<div class="content" name="SamrCreateUser2InDomain" uuid="a98d7fbb-1735-4fbf-b41a-ef363c899002"><p>The SamrCreateUser2InDomain method creates a user.</p><dl>
<dd>
<div><pre> long SamrCreateUser2InDomain(
   [in] SAMPR_HANDLE DomainHandle,
   [in] PRPC_UNICODE_STRING Name,
   [in] unsigned long AccountType,
   [in] unsigned long DesiredAccess,
   [out] SAMPR_HANDLE* UserHandle,
   [out] unsigned long* GrantedAccess,
   [out] unsigned long* RelativeId
 );
</pre></div>
</dd></dl><p><b>DomainHandle: </b>An RPC context handle, as
specified in section <span><a href="8138c078-d881-4d1f-b378-94b4c34a287a" data-linktype="relative-path">2.2.7.2</a></span>,
representing a <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_2346e8d0-b0a0-481f-b644-85c45c60d4d1" data-linktype="relative-path">domain object</a></span>.</p><p><b>Name: </b>The value to use as the name of the
user. See the message processing shown later in this section for details on how
this value maps to the data model.</p><p><b>AccountType: </b>A 32-bit value indicating the
type of <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_8d10bd9d-392e-431b-8218-742bdac19815" data-linktype="relative-path">account</a></span> to create.
See the message processing shown later in this section for possible values.</p><p><b>DesiredAccess: </b>The access requested on the <i>UserHandle</i>
on output. See section <span><a href="c0be3f43-bcf9-43ee-b027-3d02ab372c53" data-linktype="relative-path">2.2.1.7</a></span> for a
listing of possible values.</p><p><b>UserHandle: </b>An RPC context handle, as
specified in section 2.2.7.2.</p><p><b>GrantedAccess: </b>The access granted on <i>UserHandle</i>.</p><p><b>RelativeId: </b>The <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_df3d0b61-56cd-4dac-9402-982f1fedc41c" data-linktype="relative-path">RID</a></span> of the newly
created user.</p><p>This protocol asks the RPC runtime, via the <b>strict_context_handle</b>
attribute, to reject the use of context handles created by a method of a
different RPC interface than this one, as specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/38ae9f5a-dac2-46ad-b2b7-9c43f211d9f6" data-linktype="relative-path">3</a></span>.</p><p>Upon receiving this message, the server MUST process the
data from the message subject to the following constraints:</p><ol><li><p><span>    </span>The server MUST
return an error if <i>DomainHandle.HandleType</i> is not equal to
&#34;Domain&#34;.</p>
</li><li><p><span>    </span><i>DomainHandle.GrantedAccess</i>
MUST have the required access specified in section <span><a href="87bacbd0-7b8b-429f-abc6-4b3d895d4e90" data-linktype="relative-path">3.1.2.2</a></span>. Otherwise,
the server MUST return STATUS_ACCESS_DENIED.</p>
</li><li><p><span>    </span>If <i>DomainHandle.Object</i>
refers to the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_22904540-f2fb-470e-af48-ce1b0e9a02b8" data-linktype="relative-path">built-in domain</a></span>, the
server MUST abort the request and return a failure code.</p>
</li><li><p><span>    </span>The <i>AccountType</i>
parameter from the message MUST be equal to exactly one value from the
following list. If there is no match, an error status MUST be returned.</p>
<ul><li><p><span><span>  </span></span>USER_NORMAL_ACCOUNT</p>
</li><li><p><span><span>  </span></span>USER_WORKSTATION_TRUST_ACCOUNT</p>
</li><li><p><span><span>  </span></span>USER_SERVER_TRUST_ACCOUNT</p>
</li></ul></li><li><p><span>    </span>All updates
caused by this request MUST be performed in the same transaction.</p>
</li><li><p><span>    </span>On successful
completion of this method, a new <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_60122e64-9d34-40ee-a387-782eaf7adf2f" data-linktype="relative-path">database object</a></span> MUST
be created (subsequent constraints specify attributes for this new object).</p>
</li><li><p><span>    </span>The following
database attribute MUST be updated from the values provided in the message
according to the following table.</p>
<table><thead>
  <tr>
   <th>
   <p>Database attribute</p>
   </th>
   <th>
   <p>Message input</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>sAMAccountName</p>
  </td>
  <td>
  <p>Name</p>
  </td>
 </tr></tbody></table>
</li><li><p><span>    </span>The <b>distinguishedName</b>
attribute MUST be updated with a value that conforms to the constraints as
specified in section <span><a href="21b0a86b-89b9-4f66-8862-a25c49620e7f" data-linktype="relative-path">3.1.5.14.1</a></span>. Let the
term Container-Object be the object with the <b>distinguishedName</b> of the
suffix chosen in section 3.1.5.14.1 for the new object. For a computer object,
for example, Container-Object is, by default, the object with the <b>distinguishedName</b>
CN=Computers,&lt;DN of account domain object&gt;.</p>
</li><li><p><span>    </span>The <b>objectClass</b>
database attribute MUST be updated with a value determined as follows:</p>
<ol><li><p><span>   
</span>If the <i>AccountType</i> parameter is USER_WORKSTATION_TRUST_ACCOUNT or
USER_SERVER_TRUST_ACCOUNT, use computer.</p>
</li><li><p><span>   
</span>Otherwise, use user.</p>
</li></ol></li><li><p><span>  </span>The client&#39;s <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_95f17071-c8f1-403a-8a92-cf87aa7d40f5" data-linktype="relative-path">token</a></span>
MUST be retrieved using the method described in [MS-RPCE] section <span><a href="../ms-rpce/29b8217a-0bda-4fdb-a3ea-48560125ae8d" data-linktype="relative-path">3.3.3.4.3</a></span>.</p>
</li><li><p><span>  </span>The <b>userAccountControl</b>
attribute MUST be updated with a value from the following table. <i>AccountType</i>
is the <i>AccountType</i> parameter from the message. </p>
<table><thead>
  <tr>
   <th>
   <p>AccountType</p>
   </th>
   <th>
   <p>userAccountControl</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>USER_NORMAL_ACCOUNT</p>
  </td>
  <td>
  <p>UF_NORMAL_ACCOUNT | UF_ACCOUNTDISABLE</p>
  </td>
 </tr><tr>
  <td>
  <p>USER_WORKSTATION_TRUST_ACCOUNT</p>
  </td>
  <td>
  <p>UF_WORKSTATION_TRUST_ACCOUNT | UF_ACCOUNTDISABLE*</p>
  </td>
 </tr><tr>
  <td>
  <p>USER_SERVER_TRUST_ACCOUNT</p>
  </td>
  <td>
  <p>UF_SERVER_TRUST_ACCOUNT | UF_ACCOUNTDISABLE</p>
  </td>
 </tr></tbody></table>
<p>*If all the following
conditions hold true, then the <b>userAccountControl</b> attribute MUST be
updated only with the UF_WORKSTATION_TRUST_ACCOUNT value.</p>
<ul><li><p><span><span>  </span></span>The
<i>AccountType</i> parameter is USER_WORKSTATION_TRUST_ACCOUNT.</p>
</li><li><p><span><span>  </span></span>The
client does not have the ACTRL_DS_CREATE_CHILD access on the Container-Object
object.</p>
</li><li><p><span><span>  </span></span>The
<b>RpcImpersonationAccessToken.Privileges[]</b> field has the SE_
MACHINE_ACCOUNT NAME privilege (defined in <span><a href="../ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc" data-linktype="relative-path">[MS-LSAD]</a></span>
section <span><a href="../ms-lsad/1a92af76-d45f-42c3-b67c-f1dc61bd6ee1" data-linktype="relative-path">3.1.1.2.1</a></span>).</p>
</li></ul></li><li><p><span>  </span>The security model for
object creation specified in <span><a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a></span>
section <span><a href="../ms-adts/4e11a7e6-e18c-46e4-a781-3ca2b4de6f30" data-linktype="relative-path">5.1.3</a></span>
MUST NOT be adhered to.</p>
</li><li><p><span>  </span>If the client does not have
the ACTRL_DS_CREATE_CHILD access right on the Container-Object object, the
client is not otherwise denied access due to an explicit DENY <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_b581857f-39aa-4979-876b-daba67a40f15" data-linktype="relative-path">ACE</a><a id="Appendix_A_Target_55"></a><a aria-label="Product behavior note 55" href="fa61e5fc-f8fb-4d5b-9695-c724af0c3829#Appendix_A_55" data-linktype="relative-path">&lt;55&gt;</a></span>, and the <i>AccountType</i>
parameter is USER_WORKSTATION_TRUST_ACCOUNT, then:</p>
<ol><li><p><span>   
</span>On a <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">DC</a></span> configuration:</p>
<ol><li><p><span>    </span>If the <b>RpcImpersonationAccessToken.Privileges[]</b>
field does not have the SE_MACHINE_ACCOUNT_NAME privilege (defined in [MS-LSAD]
section 3.1.1.2.1), return a processing error.</p>
</li><li><p><span>    </span>Else:</p>
<ol><li><p><span>    </span>Let CallerSid be
RpcImpersonationAccessToken.Sids[RpcImpersonationAccessToken.UserIndex].</p>
</li><li><p><span>    </span>Let
CallerPrimaryGroup be RpcImpersonationAccessToken.PrimaryGroup.</p>
</li><li><p><span>    </span>If
CallerPrimaryGroup is not equal to DOMAIN_GROUP_RID_COMPUTERS, then:</p>
<ol><li><p><span>    </span>The number of
computer objects in the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a></span> with
msDS-creatorSID equal to CallerSid MUST be less than the value of
ms-DS-MachineAccountQuota on the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_3ff707e8-0783-4b16-9370-2899f1078c87" data-linktype="relative-path">account domain object</a></span>.
On error, abort and return a failure code.</p>
</li></ol></li><li><p><span>    </span>If
CallerPrimaryGroup is equal to DOMAIN_GROUP_RID_COMPUTERS, then<a id="Appendix_A_Target_56"></a><a aria-label="Product behavior note 56" href="fa61e5fc-f8fb-4d5b-9695-c724af0c3829#Appendix_A_56" data-linktype="relative-path">&lt;56&gt;</a>:</p>
<ol><li><p><span>    </span>If the domain <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">SID</a></span>
portion of CallerSid is different from the current domain SID, return a failure
code.</p>
</li><li><p><span>    </span>The server MUST
compute the sum of all computer objects in the domain created by CallerSid and
transitively created by other computer objects created by CallerSid. This sum
MUST be less than the value of ms-DS-MachineAccountQuota on the account domain
object. On error, abort and return a failure code.</p>
</li></ol></li><li><p><span>    </span>If the previous
constraints are met, then:</p>
<ol><li><p><span>    </span>msDS-creatorSID
MUST be set to CallerSid.</p>
</li><li><p><span>    </span>The owner and
group of the default <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_e5213722-75a9-44e7-b026-8e4833f0d350" data-linktype="relative-path">security descriptor</a></span>
MUST be the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_d6220a40-b608-4244-8f43-c5a4a0be89ed" data-linktype="relative-path">Domain Admins</a></span> SID
for the domain in which the account is created.</p>
</li></ol></li></ol></li></ol></li><li><p><span>   
</span>On a non-DC configuration:</p>
<ul><li><p><span><span> 
</span></span>The server MUST abort processing and return STATUS_ACCESS_DENIED.</p>
</li></ul></li></ol></li><li><p><span>  </span>The return parameter of <i>GrantedAccess</i>
MUST be set to <i>DesiredAccess</i> if <i>DesiredAccess</i> contains only valid
access masks for the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_e767a471-c3fa-4e4b-a40c-daeb08f82a17" data-linktype="relative-path">user object</a></span> (see
section 2.2.1.7); otherwise, the request MUST be aborted and
STATUS_ACCESS_DENIED MUST be returned. Additionally, on a DC configuration, if
the creation occurred because of a privilege (see step 13.1), the returned <i>GrantedAccess</i>
MUST be restricted by the intersection of <i>DesiredAccess</i> and the
following bits:</p>
<ul><li><p><span><span>  </span></span>DELETE
</p>
</li><li><p><span><span>  </span></span>USER_WRITE</p>
</li><li><p><span><span>  </span></span>USER_FORCE_PASSWORD_CHANGE</p>
</li></ul></li><li><p><span>  </span>If <i>DesiredAccess</i>
contains the ACCESS_SYSTEM_SECURITY bit, the <b>RpcImpersonationAccessToken.Privileges[]</b>
field MUST have the SE_SECURITY_NAME privilege (defined in [MS-LSAD] section
3.1.1.2.1). Otherwise, the server MUST abort processing and return
STATUS_ACCESS_DENIED.</p>
</li></ol></div>