<div class="content" name="LsarOpenPolicy2" uuid="9456a963-7c21-4710-af77-d0a2f5a72d6b"><p>The LsarOpenPolicy2 method opens a context handle to the <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_ae65dac0-cd24-4e83-a946-6d1097b71553" data-linktype="relative-path">RPC
server</a></span>. This is the first function that MUST be called to contact
the Local Security Authority (Domain Policy) Remote Protocol database.</p><dl>
<dd>
<div><pre> NTSTATUS LsarOpenPolicy2(
   [in, unique, string] wchar_t* SystemName,
   [in] PLSAPR_OBJECT_ATTRIBUTES ObjectAttributes,
   [in] ACCESS_MASK DesiredAccess,
   [out] LSAPR_HANDLE* PolicyHandle
 );
</pre></div>
</dd></dl><p><b>SystemName: </b>This parameter does not have any
effect on message processing in any environment. It MUST be ignored on receipt.</p><p><b>ObjectAttributes: </b>This parameter does not have
any effect on message processing in any environment. All fields MUST<a id="Appendix_A_Target_61"></a><a aria-label="Product behavior note 61" href="2a769a08-e023-459f-aebe-4fb3f595c0b7#Appendix_A_61" data-linktype="relative-path">&lt;61&gt;</a> be ignored except <b>RootDirectory</b>
which MUST be NULL.</p><p><b>DesiredAccess: </b>An <span><a href="7aeb7f17-0a6e-4f04-ac7e-7b1363cf9ecf" data-linktype="relative-path">ACCESS_MASK</a></span> value
that specifies the requested access rights that MUST be granted on the returned
PolicyHandle if the request is successful.</p><p><b>PolicyHandle: </b>An <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> context handle
(as specified in section <span><a href="0d093105-e8c8-45f7-a79d-182aafd60c6e" data-linktype="relative-path">2.2.2.1</a></span>) that
represents a reference to the abstract data model of a policy object, as
specified in section <span><a href="c939c70e-8cf0-4d90-a9cc-1c5002951723" data-linktype="relative-path">3.1.1.1</a></span>.</p><p><b>Return Values: </b>The following is a summary of
the return values that an implementation MUST return, as specified by the
message processing below.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Return value/code</p>
   </th>
   <th>
   <p>Description</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x00000000 STATUS_SUCCESS</td>
  <td>The request was successfully completed.</td>
 </tr><tr>
  <td>0xC0000022 STATUS_ACCESS_DENIED</td>
  <td>The caller does not have the permissions to perform this operation.</td>
 </tr><tr>
  <td>0xC000000D STATUS_INVALID_PARAMETER</td>
  <td>One of the supplied parameters is incorrect. For example, this can happen when ObjectAttributes is NULL or DesiredAccess is zero.</td>
 </tr></tbody></table>
</dd></dl><p>Processing:</p><p><i>DesiredAccess</i>: A bitmask specifying the access that
the caller attempts to obtain on the policy object, which is access-checked
according to section <span><a href="e5e1e32e-4066-435d-b669-044fe997eaf7" data-linktype="relative-path">3.1.4.2.1</a></span>. The
method-specific portion of the check is the following:</p><dl>
<dd>
<div><pre> LET serverInfo be a SERVER_INFO_101 structure
 CALL ServerGetInfo(101, &amp;serverInfo)
 LET isDomainController be a boolean initialized to FALSE
 IF (serverInfo.sv101_version_type &amp; (SV_TYPE_DOMAIN_CTRL | SV_TYPE_DOMAIN_BAKCTRL)) THEN
     Set isDomainController equal to TRUE
 END IF
            
 IF ((isDomainController equals FALSE) and (IsRequestorAnonymous() and LsaRestrictAnonymous is set to TRUE)) THEN
     Return STATUS_ACCESS_DENIED
 END IF
</pre></div>
</dd></dl><p>SERVER_INFO_101, SV_TYPE_DOMAIN_CTRL, and
SV_TYPE_DOMAIN_BACKCTRL are specified in <span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/39c502dd-022b-4a68-9367-89fd76a23bc3" data-linktype="relative-path">2.3.12</a></span>.
The ServerGetInfo procedure is specified in [MS-DTYP] section <span><a href="../ms-dtyp/af09da35-4960-4562-adab-b89a1dfb6f16" data-linktype="relative-path">2.6</a></span>.
The valid account-rights bits are specified in section <span><a href="b61b7268-987a-420b-84f9-6c75f8dc8558" data-linktype="relative-path">2.2.1.1.2</a></span>,
and the <span><a href="31ca2a31-0be4-4773-bcef-05ad6cd3ccfb#gt_e5213722-75a9-44e7-b026-8e4833f0d350" data-linktype="relative-path">security descriptor</a></span>
is specified in section 3.1.1.1.  The IsRequestorAnonymous procedure is
specified in section <span><a href="5d50b55f-e9c7-4af6-bf85-02e8043f66ea" data-linktype="relative-path">3.1.4.2.3</a></span>.</p><p><i>PolicyHandle</i>: If the request is successful, the
server MUST create and return a context handle (section <span><a href="1011130b-0413-460d-81ed-d1821d141639" data-linktype="relative-path">3.1.1.7</a></span>)
via <i>PolicyHandle</i>, with its fields initialized as follows:</p><ul><li><p><span><span> 
</span></span>LsaContextHandle.HandleType = &#34;Policy&#34;</p>
</li><li><p><span><span> 
</span></span>LsaContextHandle.Object = the policy object</p>
</li><li><p><span><span> 
</span></span>LsaContextHandle.GrantedAccess = as specified in section
3.1.4.2.1</p>
</li></ul><p>The return value MUST be set to STATUS_SUCCESS in this case.</p><p>The LsarOpenPolicy3 method supersedes this message and MUST
be used whenever possible.</p></div>