/* * Includes */ #include #include #include #include #include #include #include #include #include #include #include #include #include // For more info, check out \\index1\src\nt\private\security\tools\delegate\ldap.c #include "usrprop.h" #include "regapi.h" extern "C" { BOOLEAN RegGetUserPolicy( LPWSTR userSID , PPOLICY_TS_USER pPolicy , PUSERCONFIGW pData ); void RegGetMachinePolicy( PPOLICY_TS_MACHINE pPolicy ); void RegMergeMachinePolicy( PPOLICY_TS_MACHINE pPolicy, USERCONFIGW *pMachineConfigData , WINSTATIONCREATE * pCreate ); BOOLEAN RegDenyTSConnectionsPolicy(); DWORD WaitForTSConnectionsPolicyChanges( BOOLEAN bWaitForAccept, HANDLE hExtraEvent); BOOLEAN RegGetMachinePolicyEx( BOOLEAN forcePolicyRead, FILETIME *pTime , PPOLICY_TS_MACHINE pPolicy ); BOOLEAN RegIsMachineInHelpMode(); } extern "C" { // HKEY g_hTSPolicyKey = NULL;//handle to TS_POLICY_SUB_TREE key HKEY g_hTSControlKey = NULL;//handle to REG_CONTROL_TSERVER key } /****************************************************************** * * * Check to see if the policy is set to stop accepting connections * * * ******************************************************************/ BOOLEAN RegDenyTSConnectionsPolicy() { LONG errorCode = ERROR_SUCCESS; DWORD ValueType; DWORD ValueSize = sizeof(DWORD); DWORD valueData ; // // first check the policy tree, // if( !g_hTSPolicyKey ) { errorCode = RegOpenKeyEx( HKEY_LOCAL_MACHINE, TS_POLICY_SUB_TREE, 0, KEY_READ, &g_hTSPolicyKey ); //If error code is ERROR_FILE_NOT_FOUND, this is not an error. if( !g_hTSPolicyKey && errorCode != ERROR_FILE_NOT_FOUND ) { //we could not open policy key for some reason other //than key not found. //return TRUE to be on the safe side return TRUE; } } if ( g_hTSPolicyKey ) { errorCode = RegQueryValueEx( g_hTSPolicyKey, POLICY_DENY_TS_CONNECTIONS , NULL, &ValueType, (LPBYTE) &valueData, &ValueSize ); switch( errorCode ) { case ERROR_SUCCESS : return ( valueData ? TRUE : FALSE ) ; // we have data from the policyKey handle to return break; case ERROR_KEY_DELETED: // Group policy must have deleted this key, close it // Then, below we check for the local machine key RegCloseKey( g_hTSPolicyKey ); g_hTSPolicyKey = NULL; break; case ERROR_FILE_NOT_FOUND: // there is no policy from GP, so see (below) what the local machine // value has. break; default: // if we are having any other kind of a problem, claim TRUE and // stop connections to be on the safe side (a security angle). return TRUE; break; } } // if we got this far, then no policy was set. Check the local machine now. if( !g_hTSControlKey ) { errorCode = RegOpenKeyEx( HKEY_LOCAL_MACHINE, REG_CONTROL_TSERVER, 0, KEY_READ, &g_hTSControlKey ); } if ( g_hTSControlKey ) { errorCode = RegQueryValueEx( g_hTSControlKey, POLICY_DENY_TS_CONNECTIONS , NULL, &ValueType, (LPBYTE) &valueData, &ValueSize ); if (errorCode == ERROR_SUCCESS ) { return ( valueData ? TRUE : FALSE ) ; // we have data from the policyKey handle to return } } // if no localKey, gee... the registry is missing data... return TRUE to be on the safe side return TRUE; } /****************************************************************** * * * Wait until POLICY_DENY_TS_CONNECTIONS is changed * * * * Parameters: * * bWaitForAccept * * if TRUE, test if connections are accepted and wait for * * them to be accepted if they are not currently accepted. * * if FALSE, test if connections are not accepted and wait * * for them to be denied if they are currently accepted. * * * * hExtraEvent * * optional handle to an event to wait for. * * * * Returns: * * WAIT_OBJECT_0 * * if a change in TS connections policy occurred * * * * WAIT_OBJECT_0 + 1 * * if the extra event is present and signaled * * * ******************************************************************/ // // Note that opening the global g_hTSControlKey without protection // can cause the key to be opened twice. // // This macro is TRUE if the TS connections are denied #define TSConnectionsDenied (RegDenyTSConnectionsPolicy() && \ !(RegIsMachinePolicyAllowHelp() && RegIsMachineInHelpMode())) DWORD WaitForTSConnectionsPolicyChanges( BOOLEAN bWaitForAccept, HANDLE hExtraEvent ) { // // Wait for a policy change if // we want TS connections and they are denied OR // we don't want TS connections and they are accepted // if((bWaitForAccept && TSConnectionsDenied) || (!bWaitForAccept && !TSConnectionsDenied)) { DWORD errorCode = ERROR_SUCCESS; if( !g_hTSControlKey ) { errorCode = RegOpenKeyEx( HKEY_LOCAL_MACHINE, REG_CONTROL_TSERVER, 0, KEY_READ, &g_hTSControlKey ); if( !g_hTSControlKey ) { SetLastError( errorCode ); return WAIT_FAILED; } } HKEY hPoliciesKey = NULL; //We cannot wait for g_hTSPolicyKey because it can be deleted and created //Instead we wait for HKLM\Policies key errorCode = RegOpenKeyEx( HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Policies"), 0, KEY_READ, &hPoliciesKey ); if( !hPoliciesKey ) { SetLastError( errorCode ); return WAIT_FAILED; } HANDLE hEvents[3] = { NULL, NULL, NULL }; hEvents[0] = CreateEvent(NULL,FALSE,FALSE,NULL); hEvents[1] = CreateEvent(NULL,FALSE,FALSE,NULL); hEvents[2] = hExtraEvent; if( !hEvents[0] || !hEvents[1] ) { errorCode = GetLastError(); RegCloseKey(hPoliciesKey); SetLastError( errorCode ); return WAIT_FAILED; } BOOLEAN key1NeedsToBeNotified = TRUE; BOOLEAN key2NeedsToBeNotified = TRUE; DWORD whichObject; for( ;; ) { if (key1NeedsToBeNotified) { errorCode = RegNotifyChangeKeyValue(g_hTSControlKey, FALSE,REG_NOTIFY_CHANGE_LAST_SET, hEvents[0], TRUE ); if( errorCode != ERROR_SUCCESS ) { CloseHandle( hEvents[0] ); CloseHandle( hEvents[1] ); RegCloseKey(hPoliciesKey); SetLastError( errorCode ); return WAIT_FAILED; } else { key1NeedsToBeNotified = FALSE; } } if (key2NeedsToBeNotified) { errorCode = RegNotifyChangeKeyValue(hPoliciesKey, TRUE,REG_NOTIFY_CHANGE_LAST_SET | REG_NOTIFY_CHANGE_NAME, hEvents[1], TRUE ); if( errorCode != ERROR_SUCCESS ) { CloseHandle( hEvents[0] ); CloseHandle( hEvents[1] ); RegCloseKey(hPoliciesKey); SetLastError( errorCode ); return WAIT_FAILED; } else { key2NeedsToBeNotified = FALSE; } } if ( hExtraEvent == NULL ) { whichObject = WaitForMultipleObjects(2,hEvents,FALSE,INFINITE); } else { whichObject = WaitForMultipleObjects(3,hEvents,FALSE,INFINITE); } if(whichObject == WAIT_FAILED) { errorCode = GetLastError(); CloseHandle( hEvents[0] ); CloseHandle( hEvents[1] ); RegCloseKey(hPoliciesKey); SetLastError( errorCode ); return WAIT_FAILED; } else { if ( whichObject == WAIT_OBJECT_0 ) { key1NeedsToBeNotified = TRUE; } else if ( whichObject == WAIT_OBJECT_0 + 1 ) { key2NeedsToBeNotified = TRUE; } else if ( (whichObject == WAIT_OBJECT_0 + 2) && hExtraEvent ) { CloseHandle( hEvents[0] ); CloseHandle( hEvents[1] ); RegCloseKey(hPoliciesKey); return WAIT_OBJECT_0 + 1; } else { KdPrint(("ERROR : WaitForTSConnectionsPolicyChanges()'s WaitForMultipleObjects() returned 0x%lx\n", whichObject )); } /* if((bWaitForAccept && TSConnectionsDenied) || (!bWaitForAccept && !TSConnectionsDenied)) { continue; } else { break; } */ // always return, the tests will be done by the caller break; } } CloseHandle( hEvents[0] ); CloseHandle( hEvents[1] ); RegCloseKey(hPoliciesKey); } return WAIT_OBJECT_0; } /******************************************************************************** * * GPGetNumValue() * * Params * [in] policyKey : hkey to the policy reg tree where values are stored * [in] ValueName : name of the value (which is the policy) we are looking for * [out] pValueData: the data for the policy * * Return: * if the policy defined by the passed in valuename is present, then * return TRUE. Else, return FALSE * ********************************************************************************/ BOOLEAN GPGetNumValue( HKEY policyKey, LPWSTR ValueName, DWORD *pValueData ) { LONG Status = ERROR_SUCCESS; DWORD ValueType; DWORD ValueSize = sizeof(DWORD); // init data value to zero, just to get Prefix off our backs. This is a wasted OP // since unless policy is set, value is not used. *pValueData = 0; // // See if any values are present from the policyKey . // if ( policyKey ) { Status = RegQueryValueEx( policyKey, ValueName, NULL, &ValueType, (LPBYTE) pValueData, &ValueSize ); if (Status == ERROR_SUCCESS ) { return TRUE; // we have data from the policyKey handle to return } } // else, no key means policy is not set return FALSE; } /******************************************************************************** * * GPGetStringValue() * * same as GPGetNumValue() but for policies that have a string value * * ********************************************************************************/ BOOLEAN GPGetStringValue( HKEY policyKey, LPWSTR ValueName, LPWSTR pValueData, DWORD MaxValueSize ) { LONG Status; DWORD ValueType; DWORD ValueSize = MaxValueSize << 1; if (policyKey ) { Status = RegQueryValueEx( policyKey, ValueName, NULL, &ValueType, (LPBYTE) pValueData, &ValueSize ); if ( Status != ERROR_SUCCESS || ValueSize == sizeof(UNICODE_NULL) ) { return FALSE; // no data found. } else { if ( ValueType != REG_SZ ) { return FALSE; // bad data, pretend we have no data. } } // we did get data return( TRUE ); } return FALSE; } /******************************************************************************* * * GPQueryUserConfig * * query USERCONFIG structure * * Params: * policyKey : hkey to the HKCU policy tree * pPolicy : points to the user policy struct which has flags for any policy * value that is present in the policy tree * pUser : pointer to a userconfigw struct used as a sracth pad to hold the * policy values (if present). * Return: * void * ******************************************************************************/ VOID GPQueryUserConfig( HKEY policyKey, PPOLICY_TS_USER pPolicy , PUSERCONFIGW pUser ) { UCHAR seed; UNICODE_STRING UnicodePassword; WCHAR encPassword[ PASSWORD_LENGTH + 2 ]; DWORD dwTmpValue; // ---------------- pPolicy->fPolicyInitialProgram = GPGetStringValue( policyKey, WIN_INITIALPROGRAM, pUser->InitialProgram, INITIALPROGRAM_LENGTH + 1 ); GPGetStringValue( policyKey, WIN_WORKDIRECTORY, pUser->WorkDirectory, DIRECTORY_LENGTH + 1 ); // ---------------- pPolicy->fPolicyResetBroken = GPGetNumValue( policyKey,WIN_RESETBROKEN , & dwTmpValue ); pUser->fResetBroken = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyReconnectSame = GPGetNumValue( policyKey,WIN_RECONNECTSAME , &dwTmpValue ); pUser->fReconnectSame = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyShadow = GPGetNumValue( policyKey, WIN_SHADOW, &dwTmpValue ); pUser->Shadow = (SHADOWCLASS) dwTmpValue; // ---------------- pPolicy->fPolicyMaxSessionTime = GPGetNumValue( policyKey, WIN_MAXCONNECTIONTIME , &dwTmpValue ); pUser->MaxConnectionTime = dwTmpValue; // ---------------- pPolicy->fPolicyMaxDisconnectionTime = GPGetNumValue( policyKey,WIN_MAXDISCONNECTIONTIME ,&dwTmpValue ); pUser->MaxDisconnectionTime = dwTmpValue; // ---------------- pPolicy->fPolicyMaxIdleTime = GPGetNumValue( policyKey,WIN_MAXIDLETIME , &dwTmpValue ); pUser->MaxIdleTime = dwTmpValue; // ---------------- pPolicy->fPolicyCallback = GPGetNumValue( policyKey, WIN_CALLBACK, &dwTmpValue ); pUser->Callback = (CALLBACKCLASS ) dwTmpValue; // ---------------- pPolicy->fPolicyCallbackNumber = GPGetStringValue( policyKey, WIN_CALLBACKNUMBER, pUser->CallbackNumber, CALLBACK_LENGTH + 1 ); // ---------------- pPolicy->fPolicyAutoClientDrives = GPGetNumValue( policyKey,WIN_AUTOCLIENTDRIVES , &dwTmpValue ); pUser->fAutoClientDrives = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyAutoClientLpts = GPGetNumValue( policyKey,WIN_AUTOCLIENTLPTS , &dwTmpValue ); pUser->fAutoClientLpts = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyForceClientLptDef = GPGetNumValue( policyKey,WIN_FORCECLIENTLPTDEF , &dwTmpValue ); pUser->fForceClientLptDef = (BOOLEAN) dwTmpValue; } /******************************************************************************* * RegGetUserPolicy() * * Params: * [in] userSID : user sid in a text format * [out] pPolicy : user policy struct * [out] pUser : policy values * * Return: * BOOLEAN : TRUE if user policy was found * FALSE if there was a problem getting user policy *******************************************************************************/ BOOLEAN RegGetUserPolicy( LPWSTR userSID , PPOLICY_TS_USER pPolicy, PUSERCONFIGW pUser ) { DWORD status= ERROR_SUCCESS; HKEY policyKey; WCHAR userHive [MAX_PATH]; if (userSID) // this would never happen, but Master Prefix complains and we must server him! { wcscpy(userHive, userSID); wcscat(userHive, L"\\"); wcscat(userHive, TS_POLICY_SUB_TREE ); status = RegOpenKeyEx( HKEY_USERS, userHive , 0, KEY_READ, &policyKey ); if (status == ERROR_SUCCESS ) { GPQueryUserConfig( policyKey, pPolicy, pUser ); RegCloseKey( policyKey ); return TRUE; } } return FALSE; } /******************************************************************************* * GPQueryMachineConfig() * * Params: * [in] policyKey : key to the policy tree under hklm * [out] pPolicy : pointer to a machine policy data that is filled up by this function * * Return: * void * * * !!! WARNING !!! * * All TS related values MUST be in the flat TS-POLICY-TREE, no sub keys. * This is due to the fact that time-stamp checks by the caller of RegGetMachinePolicyEx() will * check the time stamp on the TS-POLICY key, which is NOT updated when a value in a sub-key is * altered. * * *******************************************************************************/ void GPQueryMachineConfig( HKEY policyKey, PPOLICY_TS_MACHINE pPolicy ) { DWORD dwTmpValue; // ---------------- SessionDirectoryActive pPolicy->fPolicySessionDirectoryActive = GPGetNumValue( policyKey,WIN_SESSIONDIRECTORYACTIVE, &dwTmpValue ); pPolicy->SessionDirectoryActive = (BOOLEAN) dwTmpValue; // ---------------- SessionDirectoryLocation pPolicy->fPolicySessionDirectoryLocation = GPGetStringValue( policyKey, WIN_SESSIONDIRECTORYLOCATION , pPolicy->SessionDirectoryLocation, DIRECTORY_LENGTH + 1 ); // ---------------- SessionDirectoryClusterName pPolicy->fPolicySessionDirectoryClusterName = GPGetStringValue( policyKey, WIN_SESSIONDIRECTORYCLUSTERNAME , pPolicy->SessionDirectoryClusterName, DIRECTORY_LENGTH + 1 ); // ---------------- SessionDirectoryAdditionalParams pPolicy->fPolicySessionDirectoryAdditionalParams = GPGetStringValue( policyKey, WIN_SESSIONDIRECTORYADDITIONALPARAMS , pPolicy->SessionDirectoryAdditionalParams, DIRECTORY_LENGTH + 1 ); // ---------------- Clipboard pPolicy->fPolicyDisableClip = GPGetNumValue( policyKey,WIN_DISABLECLIP, &dwTmpValue ); pPolicy->fDisableClip = (BOOLEAN) dwTmpValue; // ---------------- Audio pPolicy->fPolicyDisableCam = GPGetNumValue( policyKey,WIN_DISABLECAM , &dwTmpValue ); pPolicy->fDisableCam = (BOOLEAN) dwTmpValue; // ---------------- Comport pPolicy->fPolicyDisableCcm = GPGetNumValue( policyKey,WIN_DISABLECCM , &dwTmpValue ); pPolicy->fDisableCcm = (BOOLEAN) dwTmpValue; // ---------------- LPT pPolicy->fPolicyDisableLPT = GPGetNumValue( policyKey,WIN_DISABLELPT , &dwTmpValue ); pPolicy->fDisableLPT = (BOOLEAN) dwTmpValue; // ---------------- PRN pPolicy->fPolicyDisableCpm = GPGetNumValue( policyKey,WIN_DISABLECPM , &dwTmpValue ); pPolicy->fDisableCpm = (BOOLEAN) dwTmpValue; // ---------------- Password pPolicy->fPolicyPromptForPassword = GPGetNumValue( policyKey, WIN_PROMPTFORPASSWORD , &dwTmpValue ); pPolicy->fPromptForPassword = (BOOLEAN) dwTmpValue; // ---------------- Max Instance Count pPolicy->fPolicyMaxInstanceCount = GPGetNumValue( policyKey,WIN_MAXINSTANCECOUNT , &dwTmpValue ); pPolicy->MaxInstanceCount = dwTmpValue; // ---------------- Min Encryption Level pPolicy->fPolicyMinEncryptionLevel = GPGetNumValue( policyKey, WIN_MINENCRYPTIONLEVEL , &dwTmpValue ); pPolicy->MinEncryptionLevel = (BYTE) dwTmpValue; // ---------------- AutoReconect pPolicy->fPolicyDisableAutoReconnect = GPGetNumValue( policyKey, WIN_DISABLEAUTORECONNECT , &dwTmpValue ); pPolicy->fDisableAutoReconnect = (BOOLEAN) dwTmpValue; // New machine wide profile, home dir and home drive pPolicy->fPolicyWFProfilePath = GPGetStringValue( policyKey, WIN_WFPROFILEPATH, pPolicy ->WFProfilePath, DIRECTORY_LENGTH + 1 ); pPolicy->fPolicyWFHomeDir = GPGetStringValue( policyKey, WIN_WFHOMEDIR , pPolicy->WFHomeDir, DIRECTORY_LENGTH + 1 ); pPolicy->fPolicyWFHomeDirDrive =GPGetStringValue( policyKey, WIN_WFHOMEDIRDRIVE, pPolicy->WFHomeDirDrive, 4 ); // if home dir is of the form "driveletter:\path" (such as c:\foo), null out the dir-drive to // eliminate any confusion. if ( pPolicy->WFHomeDir[1] == L':' ) { pPolicy->WFHomeDirDrive[0] = L'\0'; } // --------------- deny connection policy, this is directly read by RegDenyTSConnectionsPolicy() too pPolicy->fPolicyDenyTSConnections = GPGetNumValue( policyKey, POLICY_DENY_TS_CONNECTIONS , &dwTmpValue ); pPolicy->fDenyTSConnections = (BOOLEAN) dwTmpValue; // track the rest of all possivle GP policies // even thou not all are used by term-srv's USERCONFIGW . A good example is the // delete tmp folders that Winlogon/wlnotify uses. // --------------- Per session tmp folders, WARNING : GINA reads policy tree directly for the sake of lower overhead during login pPolicy->fPolicyTempFoldersPerSession = GPGetNumValue( policyKey, REG_TERMSRV_PERSESSIONTEMPDIR , &dwTmpValue ); pPolicy-> fTempFoldersPerSession = (BOOLEAN) dwTmpValue; // -------------- delete per session folders on exit, WARNING : GINA reads policy tree directly for the sake of lower overhead during login pPolicy->fPolicyDeleteTempFoldersOnExit = GPGetNumValue( policyKey, REG_CITRIX_DELETETEMPDIRSONEXIT , &dwTmpValue ); pPolicy->fDeleteTempFoldersOnExit = (BOOLEAN) dwTmpValue; pPolicy->fPolicyPreventLicenseUpgrade = GPGetNumValue( policyKey, REG_POLICY_PREVENT_LICENSE_UPGRADE , &dwTmpValue ); pPolicy->fPreventLicenseUpgrade = (BOOLEAN) dwTmpValue; // -------------- Color Depth pPolicy->fPolicyColorDepth = GPGetNumValue( policyKey, POLICY_TS_COLOR_DEPTH , &dwTmpValue ); // disabled policy will set value to zero, which we will force it // to be the min color depth of 8 bits. if ( dwTmpValue < TS_8BPP_SUPPORT ) { pPolicy->ColorDepth = TS_8BPP_SUPPORT ; } else if ( dwTmpValue == TS_CLIENT_COMPAT_BPP_SUPPORT ) { pPolicy->ColorDepth = TS_24BPP_SUPPORT; // our current max, may change in teh future. } else { pPolicy->ColorDepth = dwTmpValue; } // ---------------- TSCC's permissions TAB pPolicy->fPolicyWritableTSCCPermissionsTAB = GPGetNumValue( policyKey, POLICY_TS_TSCC_PERM_TAB_WRITABLE , &dwTmpValue ); pPolicy->fWritableTSCCPermissionsTAB= (BOOLEAN) dwTmpValue; // ---------------- // Ritu has folded the user policy into machine policy for the drive re-direction. pPolicy->fPolicyDisableCdm = GPGetNumValue( policyKey, WIN_DISABLECDM , &dwTmpValue ); pPolicy->fDisableCdm = (BOOLEAN) dwTmpValue; // ---------------- // fold user config policy into machine config policy pPolicy->fPolicyForceClientLptDef = GPGetNumValue( policyKey,WIN_FORCECLIENTLPTDEF , &dwTmpValue ); pPolicy->fForceClientLptDef = (BOOLEAN) dwTmpValue; // for user config policy into machine config policy // ---------------- pPolicy->fPolicyShadow = GPGetNumValue( policyKey, WIN_SHADOW, &dwTmpValue ); pPolicy->Shadow = (SHADOWCLASS) dwTmpValue; // // ---- Sessions Policy // // ---------------- pPolicy->fPolicyResetBroken = GPGetNumValue( policyKey,WIN_RESETBROKEN , & dwTmpValue ); pPolicy->fResetBroken = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyReconnectSame = GPGetNumValue( policyKey,WIN_RECONNECTSAME , &dwTmpValue ); pPolicy->fReconnectSame = (BOOLEAN) dwTmpValue; // ---------------- pPolicy->fPolicyMaxSessionTime = GPGetNumValue( policyKey, WIN_MAXCONNECTIONTIME , &dwTmpValue ); pPolicy->MaxConnectionTime = dwTmpValue; // ---------------- pPolicy->fPolicyMaxDisconnectionTime = GPGetNumValue( policyKey,WIN_MAXDISCONNECTIONTIME ,&dwTmpValue ); pPolicy->MaxDisconnectionTime = dwTmpValue; // ---------------- pPolicy->fPolicyMaxIdleTime = GPGetNumValue( policyKey,WIN_MAXIDLETIME , &dwTmpValue ); pPolicy->MaxIdleTime = dwTmpValue; // ---------------- Start program policy pPolicy->fPolicyInitialProgram = GPGetStringValue( policyKey, WIN_INITIALPROGRAM, pPolicy->InitialProgram, INITIALPROGRAM_LENGTH + 1 ); GPGetStringValue( policyKey, WIN_WORKDIRECTORY, pPolicy->WorkDirectory, DIRECTORY_LENGTH + 1 ); // ---------------- single session per user pPolicy->fPolicySingleSessionPerUser= GPGetNumValue( policyKey,POLICY_TS_SINGLE_SESSION_PER_USER, &dwTmpValue ); pPolicy->fSingleSessionPerUser = dwTmpValue; pPolicy->fPolicySessionDirectoryExposeServerIP = GPGetNumValue( policyKey, REG_TS_SESSDIR_EXPOSE_SERVER_ADDR , &dwTmpValue ); pPolicy->SessionDirectoryExposeServerIP = dwTmpValue; // policy for disabling wallpaper in remote desktop pPolicy->fPolicyDisableWallpaper = GPGetNumValue( policyKey, POLICY_TS_NO_REMOTE_DESKTOP_WALLPAPER, &dwTmpValue ); pPolicy->fDisableWallpaper = dwTmpValue; // policy to enable disable keep alive pPolicy->fPolicyKeepAlive = GPGetNumValue( policyKey, KEEP_ALIVE_ENABLE_KEY , &dwTmpValue ); pPolicy->fKeepAliveEnable = dwTmpValue; GPGetNumValue( policyKey, KEEP_ALIVE_INTERVAL_KEY , &dwTmpValue ); pPolicy->KeepAliveInterval = dwTmpValue; } /******************************************************************************* * RegGetMachinePolicy() * * Params: * [out] pPolicy : the machine policy used by ts session's userconfig * * Return: * void * *******************************************************************************/ void RegGetMachinePolicy( PPOLICY_TS_MACHINE pPolicy ) { NTSTATUS status= STATUS_SUCCESS; HKEY policyKey; status = RegOpenKeyEx( HKEY_LOCAL_MACHINE, TS_POLICY_SUB_TREE, 0, KEY_READ, &policyKey ); if ( status != ERROR_SUCCESS) { policyKey = NULL; // prefix complains. } // ok to call this with policyKey=NULL since func will init pPolicy using default values for the case of NULL key. GPQueryMachineConfig( policyKey, pPolicy ); if ( policyKey ) { RegCloseKey( policyKey ); } } /******************************************************************************* * RegGetMachinePolicyiEx() * * This func is identical to RegGetMachinePolicy() , and provides the time stampt for * the last write time of the policy key, and if the time of the key is the same as the * time for the last read, then it will not bother with any reads and return false * * Params: * [in ] forcePolicyRead : 1st time around, you want to init all vars so force a read. * [in/out] pTime : caller passes in the last write time for the machine policy key. * if key is missing, then time is set to zero. * On return, this param is updated to reflect the most recent * update time, which could be zero if the policy key was deleted * * [out] pPolicy : the machine policy struct updated * * Return: * TRUE : means there was a real change present * FALSE : means no values had changed. *******************************************************************************/ BOOLEAN RegGetMachinePolicyEx( BOOLEAN forcePolicyRead, FILETIME *pTime , PPOLICY_TS_MACHINE pPolicy ) { HKEY policyKey; FILETIME newTime; NTSTATUS status= STATUS_SUCCESS; BOOLEAN rc = FALSE; status = RegOpenKeyEx( HKEY_LOCAL_MACHINE, TS_POLICY_SUB_TREE, 0, KEY_READ, &policyKey ); if ( status != ERROR_SUCCESS) { policyKey = NULL; // prefix complains. } // if we have a policy key, get the time for that key if (policyKey) { RegQueryInfoKey( policyKey, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &newTime ); } else // else, init time to the current system time { SYSTEMTIME currentTimeOnSystemInSystemTimeUnits; GetSystemTime( ¤tTimeOnSystemInSystemTimeUnits ); SystemTimeToFileTime( & currentTimeOnSystemInSystemTimeUnits , & newTime ); } if ( forcePolicyRead || ( (pTime->dwHighDateTime < newTime.dwHighDateTime ) || ( ( pTime->dwHighDateTime == newTime.dwHighDateTime ) && pTime->dwLowDateTime < newTime.dwLowDateTime ) ) ) { // this call will init struct memebers even if the policy key in null, so it // is required to make this call on startup, with or without an actual reg key being present GPQueryMachineConfig( policyKey, pPolicy ); rc = TRUE; } pTime->dwHighDateTime = newTime.dwHighDateTime; pTime->dwLowDateTime = newTime.dwLowDateTime; if ( policyKey ) { RegCloseKey( policyKey ); } return rc; } /******************************************************************************* * RegMergeMachinePolicy() * * Params: * [in] pPolicy : policy data to use to override userconfig * [in/out] pWSConfig : userconfig data that is modified based on the policy data * * Return: * void * ********************************************************************************/ void RegMergeMachinePolicy( PPOLICY_TS_MACHINE pPolicy, // the policy override data USERCONFIGW * pWSConfig, // the machine config data represented thru a USERCONFIGW data struct (mostly) PWINSTATIONCREATE pCreate // some of winstation data is stored here ) { // ---------------------------------------------- Clipboard if ( pPolicy->fPolicyDisableClip ) { pWSConfig->fDisableClip = pPolicy->fDisableClip; } // ---------------------------------------------- Audio if ( pPolicy->fPolicyDisableCam ) { pWSConfig->fDisableCam = pPolicy->fDisableCam; } // ---------------------------------------------- Comport if ( pPolicy->fPolicyDisableCcm ) { pWSConfig->fDisableCcm = pPolicy->fDisableCcm; } // ---------------------------------------------- LPT if ( pPolicy->fPolicyDisableLPT ) { pWSConfig->fDisableLPT = pPolicy->fDisableLPT; } // ---------------------------------------------- PRN if ( pPolicy->fPolicyDisableCpm ) { pWSConfig->fDisableCpm = pPolicy->fDisableCpm; } // ---------------------------------------------- Password if ( pPolicy->fPolicyPromptForPassword ) { pWSConfig->fPromptForPassword = pPolicy->fPromptForPassword; } // ---------------------------------------------- Max Instance if ( pPolicy->fPolicyMaxInstanceCount ) { pCreate->MaxInstanceCount = pPolicy->MaxInstanceCount; } // ---------------------------------------------- Min Encryption Level if ( pPolicy->fPolicyMinEncryptionLevel ) { pWSConfig->MinEncryptionLevel = pPolicy->MinEncryptionLevel; } // ---------------------------------------------- Auto Reconnect disable if ( pPolicy->fPolicyDisableAutoReconnect ) { pWSConfig->fDisableAutoReconnect = pPolicy->fDisableAutoReconnect; } // ---------------------------------------------- if (pPolicy->fPolicyWFProfilePath ) { wcscpy( pWSConfig->WFProfilePath, pPolicy->WFProfilePath ); } else { pWSConfig->WFProfilePath[0] = L'\0'; } // ---------------------------------------------- if ( pPolicy->fPolicyWFHomeDir ) { wcscpy( pWSConfig->WFHomeDir, pPolicy->WFHomeDir ); } else { pWSConfig->WFHomeDir[0] = L'\0'; } // ---------------------------------------------- if ( pPolicy->fPolicyWFHomeDirDrive ) { wcscpy( pWSConfig->WFHomeDirDrive, pPolicy->WFHomeDirDrive ); } else { pWSConfig->WFHomeDirDrive[0] = L'\0'; } if ( pPolicy->fPolicyColorDepth) { pWSConfig->ColorDepth = pPolicy->ColorDepth ; //NA 2/23/01 pWSConfig->fInheritColorDepth = FALSE; } // if ( pPolicy->fPolicyDisableCdm) { pWSConfig->fDisableCdm = pPolicy->fDisableCdm; } // if ( pPolicy->fPolicyForceClientLptDef ) { pWSConfig->fForceClientLptDef = pPolicy->fForceClientLptDef; } // Shadow if ( pPolicy->fPolicyShadow) { pWSConfig->Shadow = pPolicy->Shadow; pWSConfig->fInheritShadow = FALSE; } if (pPolicy->fPolicyResetBroken ) { pWSConfig->fResetBroken = pPolicy->fResetBroken; pWSConfig->fInheritResetBroken = FALSE; } if (pPolicy->fPolicyReconnectSame ) { pWSConfig->fReconnectSame = pPolicy->fReconnectSame; pWSConfig->fInheritReconnectSame = FALSE; } if (pPolicy->fPolicyMaxSessionTime ) { pWSConfig->MaxConnectionTime = pPolicy->MaxConnectionTime; pWSConfig->fInheritMaxSessionTime = FALSE; } if (pPolicy->fPolicyMaxDisconnectionTime) { pWSConfig->MaxDisconnectionTime = pPolicy->MaxDisconnectionTime; pWSConfig->fInheritMaxDisconnectionTime = FALSE; } if (pPolicy->fPolicyMaxIdleTime) { pWSConfig->MaxIdleTime = pPolicy->MaxIdleTime; pWSConfig->fInheritMaxIdleTime = FALSE; } if (pPolicy->fPolicyInitialProgram) { wcscpy( pWSConfig->InitialProgram, pPolicy->InitialProgram ); wcscpy( pWSConfig->WorkDirectory, pPolicy->WorkDirectory ); pWSConfig->fInheritInitialProgram = FALSE; } if ( pPolicy->fPolicyDisableWallpaper ) { pWSConfig->fWallPaperDisabled = pPolicy->fDisableWallpaper ; } // ---------------------------------------------- // There is no UI for setting these... So it's probably never used // // if ( pPolicy->fPolicytSecurity ) // { // pWSConfig->fDisableEncryption = pPolicy->fDisableEncryption; // pWSConfig->MinEncryptionLevel = pPolicy->MinEncryptionLevel; // } // else // { // if ( pWSConfig->fInheritSecurity ) // { // pWSConfig->fDisableEncryption = pPolicy->fDisableEncryption; // pWSConfig->MinEncryptionLevel = pPolicy->MinEncryptionLevel; // } // } }