check_virtual_account.c

NTSTATUS LsapCheckVirtualAccountRestriction(DWORD dwRid, DWORD dwPid) {
  if ( dwRid == 80 )
  {
    if ( !_InterlockedCompareExchange(&global_scm_pid, dwPid, 0) || dwPid == global_scm_pid)
      return STATUS_SUCCESS;
  }
  else
  {
    if ( dwRid != 87 )
      return STATUS_SUCCESS;
    if (NT_SUCCESS(LsapImpersonateClientEx(NULL)) {
        HANDLE TokenHandle;
        OpenThreadToken(GetCurrentThread(), TOKEN_IMPERSONATE, TRUE, &TokenHandle);
        BOOL IsMember;
        CheckTokenMembership(TokenHandle, g_pScheduleServiceSid, &IsMember);
        if (IsMember)
            return STATUS_SUCCESS;
    }
  }
  return STATUS_ACCESS_DENIED;
}