0000003 STATUS_INVALID_INFO_CLASS</td>
  <td>The InformationClass argument is outside the allowed range.</td>
 </tr><tr>
  <td>0xC0000008 STATUS_INVALID_HANDLE</td>
  <td>TrustedDomainHandle is not a valid handle.</td>
 </tr></tbody></table>
</dd></dl><p>Processing:</p><p>This message takes three arguments:</p><p><i>TrustedDomainHandle</i>: An open handle to a trusted
domain object. If the handle is not a valid context handle to a trusted domain
object or <i>TrustedDomainHandle</i>.HandleType does not equal &#34;Trusted
Domain&#34;, the server MUST return STATUS_INVALID_HANDLE. The server MUST
verify that <i>TrustedDomainHandle</i> grants access as specified in section <span><a href="d1c2802a-70d5-4f81-843c-6523ab0c5e03" data-linktype="relative-path">3.1.4.2.2</a></span>.
The following table specifies the RequiredAccess value to use in this access
check for each <i>InformationClass</i> value, or indicates if no processing is
supported, regardless of access granted. There are several methods in the Local
Security Authority (Domain Policy) Remote Protocol that query <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_f2f00d47-6cf2-4b32-b8f7-b63e38e2e9c4" data-linktype="relative-path">trusted
domain</a></span> information. All of them enforce the same rights assignments
based on information class as described in the following table.</p><table><thead>
  <tr>
   <th>
   <p>Value of InformationClass parameter</p>
   </th>
   <th>
   <p>RequiredAccess value</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TrustedDomainNameInformation TrustedDomainInformationBasic TrustedDomainInformationEx TrustedDomainInformationEx2Internal</td>
  <td>TRUSTED_QUERY_DOMAIN_NAME</td>
 </tr><tr>
  <td>TrustedControllersInformation</td>
  <td>Does not apply: This information class is obsolete and cannot be set or queried. The server MUST return STATUS_INVALID_PARAMETER.</td>
 </tr><tr>
  <td>TrustedPosixOffsetInformation TrustedDomainSupportedEncryptionTypes</td>
  <td>TRUSTED_QUERY_POSIX</td>
 </tr><tr>
  <td>TrustedPasswordInformation TrustedDomainAuthInformation TrustedDomainAuthInformationInternal</td>
  <td>TRUSTED_QUERY_AUTH</td>
 </tr><tr>
  <td>TrustedDomainFullInformation TrustedDomainFullInformationInternal TrustedDomainFullInformation2Internal</td>
  <td>TRUSTED_QUERY_DOMAIN_NAME | TRUSTED_QUERY_POSIX | TRUSTED_QUERY_AUTH</td>
 </tr></tbody></table><p><i>InformationClass</i>: A value from the
TRUSTED_INFORMATION_CLASS enumeration specifying what type of information the
caller is requesting. Not all values are valid. For values outside the
TRUSTED_INFORMATION_CLASS range, the server MUST reject the request with
STATUS_INVALID_PARAMETER. Information class values
TrustedDomainAuthInformationInternal and TrustedDomainFullInformationInternal
MUST be rejected with STATUS_INVALID_INFO_CLASS.</p><p><i>TrustedDomainInformation</i>: Used to return the data
requested by the caller, in a structure form corresponding to the <i>InformationClass</i>
parameter. Information MUST be collected from the abstract data model specified
in section <span><a href="0228f75e-9725-479c-b4cd-1cacd667343c" data-linktype="relative-path">3.1.1.5</a></span>.</p><table><thead>
  <tr>
   <th>
   <p>Value of InformationClass parameter </p>
   </th>
   <th>
   <p>Information to return</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TrustedDomainNameInformation</td>
  <td>Flat Name</td>
 </tr><tr>
  <td>TrustedPosixOffsetInformation</td>
  <td>Posix Offset</td>
 </tr><tr>
  <td>TrustedDomainInformationEx</td>
  <td>Name Flat Name Security Identifier Posix Offset Trust Type Trust Direction Trust Attributes</td>
 </tr><tr>
  <td>TrustedDomainAuthInformation TrustedDomainAuthInformationInternal TrustedDomainFullInformationInternal</td>
  <td>Not applicable: This information class cannot be queried. Server MUST return STATUS_INVALID_INFO_CLASS.</td>
 </tr><tr>
  <td>TrustedDomainFullInformation</td>
  <td>Name Flat Name Security Identifier Posix Offset Trust Type Trust Direction Trust Attributes Trust Incoming and Outgoing Password values MUST be set to 0.</td>
 </tr><tr>
  <td>TrustedDomainFullInformation2Internall</td>
  <td>Name Flat Name Security Identifier Posix Offset Trust Type Trust Direction Trust Attributes Forest Trust Attributes, as stored in Active Directory under the msDs-TrustForestTrustInfo attribute ([MS-ADTS] section 6.1.6.9.3). Trust Incoming and Outgoing Password values MUST be set to 0.</td>
 </tr><tr>
  <td>TrustedDomainSupportedEncryptionTypes</td>
  <td>Supported Encryption Types</td>
 </tr><tr>
  <td>Other values</td>
  <td>Server MUST return STATUS_INVALID_PARAMETER.</td>
 </tr></tbody></table><p>If the server is not at DS_BEHAVIOR_WIN2003 <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_b3240417-ca43-4901-90ec-fde55b32b3b8" data-linktype="relative-path">forest
functional level</a></span>, the presence of the
TRUST_ATTRIBUTE_FOREST_TRANSITIVE bit in the <b>Trust Attributes</b> field of a
trusted domain object MUST NOT be returned by the server.<a id="Appendix_A_Target_106"></a><a aria-label="Product behavior note 106" href="2a769a08-e023-459f-aebe-4fb3f595c0b7#Appendix_A_106" data-linktype="relative-path">&lt;106&gt;</a></p></div>