<div class="content" name="BackuprKey" uuid="7accb903-3863-4385-9c99-11af8c18d656"><p>This section specifies the <b>BackuprKey</b> method.</p><dl>
<dd>
<div><pre> NET_API_STATUS BackuprKey(
   [in] handle_t h,
   [in] GUID* pguidActionAgent,
   [in, size_is(cbDataIn)] byte* pDataIn,
   [in] DWORD cbDataIn,
   [out, size_is(,*pcbDataOut)] byte** ppDataOut,
   [out] DWORD* pcbDataOut,
   [in] DWORD dwParam
 );
</pre></div>
</dd></dl><p><b>h: </b>This is an <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a> binding handle
parameter as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a> and <a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a>
section <a href="../ms-rpce/a01f5886-c485-4bcf-bb23-e0d755510ab7" data-linktype="relative-path">2</a>.</p><p><b>pguidActionAgent: </b>A <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_f49694cc-c350-462d-ab8e-816f0103c6c1" data-linktype="relative-path">GUID</a> RPC structure, as
specified in <a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a>
section <a href="../ms-dtyp/4926e530-816e-41c2-b251-ec5c7aca018a" data-linktype="relative-path">2.3.4</a>.
This MUST be set to one of the following values. The <i>BACKUPKEY_BACKUP_GUID</i>
and <i>BACKUPKEY_RESTORE_GUID_WIN2K</i> values indicate the <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_0d6344a7-948f-4215-b887-8bbe43eb9620" data-linktype="relative-path">ServerWrap subprotocol</a>,
while the <i>BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID</i> and <i>BACKUPKEY_RESTORE_GUID</i>
values indicate the <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_e28261fb-25ef-4781-93e0-7280fece1bc4" data-linktype="relative-path">ClientWrap
subprotocol</a>. A server MUST support at least one of these subprotocols
completely, and all server implementations SHOULD support all four values. In
addition, if a server supports the <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_387b58ea-6abd-41c8-af6c-34206259765f" data-linktype="relative-path">wrapping</a> operation of
either subprotocol, it MUST also support the corresponding unwrap operation.
Thus, if a server supports <i>BACKUPKEY_BACKUP_GUID</i>, then it MUST also
support <i>BACKUPKEY_RESTORE_GUID_WIN2K</i>. Similarly, if a server supports <i>BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID</i>,
it MUST also support <i>BACKUPKEY_RESTORE_GUID</i>.<a id="Appendix_A_Target_9"></a><a aria-label="Product behavior note 9" href="fd8f215a-909d-4c8e-95d0-06268917d9f1#Appendix_A_9" data-linktype="relative-path">&lt;9&gt;</a></p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>BACKUPKEY_BACKUP_GUID 7F752B10-178E-11D1-AB8F-00805F14DB40</td>
  <td>Requests server-side wrapping. On input, pDataIn MUST point to a BLOB containing the secret to be wrapped. The server MUST treat pDataIn as opaque binary data. On output, ppDataOut MUST contain the wrapped secret in the format specified in section 2.2.4. For details, see section 3.1.4.1.1.</td>
 </tr><tr>
  <td>BACKUPKEY_RESTORE_GUID_WIN2K 7FE94D50-178E-11D1-AB8F-00805F14DB40</td>
  <td>Requests unwrapping of a server-side-wrapped secret. On input, pDataIn MUST point to a BLOB containing the wrapped key, in the format specified in section 2.2.4. On output, ppDataOut MUST contain a pointer to the unwrapped secret, as supplied by the client to the BACKUPKEY_BACKUP_GUID call. For details, see section 3.1.4.1.2.</td>
 </tr><tr>
  <td>BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID 018FF48A-EABA-40C6-8F6D-72370240E967</td>
  <td>Requests the public key part of the server&#39;s ClientWrap key pair. The server MUST ignore the pDataIn and cbDataIn parameters. On output, ppDataOut MUST contain a pointer to the server&#39;s public key in the format specified in section 2.2.1. For details, see section 3.1.4.1.3.</td>
 </tr><tr>
  <td>BACKUPKEY_RESTORE_GUID 47270C64-2FC7-499B-AC5B-0E37CDCE899A</td>
  <td>Request unwrapping of a secret that was client-side-wrapped with the server&#39;s public key. On input, pDataIn MUST point to a client-side wrapped key, formatted as specified in section 2.2.2. On output, ppDataOut MUST contain a pointer to the unwrapped secret, formatted as specified in section 2.2.3. For details, see section 3.1.4.1.4.</td>
 </tr></tbody></table>
</dd></dl><p><b>pDataIn: </b>This is the input data supplied by
the client. Its format depends on <i>pguidActionAgent</i> as specified in this
section.</p><p><b>cbDataIn: </b>This MUST be an unsigned 32-bit
integer, encoded in <a href="32d60aa4-e40c-414a-986c-db731aca7e71#gt_079478cb-f4c5-4ce5-b72b-2144da5d2ce7" data-linktype="relative-path">little-endian</a>
format. It MUST be equal to the length, in bytes, of the data supplied in <i>pDataIn</i>.</p><p><b>ppDataOut: </b>This is the output data returned to
the client. Its format depends on <i>pguidActionAgent</i> as specified in this
section.</p><p><b>pcbDataOut: </b>This MUST be an unsigned 32-bit
integer, encoded in little-endian format. It MUST be equal to the length, in
bytes, of the data returned in <i>pDataOut</i>.</p><p><b>dwParam: </b>This parameter is unused. It MUST be
ignored by the server.</p><p><b>Return Values: </b>The server MUST return 0 if it
successfully processes the message received from the client, and a nonzero
value otherwise.</p><p><b>Exceptions Thrown:</b> No exceptions are thrown
beyond those thrown by the underlying RPC protocol [MS-RPCE].</p><p>Upon receiving a BackuprKey message, the server MUST check
the <i>pguidActionAgent</i> parameter. If the server does not support the value
specified for this parameter, the server MUST return ERROR_INVALID_PARAMETER
(0x57). Otherwise, the server MUST continue processing as specified in the
appropriate subsection below.</p></div>