<div class="content" name="LsarLookupNames4" uuid="2c0e8a6d-df0f-4c77-bbeb-f7cd0f6b2361"><p>The LsarLookupNames4 method translates a batch of <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_f3ef2572-95cf-4c5c-b3c9-551fd648f409" data-linktype="relative-path">security principal</a> names to
their <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">SID</a> form. It also
returns the <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domains</a> of
which these security principals are a part.</p><dl>
<dd>
<div><pre> NTSTATUS LsarLookupNames4(
   [in] handle_t RpcHandle,
   [in, range(0,1000)] unsigned long Count,
   [in, size_is(Count)] PRPC_UNICODE_STRING Names,
   [out] PLSAPR_REFERENCED_DOMAIN_LIST* ReferencedDomains,
   [in, out] PLSAPR_TRANSLATED_SIDS_EX2 TranslatedSids,
   [in] LSAP_LOOKUP_LEVEL LookupLevel,
   [in, out] unsigned long* MappedCount,
   [in] unsigned long LookupOptions,
   [in] unsigned long ClientRevision
 );
</pre></div>
</dd></dl><p><b>RpcHandle: </b>This value is used by <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a> internally and is not
transmitted over the network, as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>. This handle
can be obtained by calling RPC runtime binding routines. For more information,
see <a href="https://go.microsoft.com/fwlink/?LinkId=90076" data-linktype="external">[MSDN-RPCDB]</a>.</p><p><b>Count: </b>Number of security principal names to
look up.<a id="Appendix_A_Target_24"></a><a aria-label="Product behavior note 24" href="d2715572-2c9b-4198-ace9-316a2fb5d7f5#Appendix_A_24" data-linktype="relative-path">&lt;24&gt;</a></p><p><b>Names: </b>Contains the security principal names
to translate. The RPC_UNICODE_STRING structure is defined in <a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a>
section <a href="../ms-dtyp/94a16bb6-c610-4cb9-8db6-26f15f560061" data-linktype="relative-path">2.3.10</a>.</p><dl>
<dd>
<p>The following name forms MUST be supported:</p>
</dd></dl><ul><li><p><span><span>  </span></span><a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_9d606f55-b798-4def-bf96-97b878bb92c6" data-linktype="relative-path">User principal names (UPNs)</a>,
such as user_name@example.example.com.</p>
</li><li><p><span><span>  </span></span>Fully
qualified account names based on either DNS or NetBIOS names. For example:
example.example.com\user_name or example\user_name, where the generalized form
is domain\user account name, and domain is either the fully qualified <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_102a36e2-f66f-49e2-bee3-558736b2ecd5" data-linktype="relative-path">DNS name</a> or the NetBIOS
name of the <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_f2f00d47-6cf2-4b32-b8f7-b63e38e2e9c4" data-linktype="relative-path">trusted domain</a>.</p>
</li><li><p><span><span>  </span></span>Unqualified
or isolated names, such as user_name.</p>
</li></ul><dl>
<dd>
<p>The comparisons used by the <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_ae65dac0-cd24-4e83-a946-6d1097b71553" data-linktype="relative-path">RPC server</a> MUST NOT be
case-sensitive, so case for inputs is not important.</p>
</dd></dl><p><b>ReferencedDomains: </b>On successful return,
contains the domain information for the domain to which each security principal
belongs. The domain information includes a NetBIOS domain name and a domain SID
for each entry in the list.</p><p><b>TranslatedSids: </b>On successful return, contains
the corresponding SID form for security principal names in the <i>Names</i>
parameter. It MUST be ignored on input.</p><p><b>LookupLevel: </b>Specifies what scopes are to be
used during translation, as specified in section <a href="9d1166cc-bcfd-4e22-a8ac-f55eae57c99f" data-linktype="relative-path">2.2.16</a>.</p><p><b>MappedCount: </b>On successful return, contains
the number of names that are translated completely to the SID form. This
parameter is left as an input parameter for backward compatibility and has no
effect on message processing in any environment. It MUST be ignored on input.</p><p><b>LookupOptions: </b>Flags specified by the caller
that control the lookup operation. The value MUST be one of the following.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000000</td>
  <td>Isolated names are searched for even when they are not on the local computer.</td>
 </tr><tr>
  <td>0x80000000</td>
  <td>Isolated names (except for user principal names (UPNs)) are searched for only on the local account database. UPNs are not searched for in any of the views.</td>
 </tr></tbody></table>
</dd></dl><p><b>ClientRevision: </b>Version of the client, which
implies the client&#39;s capabilities. The value MUST be one of the following.<a id="Appendix_A_Target_25"></a><a aria-label="Product behavior note 25" href="d2715572-2c9b-4198-ace9-316a2fb5d7f5#Appendix_A_25" data-linktype="relative-path">&lt;25&gt;</a></p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000001</td>
  <td>The client does not understand DNS domain names and is not aware that it might be part of a forest.</td>
 </tr><tr>
  <td>0x00000002</td>
  <td>The client understands DNS domain names and is aware that it might be part of a forest. Error codes returned can include STATUS_TRUSTED_DOMAIN_FAILURE and STATUS_TRUSTED_RELATIONSHIP_FAILURE, which are not returned for ClientRevision of 0x00000001. For more information on error codes, see [MS-ERREF].</td>
 </tr></tbody></table>
</dd>
<dd>
<p>Values smaller than 0x00000002 SHOULD be assumed to
be 0x00000001, and other values SHOULD be assumed to be 0x00000002.</p>
</dd></dl><p><b>Return Values: </b>The following table contains a
summary of the return values that an implementation MUST return, as specified
by the message processing shown after the table.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Return value/code</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000000 STATUS_SUCCESS</td>
  <td>The request was successfully completed.</td>
 </tr><tr>
  <td>0x00000107 STATUS_SOME_NOT_MAPPED</td>
  <td>Some of the information to be translated has not been translated.</td>
 </tr><tr>
  <td>0xC00000DC STATUS_INVALID_SERVER_STATE</td>
  <td>The RPC server is not a domain controller.</td>
 </tr><tr>
  <td>0xC0000022 STATUS_ACCESS_DENIED</td>
  <td>The caller does not have the permissions to perform this operation.</td>
 </tr><tr>
  <td>0xC000000D STATUS_INVALID_PARAMETER</td>
  <td>One of the supplied parameters was invalid.</td>
 </tr><tr>
  <td>0xC0000073 STATUS_NONE_MAPPED</td>
  <td>None of the information to be translated has been translated.</td>
 </tr></tbody></table>
</dd></dl><p>This message is valid only if the RPC server is a domain
controller. The RPC server MUST return STATUS_INVALID_SERVER_STATE in the
return value if it is not a domain controller.</p><p>The RPC server MUST ensure that one of the following
conditions is true:</p><ol><li><p><span>    </span>The
RPC_C_AUTHN_NETLOGON security provider (as specified in <a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a>
section <a href="../ms-rpce/d4097450-c62f-484b-872f-ddf59a7a0d36" data-linktype="relative-path">2.2.1.1.7</a>)
and at least RPC_C_AUTHN_LEVEL_PKT_INTEGRITY authentication level (as specified
in [MS-RPCE] section <a href="../ms-rpce/425a7c53-c33a-4868-8e5b-2a850d40dc73" data-linktype="relative-path">2.2.1.1.8</a>)
are used in this RPC message.</p>
</li><li><p><span>    </span>The RPC client
token contains one of the following well-known SID types -
DOMAIN_GROUP_RID_COMPUTERS, DOMAIN_GROUP_RID_CONTROLLERS,
DOMAIN_GROUP_RID_READONLY_CONTROLLERS (as specified in <a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a>
section <a href="../ms-samr/565a6584-3061-4ede-a531-f5c53826504b" data-linktype="relative-path">2.2.1.14</a>).<a id="Appendix_A_Target_26"></a><a aria-label="Product behavior note 26" href="d2715572-2c9b-4198-ace9-316a2fb5d7f5#Appendix_A_26" data-linktype="relative-path">&lt;26&gt;</a></p>
</li></ol><p>Otherwise, the RPC server MUST return STATUS_ACCESS_DENIED.</p><p>The RPC server MUST check each element in the <i>Names</i>
parameter for validity, as described for the RPC_UNICODE_STRING structure in
[MS-DTYP] section 2.3.10. If validation fails, the RPC server MUST return
STATUS_INVALID_PARAMETER.</p><p>The <i>TranslatedSids</i> and <i>MappedCount</i> parameters
are left as input parameters for backward compatibility and have no effect on
message processing in any environment. They MUST be ignored on input.</p><p><i>LookupOptions</i> MUST NOT contain 0x80000000 unless <i>LookupLevel</i>
is LsapLookupWksta. If this fails, the RPC server MUST return
STATUS_INVALID_PARAMETER.</p><p>A name is interchangeably called a &#34;qualified&#34; or
&#34;composite&#34; name if the name has a backslash (&#39;\&#39;) character in it.
The string before the backslash is assumed to be the domain name, and the
string after the backslash is the name to be resolved within that domain. If
the name does not contain a backslash character, it is called an
&#34;isolated&#34; name. An isolated name can be in single-label form, as in
&#34;John&#34;, or can be in user-principal-name form, as in
&#34;John@example.com&#34;.</p><p>The RPC server MUST match a name with a row in the view by
using the following rules:</p><ul><li><p><span><span> 
</span></span>If the name is a qualified name, the domain name MUST match the
Domain NetBIOS Name column or Domain DNS Name column, and the name MUST match
the Security Principal Name column. Note that there cannot be multiple matches
in this case (see section <a href="77855eed-d3c7-4538-b527-20a36d4dcb18" data-linktype="relative-path">3.1.1.1</a>).
A domain name match against the Domain DNS Name column MUST NOT be performed if
<i>ClientRevision</i> is 0x00000001 and the machine is joined to a mixed mode
domain, as specified in <a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a>
section <a href="../ms-adts/b40f9606-812d-4b76-924e-55a5401e2bc8" data-linktype="relative-path">6.1.4.1</a>.</p>
</li><li><p><span><span> 
</span></span>If the name is an isolated name:</p>
<ul><li><p><span><span>  </span></span>If
in single-label form, the name MUST match the Security Principal Name column or
the Additional Security Principal Name column.</p>
<ul><li><p><span><span> 
</span></span>If there are multiple matches due to a search in multiple
domains, which can happen in Forest Views, any one of the matches MAY be used
to satisfy the request, as long as a consistent search order is followed.</p>
</li></ul></li><li><p><span><span>  </span></span>If
in user principal name form, the name SHOULD<a id="Appendix_A_Target_27"></a><a aria-label="Product behavior note 27" href="d2715572-2c9b-4198-ace9-316a2fb5d7f5#Appendix_A_27" data-linktype="relative-path">&lt;27&gt;</a> match the
User Principal Name column or the Default User Principal Names column.</p>
<ul><li><p><span><span> 
</span></span>If there are multiple matches on the User Principal Name
attribute, the match MUST fail.</p>
</li><li><p><span><span> 
</span></span>If there is one match with User Principal Name and one match with
Default User Principal Names, the match with the User Principal Name attribute
MUST take precedence.</p>
</li><li><p><span><span> 
</span></span>There cannot be multiple Default User Principal Names matches;
see section 3.1.1.1.</p>
</li></ul></li></ul></li></ul><p>The search scope is defined by the <i>LookupLevel</i>
parameter. The RPC server MUST search only the scopes that are defined by the <i>LookupLevel</i>
parameter and MUST NOT return matches defined outside that scope. The scopes to
search when processing this message are specified in section 2.2.16.</p><p>When a name is matched in the database, or when the domain
name of a composite name is matched in the database, the <i>ReferencedDomains</i>
parameter MUST be searched for an entry that is identical to the following: The
<b>Name</b> field contains the value from the Domain NetBIOS Name column, and
the <b>Sid</b> field contains the value from the Domain SID column. If there is
no such entry, a new entry with the <b>Name</b> field containing the value of
the Domain NetBIOS Name and the <b>Sid</b> field containing the value of the
Domain SID MUST be created and added to the <i>ReferencedDomains</i> list.</p><p>Output parameters MUST be updated using the following
information:</p><ol><li><p><span>    </span>For a successful
search, the corresponding <i>TranslatedSids</i> entry MUST be updated as
follows:</p>
<ul><li><p><span><span>  </span></span>Use:
Security Principal Type column</p>
</li><li><p><span><span>  </span></span>Sid:
Security Principal SID column</p>
</li><li><p><span><span>  </span></span>Flags:</p>
<ul><li><p><span><span> 
</span></span>0x00000001: If the search is not satisfied by matching against
the Security Principal Name column. Also see the paragraph after step 3.</p>
</li><li><p><span><span> 
</span></span>0x00000004: If the search is satisfied by a comparison that uses
the view specified in section <a href="252cb6b0-2edc-4403-9d75-5b2786ba859e" data-linktype="relative-path">3.1.1.1.2</a>, Configurable
Translation Database and Corresponding View. Also see the paragraph after step
3.</p>
</li></ul></li><li><p><span><span>  </span></span>DomainIndex:
Index of the domain in the <i>ReferencedDomains</i> parameter.</p>
</li></ul></li><li><p><span>    </span>If a match
cannot be found for a name, the corresponding <i>TranslatedSids</i> entry MUST
be updated with:</p>
<ul><li><p><span><span>  </span></span>Use:
SidTypeUnknown</p>
</li><li><p><span><span>  </span></span>Sid:
NULL</p>
</li><li><p><span><span>  </span></span>Flags:
0x00000000 (also see the paragraph after step 3)</p>
</li><li><p><span><span>  </span></span>DomainIndex:
-1</p>
</li></ul></li><li><p><span>    </span>If a match
cannot be found for a composite name, but the domain name within the composite
name is found, the corresponding <i>TranslatedSids</i> entry MUST be updated
with:</p>
<ul><li><p><span><span>  </span></span>Use:
SidTypeUnknown</p>
</li><li><p><span><span>  </span></span>Sid:
NULL</p>
</li><li><p><span><span>  </span></span>Flags:
0x00000000 (also see the following paragraph)</p>
</li><li><p><span><span>  </span></span>DomainIndex:
Index of the domain in the <i>ReferencedDomains</i> parameter.</p>
</li></ul></li></ol><p>In all preceding cases, the <b>Flags</b> field MUST contain
0x00000002 when:</p><ul><li><p><span><span> 
</span></span><i>LookupLevel</i> is LsapLookupWksta, LsapLookupPDC,
LsapLookupGC, LsapLookupXForestReferral, or LsapLookupXForestResolve, and</p>
</li><li><p><span><span> 
</span></span>The IsDomainNameInTrustedForest algorithm defined in <a href="../ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47" data-linktype="relative-path">[MS-DRSR]</a>
section <a href="../ms-drsr/f6bf681d-6dc8-407a-8b0b-3f0bd5fcee26" data-linktype="relative-path">5.64.2</a>
(Determining If a Name Is in a Trusted Forest), given the domain name, returns
true, or the IsUPNInTrustedForest algorithm defined in [MS-DRSR] section <a href="../ms-drsr/6cf26ed8-ab44-4d59-81df-368b7722b638" data-linktype="relative-path">5.109</a>,
given the full name to be translated, returns true.</p>
</li></ul><p>The return value MUST be set to STATUS_SUCCESS if all names
are translated correctly.</p><p>If some names are translated correctly but some are not, the
return value MUST be set to STATUS_SOME_NOT_MAPPED.</p><p>If none of the names are translated correctly, the return
value SHOULD<a id="Appendix_A_Target_28"></a><a aria-label="Product behavior note 28" href="d2715572-2c9b-4198-ace9-316a2fb5d7f5#Appendix_A_28" data-linktype="relative-path">&lt;28&gt;</a> be set to STATUS_NONE_MAPPED.</p><p>If <i>LookupLevel</i> is LsapLookupWksta, and the return
code can be identified as an error value (that is, less than 0) other than
STATUS_NONE_MAPPED, <i>ReferencedDomains</i> and the <b>Sids</b> field in the <i>TranslatedSids</i>
structure MUST NOT be returned.</p></div>