<div class="content" name="SamrEnumerateUsersInDomain" uuid="6bdc92c0-c692-4ffb-9de7-65858b68da75"><p>The SamrEnumerateUsersInDomain method enumerates all users.</p><dl>
<dd>
<div><pre> long SamrEnumerateUsersInDomain(
   [in] SAMPR_HANDLE DomainHandle,
   [in, out] unsigned long* EnumerationContext,
   [in] unsigned long UserAccountControl,
   [out] PSAMPR_ENUMERATION_BUFFER* Buffer,
   [in] unsigned long PreferedMaximumLength,
   [out] unsigned long* CountReturned
 );
</pre></div>
</dd></dl><p><b>DomainHandle: </b>An RPC context handle, as
specified in section <span><a href="8138c078-d881-4d1f-b378-94b4c34a287a" data-linktype="relative-path">2.2.7.2</a></span>,
representing a <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_2346e8d0-b0a0-481f-b644-85c45c60d4d1" data-linktype="relative-path">domain object</a></span>.</p><p><b>EnumerationContext: </b>This value is a cookie
that the server can use to continue an enumeration on a subsequent call. It is
an opaque value to the client. To initiate a new enumeration the client sets <i>EnumerationContext</i>
to zero. Otherwise the client sets <i>EnumerationContext</i> to a value
returned by a previous call to the method. </p><p><b>UserAccountControl: </b>A filter value to be used
on the <b>userAccountControl</b> attribute.</p><p><b>Buffer: </b>A list of user information, as
specified in section <span><a href="c53161a4-38e8-4a28-a33e-0d378fce03dd" data-linktype="relative-path">2.2.7.10</a></span>.</p><p><b>PreferedMaximumLength: </b>The requested maximum
number of bytes to return in <i>Buffer</i>.</p><p><b>CountReturned: </b>The count of <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a></span>
elements returned in <i>Buffer</i>.</p><p>This protocol asks the RPC runtime, via the <b>strict_context_handle</b>
attribute, to reject the use of context handles created by a method of a
different RPC interface than this one, as specified in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/38ae9f5a-dac2-46ad-b2b7-9c43f211d9f6" data-linktype="relative-path">3</a></span>.</p><p>This method MUST be processed per the specifications in
section <span><a href="672e23b6-16eb-45f7-a0eb-f7969d56c209" data-linktype="relative-path">3.1.5.2.2</a></span>, using
the following object selection filter:</p><ol><li><p><span>    </span>The <b>objectClass</b>
attribute value MUST be user or derived from user.</p>
</li><li><p><span>    </span>The <b>userAccountControl</b>
attribute value MUST contain all the bits in the method parameter <i>UserAccountControl</i>.</p>
</li><li><p><span>    </span>The <b>objectSid</b>
attribute value MUST have the <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_9066e9dc-8275-4452-9073-daab5fd427c5" data-linktype="relative-path">domain prefix</a></span> of the
domain referenced by <i>DomainHandle</i>.</p>
</li></ol><p>In addition, all of the following constraints MUST be
satisfied before the constraints of section 3.1.5.2.2 are satisfied:</p><ol><li><p><span>    </span>If <i>DomainHandle.Object</i>
is a reference to the account domain and the configuration is <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">DC</a></span>,
the client MUST have the SAM-Enumerate-Entire-Domain <span><a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_42f6c9e0-a2b3-4bc3-9b87-fdb902e5505e" data-linktype="relative-path">control access right</a></span>
(<span><a href="../ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a" data-linktype="relative-path">[MS-ADTS]</a></span>
section <span><a href="../ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb" data-linktype="relative-path">5.1.3.2.1</a></span>)
on the domain&#39;s <b>ntSecurityDescriptor</b> attribute value.</p>
</li><li><p><span>    </span>The server MUST
ignore the UF_LOCKOUT and UF_PASSWORD_EXPIRED bits in the <i>UserAccountControl</i>
parameter.</p>
</li></ol></div>