Desktop Functions:

   Smart Device Functions:

Show Recent Changes
Subscribe (RSS)
Misc. Pages
Helpful Tools
Suggested Reading
Website TODO List
Support Forum
Download Visual Studio Add-In

Terms of Use
Privacy Policy
LsaRemoveAccountRights (advapi32)
The LsaRemoveAccountRights function removes one or more privileges from an account.

C# Signature:

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

    static extern uint LsaRemoveAccountRights(
    IntPtr PolicyHandle,
    byte[] AccountSid,
    bool AllRights,
    LSA_UNICODE_STRING[] UserRights,
    uint CountOfRights);

VB Signature:

    Private Declare Unicode Function LsaRemoveAccountRights Lib "advapi32.dll" ( _
    ByVal PolicyHandle As IntPtr, _
    ByVal AccountSid As IntPtr, _
    ByVal AllRights As Boolean, _
    ByRef UserRights As LSA_UNICODE_STRING, _
    ByVal CountOfRights As Integer _
    ) As Integer

User-Defined Types:


Alternative Managed API:

Do you know one? Please contribute it!


    'NTSTATUS LsaRemoveAccountRights(
    '  LSA_HANDLE PolicyHandle,
    '  PSID AccountSid,
    '  BOOLEAN AllRights,
    '  PLSA_UNICODE_STRING[] UserRights,
    '  ULONG CountOfRights

Tips & Tricks:

    The UserRights parameter is really an array of LSA_UNICODE_STRINGS

VB.Net Sample Code:

    Private WinWorldSid As Integer = 1
    Private POLICY_ALL_ACCESS As Integer = &HF0FFF
    Private SECURITY_MAX_SID_SIZE As Integer = 68
    Private SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME As String = "SeDenyRemoteInteractiveLogonRight"
    Private NT_STATUS_OBJECT_NAME_NOT_FOUND As Integer = &HC0000034
    Private STATUS_NO_MORE_ENTRIES As Integer = &H8000001A

    ' Remove the Deny permission
    Public Sub AllowTS(ByVal PC As String)
    Dim ret, Access, sidsize As Integer
    Dim SystemName, DenyTSRights As LSA_UNICODE_STRING
    Dim Policy, EveryoneSID As IntPtr

    ' build a well-known SID for "Everyone"
    EveryoneSID = Marshal.AllocHGlobal(sidsize)
    If CreateWellKnownSid(WinWorldSid, IntPtr.Zero, EveryoneSID, sidsize) = False Then
        ret = Marshal.GetLastWin32Error()
        Throw New Win32Exception(ret)
    End If

    ' setup the parameters for the LsaOpenPolicy API
    ObjectAttr.Length = Marshal.SizeOf(ObjectAttr)
    SystemName.Length = PC.Length * UnicodeEncoding.CharSize
    SystemName.MaximumLength = (PC.Length + 1) * UnicodeEncoding.CharSize
    SystemName.Buffer = Marshal.StringToHGlobalUni(PC)

    ' open a policy handle on the remote PC
    ret = LsaOpenPolicy(SystemName, ObjectAttr, Access, Policy)
    If ret <> 0 Then
        Throw New Win32Exception(LsaNtStatusToWinError(ret))
    End If

    ' clean up

    ' Setup the input parameters for the LsaRemoveAccountRights API
    DenyTSRights.Length = SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME.Length * UnicodeEncoding.CharSize
    DenyTSRights.MaximumLength = (SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME.Length + 1) * UnicodeEncoding.CharSize
    DenyTSRights.Buffer = Marshal.StringToHGlobalUni(SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME)

    ' do it!
    ret = LsaRemoveAccountRights(Policy, EveryoneSID, False, DenyTSRights, 1)
    If ret <> 0 And ret <> NT_STATUS_OBJECT_NAME_NOT_FOUND Then
        Throw New Win32Exception(LsaNtStatusToWinError(ret))
    End If

    ' clean up
    End Sub


Please edit this page!

Do you have...

  • helpful tips or sample code to share for using this API in managed code?
  • corrections to the existing content?
  • variations of the signature you want to share?
  • additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).

Access directly from VS:
Terms of Use
Edit This Page
Find References
Show Printable Version