xref: /reactos/dll/win32/userenv/profile.c (revision 1ac9e484) 
1 /*
2  * COPYRIGHT:       See COPYING in the top level directory
3  * PROJECT:         ReactOS system libraries
4  * FILE:            dll/win32/userenv/profile.c
5  * PURPOSE:         User profile code
6  * PROGRAMMERS:     Eric Kohl
7  *                  Herv� Poussineau
8  */
9 
10 #include "precomp.h"
11 
12 #include <sddl.h>
13 
14 #define NDEBUG
15 #include <debug.h>
16 
17 /* FUNCTIONS ***************************************************************/
18 
19 BOOL
20 AppendSystemPostfix(LPWSTR lpName,
21                     DWORD dwMaxLength)
22 {
23     WCHAR szSystemRoot[MAX_PATH];
24     LPWSTR lpszPostfix;
25     LPWSTR lpszPtr;
26 
27     /* Build profile name postfix */
28     if (!ExpandEnvironmentStringsW(L"%SystemRoot%",
29                                    szSystemRoot,
30                                    ARRAYSIZE(szSystemRoot)))
31     {
32         DPRINT1("Error: %lu\n", GetLastError());
33         return FALSE;
34     }
35 
36     _wcsupr(szSystemRoot);
37 
38     /* Get name postfix */
39     szSystemRoot[2] = L'.';
40     lpszPostfix = &szSystemRoot[2];
41     lpszPtr = lpszPostfix;
42     while (*lpszPtr != (WCHAR)0)
43     {
44         if (*lpszPtr == L'\\')
45             *lpszPtr = L'_';
46         lpszPtr++;
47     }
48 
49     if (wcslen(lpName) + wcslen(lpszPostfix) + 1 >= dwMaxLength)
50     {
51         DPRINT1("Error: buffer overflow\n");
52         SetLastError(ERROR_BUFFER_OVERFLOW);
53         return FALSE;
54     }
55 
56     wcscat(lpName, lpszPostfix);
57 
58     return TRUE;
59 }
60 
61 
62 static
63 BOOL
64 AcquireRemoveRestorePrivilege(IN BOOL bAcquire)
65 {
66     BOOL bRet = FALSE;
67     HANDLE Token;
68     TOKEN_PRIVILEGES TokenPriv;
69 
70     DPRINT("AcquireRemoveRestorePrivilege(%d)\n", bAcquire);
71 
72     if (OpenProcessToken(GetCurrentProcess(),
73                          TOKEN_ADJUST_PRIVILEGES,
74                          &Token))
75     {
76         TokenPriv.PrivilegeCount = 1;
77         TokenPriv.Privileges[0].Attributes = (bAcquire ? SE_PRIVILEGE_ENABLED : 0);
78 
79         if (LookupPrivilegeValue(NULL, SE_RESTORE_NAME, &TokenPriv.Privileges[0].Luid))
80         {
81             bRet = AdjustTokenPrivileges(Token, FALSE, &TokenPriv, 0, NULL, NULL);
82 
83             if (!bRet)
84             {
85                 DPRINT1("AdjustTokenPrivileges() failed with error %lu\n", GetLastError());
86             }
87             else if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
88             {
89                 DPRINT1("AdjustTokenPrivileges() succeeded, but with not all privileges assigned\n");
90                 bRet = FALSE;
91             }
92         }
93         else
94         {
95             DPRINT1("LookupPrivilegeValue() failed with error %lu\n", GetLastError());
96         }
97 
98         CloseHandle(Token);
99     }
100     else
101     {
102         DPRINT1("OpenProcessToken() failed with error %lu\n", GetLastError());
103     }
104 
105     return bRet;
106 }
107 
108 
109 static
110 BOOL
111 CheckForLoadedProfile(HANDLE hToken)
112 {
113     UNICODE_STRING SidString;
114     HKEY hKey;
115 
116     DPRINT("CheckForLoadedProfile() called\n");
117 
118     /* Get the user SID string */
119     if (!GetUserSidStringFromToken(hToken, &SidString))
120     {
121         DPRINT1("GetUserSidStringFromToken() failed\n");
122         return FALSE;
123     }
124 
125     if (RegOpenKeyExW(HKEY_USERS,
126                       SidString.Buffer,
127                       0,
128                       MAXIMUM_ALLOWED,
129                       &hKey))
130     {
131         DPRINT("Profile not loaded\n");
132         RtlFreeUnicodeString(&SidString);
133         return FALSE;
134     }
135 
136     RegCloseKey(hKey);
137 
138     RtlFreeUnicodeString(&SidString);
139 
140     DPRINT("Profile already loaded\n");
141 
142     return TRUE;
143 }
144 
145 
146 static
147 HANDLE
148 CreateProfileMutex(
149     _In_ PWSTR pszSidString)
150 {
151     SECURITY_DESCRIPTOR SecurityDescriptor;
152     SECURITY_ATTRIBUTES SecurityAttributes;
153     PWSTR pszMutexName = NULL;
154     HANDLE hMutex = NULL;
155 
156     pszMutexName = HeapAlloc(GetProcessHeap(),
157                              0,
158                              (wcslen(L"Global\\userenv:  User Profile Mutex for ") + wcslen(pszSidString) + 1) * sizeof(WCHAR));
159     if (pszMutexName == NULL)
160     {
161         DPRINT("Failed to allocate the mutex name buffer!\n");
162         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
163         return NULL;
164     }
165 
166     /* Build the profile mutex name */
167     wcscpy(pszMutexName, L"Global\\userenv:  User Profile Mutex for ");
168     wcscat(pszMutexName, pszSidString);
169 
170     /* Initialize the security descriptor */
171     InitializeSecurityDescriptor(&SecurityDescriptor,
172                                  SECURITY_DESCRIPTOR_REVISION);
173 
174     /* Set a NULL-DACL (everyone has access) */
175     SetSecurityDescriptorDacl(&SecurityDescriptor,
176                               TRUE,
177                               NULL,
178                               FALSE);
179 
180     /* Initialize the security attributes */
181     SecurityAttributes.nLength = sizeof(SecurityAttributes);
182     SecurityAttributes.lpSecurityDescriptor = &SecurityDescriptor;
183     SecurityAttributes.bInheritHandle = FALSE;
184 
185     /* Create the profile mutex */
186     hMutex = CreateMutexW(&SecurityAttributes,
187                           FALSE,
188                           pszMutexName);
189     if (hMutex == NULL)
190     {
191         DPRINT1("Failed to create the profile mutex (Error %lu)\n", GetLastError());
192     }
193 
194     HeapFree(GetProcessHeap(), 0, pszMutexName);
195 
196     return hMutex;
197 }
198 
199 
200 static
201 DWORD
202 IncrementRefCount(
203     PWSTR pszSidString,
204     PDWORD pdwRefCount)
205 {
206     HKEY hProfilesKey = NULL, hProfileKey = NULL;
207     DWORD dwRefCount = 0, dwLength, dwType;
208     DWORD dwError;
209 
210     DPRINT1("IncrementRefCount(%S %p)\n",
211             pszSidString, pdwRefCount);
212 
213     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
214                             L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
215                             0,
216                             KEY_QUERY_VALUE,
217                             &hProfilesKey);
218     if (dwError != ERROR_SUCCESS)
219     {
220         DPRINT1("Error: %lu\n", dwError);
221         goto done;
222     }
223 
224     dwError = RegOpenKeyExW(hProfilesKey,
225                             pszSidString,
226                             0,
227                             KEY_QUERY_VALUE | KEY_SET_VALUE,
228                             &hProfileKey);
229     if (dwError != ERROR_SUCCESS)
230     {
231         DPRINT1("Error: %lu\n", dwError);
232         goto done;
233     }
234 
235     /* Get the reference counter */
236     dwLength = sizeof(dwRefCount);
237     RegQueryValueExW(hProfileKey,
238                      L"RefCount",
239                      NULL,
240                      &dwType,
241                      (PBYTE)&dwRefCount,
242                      &dwLength);
243 
244     dwRefCount++;
245 
246     dwLength = sizeof(dwRefCount);
247     dwError = RegSetValueExW(hProfileKey,
248                              L"RefCount",
249                              0,
250                              REG_DWORD,
251                              (PBYTE)&dwRefCount,
252                              dwLength);
253     if (dwError != ERROR_SUCCESS)
254     {
255         DPRINT1("Error: %lu\n", dwError);
256         goto done;
257     }
258 
259     if (pdwRefCount != NULL)
260         *pdwRefCount = dwRefCount;
261 
262 done:
263     if (hProfileKey != NULL)
264         RegCloseKey(hProfileKey);
265 
266     if (hProfilesKey != NULL)
267         RegCloseKey(hProfilesKey);
268 
269     return dwError;
270 }
271 
272 
273 static
274 DWORD
275 DecrementRefCount(
276     PWSTR pszSidString,
277     PDWORD pdwRefCount)
278 {
279     HKEY hProfilesKey = NULL, hProfileKey = NULL;
280     DWORD dwRefCount = 0, dwLength, dwType;
281     DWORD dwError;
282 
283     DPRINT1("DecrementRefCount(%S %p)\n",
284             pszSidString, pdwRefCount);
285 
286     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
287                             L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
288                             0,
289                             KEY_QUERY_VALUE,
290                             &hProfilesKey);
291     if (dwError != ERROR_SUCCESS)
292     {
293         DPRINT1("Error: %lu\n", dwError);
294         goto done;
295     }
296 
297     dwError = RegOpenKeyExW(hProfilesKey,
298                             pszSidString,
299                             0,
300                             KEY_QUERY_VALUE | KEY_SET_VALUE,
301                             &hProfileKey);
302     if (dwError != ERROR_SUCCESS)
303     {
304         DPRINT1("Error: %lu\n", dwError);
305         goto done;
306     }
307 
308     /* Get the reference counter */
309     dwLength = sizeof(dwRefCount);
310     dwError = RegQueryValueExW(hProfileKey,
311                                L"RefCount",
312                                NULL,
313                                &dwType,
314                                (PBYTE)&dwRefCount,
315                                &dwLength);
316     if (dwError != ERROR_SUCCESS)
317     {
318         DPRINT1("Error: %lu\n", dwError);
319         goto done;
320     }
321 
322     dwRefCount--;
323 
324     dwLength = sizeof(dwRefCount);
325     dwError = RegSetValueExW(hProfileKey,
326                              L"RefCount",
327                              0,
328                              REG_DWORD,
329                              (PBYTE)&dwRefCount,
330                              dwLength);
331     if (dwError != ERROR_SUCCESS)
332     {
333         DPRINT1("Error: %lu\n", dwError);
334         goto done;
335     }
336 
337     if (pdwRefCount != NULL)
338         *pdwRefCount = dwRefCount;
339 
340 done:
341     if (hProfileKey != NULL)
342         RegCloseKey(hProfileKey);
343 
344     if (hProfilesKey != NULL)
345         RegCloseKey(hProfilesKey);
346 
347     return dwError;
348 }
349 
350 
351 static
352 DWORD
353 CheckForGuestsAndAdmins(
354     _In_ HANDLE hToken,
355     _Out_ PDWORD pdwState)
356 {
357     PTOKEN_GROUPS pGroupInfo = NULL;
358     PSID pAdministratorsSID = NULL;
359     PSID pGuestsSID = NULL;
360     DWORD i, dwSize = 0;
361     DWORD dwError = ERROR_SUCCESS;
362 
363     DPRINT("CheckForGuestsAndAdmins(%p %p)\n", hToken, pdwState);
364 
365     /* Get the buffer size */
366     if (!GetTokenInformation(hToken, TokenGroups, NULL, dwSize, &dwSize))
367     {
368         dwError = GetLastError();
369         if (dwError != ERROR_INSUFFICIENT_BUFFER)
370         {
371             DPRINT1("GetTokenInformation() failed (Error %lu)\n", dwError);
372             return dwError;
373         }
374 
375         dwError = ERROR_SUCCESS;
376     }
377 
378     /* Allocate the buffer */
379     pGroupInfo = (PTOKEN_GROUPS)HeapAlloc(GetProcessHeap(), 0, dwSize);
380     if (pGroupInfo == NULL)
381     {
382         dwError = ERROR_OUTOFMEMORY;
383         DPRINT1("HeapAlloc() failed (Error %lu)\n", dwError);
384         goto done;
385     }
386 
387     /* Get the token groups */
388     if (!GetTokenInformation(hToken, TokenGroups, pGroupInfo, dwSize, &dwSize))
389     {
390         dwError = GetLastError();
391         DPRINT1("GetTokenInformation() failed (Error %lu)\n", dwError);
392         goto done;
393     }
394 
395     /* Build the Administrators Group SID */
396     if(!AllocateAndInitializeSid(&LocalSystemAuthority,
397                                  2,
398                                  SECURITY_BUILTIN_DOMAIN_RID,
399                                  DOMAIN_ALIAS_RID_ADMINS,
400                                  0, 0, 0, 0, 0, 0,
401                                  &pAdministratorsSID))
402     {
403         dwError = GetLastError();
404         DPRINT1("AllocateAndInitializeSid() failed (Error %lu)\n", dwError);
405         goto done;
406     }
407 
408     /* Build the Guests Group SID */
409     if(!AllocateAndInitializeSid(&LocalSystemAuthority,
410                                  2,
411                                  SECURITY_BUILTIN_DOMAIN_RID,
412                                  DOMAIN_ALIAS_RID_GUESTS,
413                                  0, 0, 0, 0, 0, 0,
414                                  &pGuestsSID))
415     {
416         dwError = GetLastError();
417         DPRINT1("AllocateAndInitializeSid() failed (Error %lu)\n", dwError);
418         goto done;
419     }
420 
421     /* Check for Administratos or Guests group memberships */
422     for (i = 0; i < pGroupInfo->GroupCount; i++)
423     {
424         if (EqualSid(pAdministratorsSID, pGroupInfo->Groups[i].Sid))
425         {
426             *pdwState |= 0x0100; // PROFILE_ADMIN_USER
427         }
428 
429         if (EqualSid(pGuestsSID, pGroupInfo->Groups[i].Sid))
430         {
431             *pdwState |= 0x0080; // PROFILE_GUESTS_USER
432         }
433     }
434 
435     dwError = ERROR_SUCCESS;
436 
437 done:
438     if (pGuestsSID != NULL)
439         FreeSid(pGuestsSID);
440 
441     if (pAdministratorsSID != NULL)
442         FreeSid(pAdministratorsSID);
443 
444     if (pGroupInfo != NULL)
445         HeapFree(GetProcessHeap(), 0, pGroupInfo);
446 
447     return dwError;
448 }
449 
450 
451 static
452 DWORD
453 SetProfileData(
454     _In_ PWSTR pszSidString,
455     _In_ DWORD dwFlags,
456     _In_ HANDLE hToken)
457 {
458     HKEY hProfilesKey = NULL, hProfileKey = NULL;
459     FILETIME LoadTime;
460     DWORD dwLength, dwState = 0;
461     DWORD dwError;
462 
463     DPRINT("SetProfileData(%S %p)\n", pszSidString, hToken);
464 
465     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
466                             L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
467                             0,
468                             KEY_QUERY_VALUE,
469                             &hProfilesKey);
470     if (dwError != ERROR_SUCCESS)
471     {
472         DPRINT1("Error: %lu\n", dwError);
473         goto done;
474     }
475 
476     dwError = RegOpenKeyExW(hProfilesKey,
477                             pszSidString,
478                             0,
479                             KEY_QUERY_VALUE | KEY_SET_VALUE,
480                             &hProfileKey);
481     if (dwError != ERROR_SUCCESS)
482     {
483         DPRINT1("Error: %lu\n", dwError);
484         goto done;
485     }
486 
487     /* Set the profile load time */
488     GetSystemTimeAsFileTime(&LoadTime);
489 
490     dwLength = sizeof(LoadTime.dwLowDateTime);
491     dwError = RegSetValueExW(hProfileKey,
492                              L"ProfileLoadTimeLow",
493                              0,
494                              REG_DWORD,
495                              (PBYTE)&LoadTime.dwLowDateTime,
496                              dwLength);
497     if (dwError != ERROR_SUCCESS)
498     {
499         DPRINT1("Error: %lu\n", dwError);
500         goto done;
501     }
502 
503     dwLength = sizeof(LoadTime.dwHighDateTime);
504     dwError = RegSetValueExW(hProfileKey,
505                              L"ProfileLoadTimeHigh",
506                              0,
507                              REG_DWORD,
508                              (PBYTE)&LoadTime.dwHighDateTime,
509                              dwLength);
510     if (dwError != ERROR_SUCCESS)
511     {
512         DPRINT1("Error: %lu\n", dwError);
513         goto done;
514     }
515 
516     dwLength = sizeof(dwFlags);
517     dwError = RegSetValueExW(hProfileKey,
518                              L"Flags",
519                              0,
520                              REG_DWORD,
521                              (PBYTE)&dwFlags,
522                              dwLength);
523     if (dwError != ERROR_SUCCESS)
524     {
525         DPRINT1("Error: %lu\n", dwError);
526         goto done;
527     }
528 
529     dwError = CheckForGuestsAndAdmins(hToken,
530                                       &dwState);
531     if (dwError != ERROR_SUCCESS)
532     {
533         DPRINT1("Error: %lu\n", dwError);
534         goto done;
535     }
536 
537     dwLength = sizeof(dwState);
538     dwError = RegSetValueExW(hProfileKey,
539                              L"State",
540                              0,
541                              REG_DWORD,
542                              (PBYTE)&dwState,
543                              dwLength);
544     if (dwError != ERROR_SUCCESS)
545     {
546         DPRINT1("Error: %lu\n", dwError);
547         goto done;
548     }
549 
550 done:
551     if (hProfileKey != NULL)
552         RegCloseKey(hProfileKey);
553 
554     if (hProfilesKey != NULL)
555         RegCloseKey(hProfilesKey);
556 
557     return dwError;
558 }
559 
560 
561 /* PUBLIC FUNCTIONS ********************************************************/
562 
563 BOOL
564 WINAPI
565 CopySystemProfile(
566     _In_ ULONG Unused)
567 {
568     WCHAR szKeyName[MAX_PATH];
569     WCHAR szRawProfilePath[MAX_PATH];
570     WCHAR szProfilePath[MAX_PATH];
571     WCHAR szDefaultProfilePath[MAX_PATH];
572     UNICODE_STRING SidString = {0, 0, NULL};
573     HANDLE hToken = NULL;
574     PSID pUserSid = NULL;
575     HKEY hProfileKey = NULL;
576     DWORD dwDisposition;
577     BOOL bResult = FALSE;
578     DWORD cchSize;
579     DWORD dwError;
580 
581     DPRINT1("CopySystemProfile()\n");
582 
583     if (!OpenProcessToken(GetCurrentProcess(),
584                           TOKEN_QUERY | TOKEN_IMPERSONATE,
585                           &hToken))
586     {
587         DPRINT1("Failed to open the process token (Error %lu)\n", GetLastError());
588         return FALSE;
589     }
590 
591     pUserSid = GetUserSid(hToken);
592     if (pUserSid == NULL)
593     {
594         DPRINT1("Failed to get the users SID (Error %lu)\n", GetLastError());
595         goto done;
596     }
597 
598     /* Get the user SID string */
599     if (!GetUserSidStringFromToken(hToken, &SidString))
600     {
601         DPRINT1("GetUserSidStringFromToken() failed\n");
602         goto done;
603     }
604 
605     StringCbCopyW(szKeyName, sizeof(szKeyName),
606                   L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\");
607     StringCbCatW(szKeyName, sizeof(szKeyName), SidString.Buffer);
608 
609     RtlFreeUnicodeString(&SidString);
610 
611     dwError = RegCreateKeyExW(HKEY_LOCAL_MACHINE,
612                               szKeyName,
613                               0, NULL, 0,
614                               KEY_WRITE,
615                               NULL,
616                               &hProfileKey,
617                               &dwDisposition);
618     if (dwError != ERROR_SUCCESS)
619     {
620         DPRINT1("Failed to create the profile key for the %s profile (Error %lu)\n",
621                 SidString.Buffer, dwError);
622         goto done;
623     }
624 
625     dwError = RegSetValueExW(hProfileKey,
626                              L"Sid",
627                              0,
628                              REG_BINARY,
629                              (PBYTE)pUserSid,
630                              RtlLengthSid(pUserSid));
631     if (dwError != ERROR_SUCCESS)
632     {
633         DPRINT1("Failed to set the SID value (Error %lu)\n", dwError);
634         goto done;
635     }
636 
637     wcscpy(szRawProfilePath,
638            L"%systemroot%\\system32\\config\\systemprofile");
639 
640     dwError = RegSetValueExW(hProfileKey,
641                              L"ProfileImagePath",
642                              0,
643                              REG_EXPAND_SZ,
644                              (PBYTE)szRawProfilePath,
645                              (wcslen(szRawProfilePath) + 1) * sizeof(WCHAR));
646     if (dwError != ERROR_SUCCESS)
647     {
648         DPRINT1("Failed to set the ProfileImagePath value (Error %lu)\n", dwError);
649         goto done;
650     }
651 
652     /* Expand the raw profile path */
653     if (!ExpandEnvironmentStringsW(szRawProfilePath,
654                                    szProfilePath,
655                                    ARRAYSIZE(szProfilePath)))
656     {
657         DPRINT1("Failled to expand the raw profile path (Error %lu)\n", GetLastError());
658         goto done;
659     }
660 
661     /* Create the profile directory if it does not exist yet */
662     // FIXME: Security!
663     if (!CreateDirectoryW(szProfilePath, NULL))
664     {
665         if (GetLastError() != ERROR_ALREADY_EXISTS)
666         {
667             DPRINT1("Failed to create the profile directory (Error %lu)\n", GetLastError());
668             goto done;
669         }
670     }
671 
672     /* Get the path of the default profile */
673     cchSize = ARRAYSIZE(szDefaultProfilePath);
674     if (!GetDefaultUserProfileDirectoryW(szDefaultProfilePath, &cchSize))
675     {
676         DPRINT1("Failed to create the default profile path (Error %lu)\n", GetLastError());
677         goto done;
678     }
679 
680     /* Copy the default profile into the new profile directory */
681     // FIXME: Security!
682     if (!CopyDirectory(szProfilePath, szDefaultProfilePath))
683     {
684         DPRINT1("Failed to copy the default profile directory (Error %lu)\n", GetLastError());
685         goto done;
686     }
687 
688     bResult = TRUE;
689 
690 done:
691     if (hProfileKey != NULL)
692         RegCloseKey(hProfileKey);
693 
694     RtlFreeUnicodeString(&SidString);
695 
696     if (pUserSid != NULL)
697         LocalFree(pUserSid);
698 
699     if (hToken != NULL)
700         CloseHandle(hToken);
701 
702     return bResult;
703 }
704 
705 
706 BOOL
707 WINAPI
708 CreateUserProfileA(
709     _In_ PSID pSid,
710     _In_ LPCSTR lpUserName)
711 {
712     LPWSTR pUserNameW = NULL;
713     INT nLength;
714     BOOL bResult;
715 
716     DPRINT("CreateUserProfileA(%p %s)\n", pSid, lpUserName);
717 
718     /* Convert lpUserName to Unicode */
719     nLength = MultiByteToWideChar(CP_ACP, 0, lpUserName, -1, NULL, 0);
720     pUserNameW = HeapAlloc(GetProcessHeap(), 0, nLength * sizeof(WCHAR));
721     if (pUserNameW == NULL)
722     {
723         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
724         return FALSE;
725     }
726     MultiByteToWideChar(CP_ACP, 0, lpUserName, -1, pUserNameW, nLength);
727 
728     /* Call the Ex function */
729     bResult = CreateUserProfileExW(pSid,
730                                    pUserNameW,
731                                    NULL,
732                                    NULL,
733                                    0,
734                                    FALSE);
735 
736     HeapFree(GetProcessHeap(), 0, pUserNameW);
737 
738     return bResult;
739 }
740 
741 
742 BOOL
743 WINAPI
744 CreateUserProfileW(
745     _In_ PSID pSid,
746     _In_ LPCWSTR lpUserName)
747 {
748     DPRINT("CreateUserProfileW(%p %S)\n", pSid, lpUserName);
749 
750     /* Call the Ex function */
751     return CreateUserProfileExW(pSid,
752                                 lpUserName,
753                                 NULL,
754                                 NULL,
755                                 0,
756                                 FALSE);
757 }
758 
759 
760 BOOL
761 WINAPI
762 CreateUserProfileExA(
763     _In_ PSID pSid,
764     _In_ LPCSTR lpUserName,
765     _In_opt_ LPCSTR lpUserHive,
766     _Out_opt_ LPSTR lpProfileDir,
767     _In_ DWORD dwDirSize,
768     _In_ BOOL bWin9xUpg)
769 {
770     LPWSTR pUserNameW = NULL;
771     LPWSTR pUserHiveW = NULL;
772     LPWSTR pProfileDirW = NULL;
773     INT nLength;
774     BOOL bResult = FALSE;
775 
776     DPRINT("CreateUserProfileExA(%p %s %s %p %lu %d)\n",
777            pSid, lpUserName, lpUserHive, lpProfileDir, dwDirSize, bWin9xUpg);
778 
779     /* Check the parameters */
780     if (lpProfileDir != NULL && dwDirSize == 0)
781     {
782         SetLastError(ERROR_INVALID_PARAMETER);
783         return FALSE;
784     }
785 
786     /* Convert lpUserName to Unicode */
787     nLength = MultiByteToWideChar(CP_ACP, 0, lpUserName, -1, NULL, 0);
788     pUserNameW = HeapAlloc(GetProcessHeap(), 0, nLength * sizeof(WCHAR));
789     if (pUserNameW == NULL)
790     {
791         SetLastError(ERROR_NOT_ENOUGH_MEMORY);
792         goto done;
793     }
794     MultiByteToWideChar(CP_ACP, 0, lpUserName, -1, pUserNameW, nLength);
795 
796     /* Convert lpUserHive to Unicode */
797     if (lpUserHive != NULL)
798     {
799         nLength = MultiByteToWideChar(CP_ACP, 0, lpUserHive, -1, NULL, 0);
800         pUserHiveW = HeapAlloc(GetProcessHeap(), 0, nLength * sizeof(WCHAR));
801         if (pUserHiveW == NULL)
802         {
803             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
804             goto done;
805         }
806         MultiByteToWideChar(CP_ACP, 0, lpUserHive, -1, pUserHiveW, nLength);
807     }
808 
809     /* Allocate a Unicode buffer for lpProfileDir */
810     if (lpProfileDir != NULL)
811     {
812         pProfileDirW = HeapAlloc(GetProcessHeap(), 0, dwDirSize * sizeof(WCHAR));
813         if (pProfileDirW == NULL)
814         {
815             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
816             goto done;
817         }
818     }
819 
820     /* Call the Unicode function */
821     bResult = CreateUserProfileExW(pSid,
822                                    (LPCWSTR)pUserNameW,
823                                    (LPCWSTR)pUserHiveW,
824                                    pProfileDirW,
825                                    dwDirSize,
826                                    bWin9xUpg);
827 
828     /* Convert the profile path to ANSI */
829     if (bResult && lpProfileDir != NULL)
830     {
831         WideCharToMultiByte(CP_ACP, 0, pProfileDirW, -1, lpProfileDir, dwDirSize, NULL, NULL);
832     }
833 
834 done:
835     /* Free the buffers */
836     if (pProfileDirW != NULL)
837         HeapFree(GetProcessHeap(), 0, pProfileDirW);
838 
839     if (pUserHiveW != NULL)
840         HeapFree(GetProcessHeap(), 0, pUserHiveW);
841 
842     if (pUserNameW != NULL)
843         HeapFree(GetProcessHeap(), 0, pUserNameW);
844 
845     return bResult;
846 }
847 
848 
849 BOOL
850 WINAPI
851 CreateUserProfileExW(
852     _In_ PSID pSid,
853     _In_ LPCWSTR lpUserName,
854     _In_opt_ LPCWSTR lpUserHive,
855     _Out_opt_ LPWSTR lpProfileDir,
856     _In_ DWORD dwDirSize,
857     _In_ BOOL bWin9xUpg)
858 {
859     WCHAR szRawProfilesPath[MAX_PATH];
860     WCHAR szProfilesPath[MAX_PATH];
861     WCHAR szUserProfilePath[MAX_PATH];
862     WCHAR szDefaultUserPath[MAX_PATH];
863     WCHAR szUserProfileName[MAX_PATH];
864     WCHAR szBuffer[MAX_PATH];
865     LPWSTR SidString;
866     DWORD dwType, dwLength;
867     DWORD dwDisposition;
868     UINT i;
869     HKEY hKey;
870     BOOL bRet = TRUE;
871     LONG Error;
872 
873     DPRINT("CreateUserProfileExW(%p %S %S %p %lu %d)\n",
874            pSid, lpUserName, lpUserHive, lpProfileDir, dwDirSize, bWin9xUpg);
875 
876     /* Parameters validation */
877     if (!pSid || !lpUserName)
878     {
879         SetLastError(ERROR_INVALID_PARAMETER);
880         return FALSE;
881     }
882 
883     /*
884      * TODO:
885      *  - Add support for lpUserHive.
886      *  - bWin9xUpg is obsolete. Don't waste your time implementing this.
887      */
888 
889     Error = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
890                           L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
891                           0,
892                           KEY_QUERY_VALUE,
893                           &hKey);
894     if (Error != ERROR_SUCCESS)
895     {
896         DPRINT1("Error: %lu\n", Error);
897         SetLastError((DWORD)Error);
898         return FALSE;
899     }
900 
901     /* Get profiles path */
902     dwLength = sizeof(szRawProfilesPath);
903     Error = RegQueryValueExW(hKey,
904                              L"ProfilesDirectory",
905                              NULL,
906                              &dwType,
907                              (LPBYTE)szRawProfilesPath,
908                              &dwLength);
909     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
910     {
911         DPRINT1("Error: %lu\n", Error);
912         RegCloseKey(hKey);
913         SetLastError((DWORD)Error);
914         return FALSE;
915     }
916 
917     /* Expand it */
918     if (!ExpandEnvironmentStringsW(szRawProfilesPath,
919                                    szProfilesPath,
920                                    ARRAYSIZE(szProfilesPath)))
921     {
922         DPRINT1("Error: %lu\n", GetLastError());
923         RegCloseKey(hKey);
924         return FALSE;
925     }
926 
927     /* Create the profiles directory if it does not exist yet */
928     // FIXME: Security!
929     if (!CreateDirectoryW(szProfilesPath, NULL))
930     {
931         if (GetLastError() != ERROR_ALREADY_EXISTS)
932         {
933             DPRINT1("Error: %lu\n", GetLastError());
934             return FALSE;
935         }
936     }
937 
938     /* Get default user path */
939     dwLength = sizeof(szBuffer);
940     Error = RegQueryValueExW(hKey,
941                              L"DefaultUserProfile",
942                              NULL,
943                              &dwType,
944                              (LPBYTE)szBuffer,
945                              &dwLength);
946     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
947     {
948         DPRINT1("Error: %lu\n", Error);
949         RegCloseKey(hKey);
950         SetLastError((DWORD)Error);
951         return FALSE;
952     }
953 
954     RegCloseKey(hKey);
955 
956     StringCbCopyW(szUserProfileName, sizeof(szUserProfileName), lpUserName);
957 
958     /* Create user profile directory */
959 
960     StringCbCopyW(szUserProfilePath, sizeof(szUserProfilePath), szProfilesPath);
961     StringCbCatW(szUserProfilePath, sizeof(szUserProfilePath), L"\\");
962     StringCbCatW(szUserProfilePath, sizeof(szUserProfilePath), szUserProfileName);
963 
964     // FIXME: Security!
965     if (!CreateDirectoryW(szUserProfilePath, NULL))
966     {
967         if (GetLastError() != ERROR_ALREADY_EXISTS)
968         {
969             DPRINT1("Error: %lu\n", GetLastError());
970             return FALSE;
971         }
972 
973         for (i = 0; i < 1000; i++)
974         {
975             swprintf(szUserProfileName, L"%s.%03u", lpUserName, i);
976 
977             StringCbCopyW(szUserProfilePath, sizeof(szUserProfilePath), szProfilesPath);
978             StringCbCatW(szUserProfilePath, sizeof(szUserProfilePath), L"\\");
979             StringCbCatW(szUserProfilePath, sizeof(szUserProfilePath), szUserProfileName);
980 
981             // FIXME: Security!
982             if (CreateDirectoryW(szUserProfilePath, NULL))
983                 break;
984 
985             if (GetLastError() != ERROR_ALREADY_EXISTS)
986             {
987                 DPRINT1("Error: %lu\n", GetLastError());
988                 return FALSE;
989             }
990         }
991     }
992 
993     /* Copy default user directory */
994 
995     StringCbCopyW(szDefaultUserPath, sizeof(szDefaultUserPath), szProfilesPath);
996     StringCbCatW(szDefaultUserPath, sizeof(szDefaultUserPath), L"\\");
997     StringCbCatW(szDefaultUserPath, sizeof(szDefaultUserPath), szBuffer);
998 
999     // FIXME: Security!
1000     if (!CopyDirectory(szUserProfilePath, szDefaultUserPath))
1001     {
1002         DPRINT1("Error: %lu\n", GetLastError());
1003         return FALSE;
1004     }
1005 
1006     /* Add profile to profile list */
1007     if (!ConvertSidToStringSidW(pSid,
1008                                 &SidString))
1009     {
1010         DPRINT1("Error: %lu\n", GetLastError());
1011         return FALSE;
1012     }
1013 
1014     StringCbCopyW(szBuffer, sizeof(szBuffer),
1015                   L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\");
1016     StringCbCatW(szBuffer, sizeof(szBuffer), SidString);
1017 
1018     /* Create user profile key */
1019     Error = RegCreateKeyExW(HKEY_LOCAL_MACHINE,
1020                             szBuffer,
1021                             0,
1022                             NULL,
1023                             REG_OPTION_NON_VOLATILE,
1024                             KEY_ALL_ACCESS,
1025                             NULL,
1026                             &hKey,
1027                             &dwDisposition);
1028     if (Error != ERROR_SUCCESS)
1029     {
1030         DPRINT1("Error: %lu\n", Error);
1031         bRet = FALSE;
1032         goto done;
1033     }
1034 
1035     /* Create non-expanded user profile path */
1036     StringCbCopyW(szBuffer, sizeof(szBuffer), szRawProfilesPath);
1037     StringCbCatW(szBuffer, sizeof(szBuffer), L"\\");
1038     StringCbCatW(szBuffer, sizeof(szBuffer), szUserProfileName);
1039 
1040     /* Set 'ProfileImagePath' value (non-expanded) */
1041     Error = RegSetValueExW(hKey,
1042                            L"ProfileImagePath",
1043                            0,
1044                            REG_EXPAND_SZ,
1045                            (LPBYTE)szBuffer,
1046                            (wcslen(szBuffer) + 1) * sizeof(WCHAR));
1047     if (Error != ERROR_SUCCESS)
1048     {
1049         DPRINT1("Error: %lu\n", Error);
1050         RegCloseKey(hKey);
1051         bRet = FALSE;
1052         goto done;
1053     }
1054 
1055     /* Set 'Sid' value */
1056     Error = RegSetValueExW(hKey,
1057                            L"Sid",
1058                            0,
1059                            REG_BINARY,
1060                            pSid,
1061                            GetLengthSid(pSid));
1062     if (Error != ERROR_SUCCESS)
1063     {
1064         DPRINT1("Error: %lu\n", Error);
1065         RegCloseKey(hKey);
1066         bRet = FALSE;
1067         goto done;
1068     }
1069 
1070     RegCloseKey(hKey);
1071 
1072     /* Create user hive file */
1073 
1074     /* Use the default hive file name */
1075     StringCbCopyW(szBuffer, sizeof(szBuffer), szUserProfilePath);
1076     StringCbCatW(szBuffer, sizeof(szBuffer), L"\\ntuser.dat");
1077 
1078     /* Acquire restore privilege */
1079     if (!AcquireRemoveRestorePrivilege(TRUE))
1080     {
1081         Error = GetLastError();
1082         DPRINT1("Error: %lu\n", Error);
1083         bRet = FALSE;
1084         goto done;
1085     }
1086 
1087     /* Load the user hive */
1088     Error = RegLoadKeyW(HKEY_USERS,
1089                         SidString,
1090                         szBuffer);
1091     AcquireRemoveRestorePrivilege(FALSE);
1092     if (Error != ERROR_SUCCESS)
1093     {
1094         DPRINT1("Error: %lu\n", Error);
1095         bRet = FALSE;
1096         goto done;
1097     }
1098 
1099     /* Initialize user hive */
1100     if (!CreateUserHive(SidString, szUserProfilePath))
1101     {
1102         Error = GetLastError();
1103         DPRINT1("Error: %lu\n", Error);
1104         bRet = FALSE;
1105     }
1106 
1107     /* Unload the hive */
1108     AcquireRemoveRestorePrivilege(TRUE);
1109     RegUnLoadKeyW(HKEY_USERS, SidString);
1110     AcquireRemoveRestorePrivilege(FALSE);
1111 
1112     /*
1113      * If the caller wants to retrieve the user profile path,
1114      * give it now. 'dwDirSize' is the number of characters.
1115      */
1116     if (lpProfileDir && dwDirSize)
1117         StringCchCopyW(lpProfileDir, dwDirSize, szUserProfilePath);
1118 
1119 done:
1120     LocalFree((HLOCAL)SidString);
1121     SetLastError((DWORD)Error);
1122 
1123     DPRINT("CreateUserProfileExW() done\n");
1124 
1125     return bRet;
1126 }
1127 
1128 
1129 BOOL
1130 WINAPI
1131 DeleteProfileA(
1132     _In_ LPCSTR lpSidString,
1133     _In_opt_ LPCSTR lpProfilePath,
1134     _In_opt_ LPCSTR lpComputerName)
1135 {
1136     BOOL bResult;
1137     UNICODE_STRING SidString = {0, 0, NULL}, ProfilePath = {0, 0, NULL}, ComputerName = {0, 0, NULL};
1138 
1139     DPRINT("DeleteProfileA() called\n");
1140 
1141     /* Conversion to UNICODE */
1142     if (lpSidString)
1143         RtlCreateUnicodeStringFromAsciiz(&SidString,
1144                                          (LPSTR)lpSidString);
1145 
1146     if (lpProfilePath)
1147         RtlCreateUnicodeStringFromAsciiz(&ProfilePath,
1148                                          (LPSTR)lpProfilePath);
1149 
1150     if (lpComputerName)
1151         RtlCreateUnicodeStringFromAsciiz(&ComputerName,
1152                                          (LPSTR)lpComputerName);
1153 
1154     /* Call the UNICODE function */
1155     bResult = DeleteProfileW(SidString.Buffer,
1156                              ProfilePath.Buffer,
1157                              ComputerName.Buffer);
1158 
1159     /* Memory cleanup */
1160     if (lpSidString)
1161         RtlFreeUnicodeString(&SidString);
1162 
1163     if (lpProfilePath)
1164         RtlFreeUnicodeString(&ProfilePath);
1165 
1166     if (lpComputerName)
1167         RtlFreeUnicodeString(&ComputerName);
1168 
1169     return bResult;
1170 }
1171 
1172 
1173 BOOL
1174 WINAPI
1175 DeleteProfileW(
1176     _In_ LPCWSTR lpSidString,
1177     _In_opt_ LPCWSTR lpProfilePath,
1178     _In_opt_ LPCWSTR lpComputerName)
1179 {
1180     DPRINT1("DeleteProfileW(%S %S %S) not implemented!\n", lpSidString, lpProfilePath, lpComputerName);
1181     return TRUE; //FALSE;
1182 }
1183 
1184 
1185 BOOL
1186 WINAPI
1187 GetAllUsersProfileDirectoryA(
1188     _Out_opt_ LPSTR lpProfileDir,
1189     _Inout_ LPDWORD lpcchSize)
1190 {
1191     LPWSTR lpBuffer;
1192     BOOL bResult;
1193 
1194     if (!lpcchSize)
1195     {
1196         SetLastError(ERROR_INVALID_PARAMETER);
1197         return FALSE;
1198     }
1199 
1200     lpBuffer = GlobalAlloc(GMEM_FIXED,
1201                            *lpcchSize * sizeof(WCHAR));
1202     if (lpBuffer == NULL)
1203         return FALSE;
1204 
1205     bResult = GetAllUsersProfileDirectoryW(lpBuffer,
1206                                            lpcchSize);
1207     if (bResult && lpProfileDir)
1208     {
1209         bResult = WideCharToMultiByte(CP_ACP,
1210                                       0,
1211                                       lpBuffer,
1212                                       -1,
1213                                       lpProfileDir,
1214                                       *lpcchSize,
1215                                       NULL,
1216                                       NULL);
1217     }
1218 
1219     GlobalFree(lpBuffer);
1220 
1221     return bResult;
1222 }
1223 
1224 
1225 BOOL
1226 WINAPI
1227 GetAllUsersProfileDirectoryW(
1228     _Out_opt_ LPWSTR lpProfileDir,
1229     _Inout_ LPDWORD lpcchSize)
1230 {
1231     WCHAR szProfilePath[MAX_PATH];
1232     WCHAR szBuffer[MAX_PATH];
1233     DWORD dwType, dwLength;
1234     HKEY hKey;
1235     LONG Error;
1236 
1237     if (!lpcchSize)
1238     {
1239         SetLastError(ERROR_INVALID_PARAMETER);
1240         return FALSE;
1241     }
1242 
1243     Error = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1244                           L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
1245                           0,
1246                           KEY_QUERY_VALUE,
1247                           &hKey);
1248     if (Error != ERROR_SUCCESS)
1249     {
1250         DPRINT1("Error: %lu\n", Error);
1251         SetLastError((DWORD)Error);
1252         return FALSE;
1253     }
1254 
1255     /* Get profiles path */
1256     dwLength = sizeof(szBuffer);
1257     Error = RegQueryValueExW(hKey,
1258                              L"ProfilesDirectory",
1259                              NULL,
1260                              &dwType,
1261                              (LPBYTE)szBuffer,
1262                              &dwLength);
1263     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1264     {
1265         DPRINT1("Error: %lu\n", Error);
1266         RegCloseKey(hKey);
1267         SetLastError((DWORD)Error);
1268         return FALSE;
1269     }
1270 
1271     /* Expand it */
1272     if (!ExpandEnvironmentStringsW(szBuffer,
1273                                    szProfilePath,
1274                                    ARRAYSIZE(szProfilePath)))
1275     {
1276         DPRINT1("Error: %lu\n", GetLastError());
1277         RegCloseKey(hKey);
1278         return FALSE;
1279     }
1280 
1281     /* Get 'AllUsersProfile' name */
1282     dwLength = sizeof(szBuffer);
1283     Error = RegQueryValueExW(hKey,
1284                              L"AllUsersProfile",
1285                              NULL,
1286                              &dwType,
1287                              (LPBYTE)szBuffer,
1288                              &dwLength);
1289     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1290     {
1291         DPRINT1("Error: %lu\n", Error);
1292         RegCloseKey(hKey);
1293         SetLastError((DWORD)Error);
1294         return FALSE;
1295     }
1296 
1297     RegCloseKey(hKey);
1298 
1299     StringCbCatW(szProfilePath, sizeof(szProfilePath), L"\\");
1300     StringCbCatW(szProfilePath, sizeof(szProfilePath), szBuffer);
1301 
1302     dwLength = wcslen(szProfilePath) + 1;
1303     if (lpProfileDir && (*lpcchSize >= dwLength))
1304     {
1305         StringCchCopyW(lpProfileDir, *lpcchSize, szProfilePath);
1306         *lpcchSize = dwLength;
1307         return TRUE;
1308     }
1309     else // if (!lpProfileDir || (*lpcchSize < dwLength))
1310     {
1311         *lpcchSize = dwLength;
1312         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1313         return FALSE;
1314     }
1315 }
1316 
1317 
1318 BOOL
1319 WINAPI
1320 GetDefaultUserProfileDirectoryA(
1321     _Out_opt_ LPSTR lpProfileDir,
1322     _Inout_ LPDWORD lpcchSize)
1323 {
1324     LPWSTR lpBuffer;
1325     BOOL bResult;
1326 
1327     if (!lpcchSize)
1328     {
1329         SetLastError(ERROR_INVALID_PARAMETER);
1330         return FALSE;
1331     }
1332 
1333     lpBuffer = GlobalAlloc(GMEM_FIXED,
1334                            *lpcchSize * sizeof(WCHAR));
1335     if (lpBuffer == NULL)
1336         return FALSE;
1337 
1338     bResult = GetDefaultUserProfileDirectoryW(lpBuffer,
1339                                               lpcchSize);
1340     if (bResult && lpProfileDir)
1341     {
1342         bResult = WideCharToMultiByte(CP_ACP,
1343                                       0,
1344                                       lpBuffer,
1345                                       -1,
1346                                       lpProfileDir,
1347                                       *lpcchSize,
1348                                       NULL,
1349                                       NULL);
1350     }
1351 
1352     GlobalFree(lpBuffer);
1353 
1354     return bResult;
1355 }
1356 
1357 
1358 BOOL
1359 WINAPI
1360 GetDefaultUserProfileDirectoryW(
1361     _Out_opt_ LPWSTR lpProfileDir,
1362     _Inout_ LPDWORD lpcchSize)
1363 {
1364     WCHAR szProfilePath[MAX_PATH];
1365     WCHAR szBuffer[MAX_PATH];
1366     DWORD dwType, dwLength;
1367     HKEY hKey;
1368     LONG Error;
1369 
1370     if (!lpcchSize)
1371     {
1372         SetLastError(ERROR_INVALID_PARAMETER);
1373         return FALSE;
1374     }
1375 
1376     Error = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1377                           L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
1378                           0,
1379                           KEY_QUERY_VALUE,
1380                           &hKey);
1381     if (Error != ERROR_SUCCESS)
1382     {
1383         DPRINT1("Error: %lu\n", Error);
1384         SetLastError((DWORD)Error);
1385         return FALSE;
1386     }
1387 
1388     /* Get profiles path */
1389     dwLength = sizeof(szBuffer);
1390     Error = RegQueryValueExW(hKey,
1391                              L"ProfilesDirectory",
1392                              NULL,
1393                              &dwType,
1394                              (LPBYTE)szBuffer,
1395                              &dwLength);
1396     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1397     {
1398         DPRINT1("Error: %lu\n", Error);
1399         RegCloseKey(hKey);
1400         SetLastError((DWORD)Error);
1401         return FALSE;
1402     }
1403 
1404     /* Expand it */
1405     if (!ExpandEnvironmentStringsW(szBuffer,
1406                                    szProfilePath,
1407                                    ARRAYSIZE(szProfilePath)))
1408     {
1409         DPRINT1("Error: %lu\n", GetLastError());
1410         RegCloseKey(hKey);
1411         return FALSE;
1412     }
1413 
1414     /* Get 'DefaultUserProfile' name */
1415     dwLength = sizeof(szBuffer);
1416     Error = RegQueryValueExW(hKey,
1417                              L"DefaultUserProfile",
1418                              NULL,
1419                              &dwType,
1420                              (LPBYTE)szBuffer,
1421                              &dwLength);
1422     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1423     {
1424         DPRINT1("Error: %lu\n", Error);
1425         RegCloseKey(hKey);
1426         SetLastError((DWORD)Error);
1427         return FALSE;
1428     }
1429 
1430     RegCloseKey(hKey);
1431 
1432     StringCbCatW(szProfilePath, sizeof(szProfilePath), L"\\");
1433     StringCbCatW(szProfilePath, sizeof(szProfilePath), szBuffer);
1434 
1435     dwLength = wcslen(szProfilePath) + 1;
1436     if (lpProfileDir && (*lpcchSize >= dwLength))
1437     {
1438         StringCchCopyW(lpProfileDir, *lpcchSize, szProfilePath);
1439         *lpcchSize = dwLength;
1440         return TRUE;
1441     }
1442     else // if (!lpProfileDir || (*lpcchSize < dwLength))
1443     {
1444         *lpcchSize = dwLength;
1445         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1446         return FALSE;
1447     }
1448 }
1449 
1450 
1451 BOOL
1452 WINAPI
1453 GetProfilesDirectoryA(
1454     _Out_ LPSTR lpProfileDir, // _Out_opt_
1455     _Inout_ LPDWORD lpcchSize)
1456 {
1457     LPWSTR lpBuffer;
1458     BOOL bResult;
1459 
1460     if (!lpcchSize || !lpProfileDir)
1461     {
1462         SetLastError(ERROR_INVALID_PARAMETER);
1463         return FALSE;
1464     }
1465 
1466     lpBuffer = GlobalAlloc(GMEM_FIXED,
1467                            *lpcchSize * sizeof(WCHAR));
1468     if (lpBuffer == NULL)
1469         return FALSE;
1470 
1471     bResult = GetProfilesDirectoryW(lpBuffer,
1472                                     lpcchSize);
1473     if (bResult && lpProfileDir)
1474     {
1475         bResult = WideCharToMultiByte(CP_ACP,
1476                                       0,
1477                                       lpBuffer,
1478                                       -1,
1479                                       lpProfileDir,
1480                                       *lpcchSize,
1481                                       NULL,
1482                                       NULL);
1483     }
1484 
1485     GlobalFree(lpBuffer);
1486 
1487     return bResult;
1488 }
1489 
1490 
1491 BOOL
1492 WINAPI
1493 GetProfilesDirectoryW(
1494     _Out_ LPWSTR lpProfilesDir, // _Out_opt_
1495     _Inout_ LPDWORD lpcchSize)
1496 {
1497     WCHAR szProfilesPath[MAX_PATH];
1498     WCHAR szBuffer[MAX_PATH];
1499     DWORD dwType, dwLength;
1500     HKEY hKey;
1501     LONG Error;
1502 
1503     if (!lpcchSize)
1504     {
1505         SetLastError(ERROR_INVALID_PARAMETER);
1506         return FALSE;
1507     }
1508 
1509     Error = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1510                           L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
1511                           0,
1512                           KEY_QUERY_VALUE,
1513                           &hKey);
1514     if (Error != ERROR_SUCCESS)
1515     {
1516         DPRINT1("Error: %lu\n", Error);
1517         SetLastError((DWORD)Error);
1518         return FALSE;
1519     }
1520 
1521     /* Get profiles path */
1522     dwLength = sizeof(szBuffer);
1523     Error = RegQueryValueExW(hKey,
1524                              L"ProfilesDirectory",
1525                              NULL,
1526                              &dwType,
1527                              (LPBYTE)szBuffer,
1528                              &dwLength);
1529     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1530     {
1531         DPRINT1("Error: %lu\n", Error);
1532         RegCloseKey(hKey);
1533         SetLastError((DWORD)Error);
1534         return FALSE;
1535     }
1536 
1537     RegCloseKey(hKey);
1538 
1539     /* Expand it */
1540     if (!ExpandEnvironmentStringsW(szBuffer,
1541                                    szProfilesPath,
1542                                    ARRAYSIZE(szProfilesPath)))
1543     {
1544         DPRINT1("Error: %lu\n", GetLastError());
1545         return FALSE;
1546     }
1547 
1548     dwLength = wcslen(szProfilesPath) + 1;
1549     if (lpProfilesDir && (*lpcchSize >= dwLength))
1550     {
1551         StringCchCopyW(lpProfilesDir, *lpcchSize, szProfilesPath);
1552         *lpcchSize = dwLength;
1553         return TRUE;
1554     }
1555     else // if (!lpProfilesDir || (*lpcchSize < dwLength))
1556     {
1557         *lpcchSize = dwLength;
1558         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1559         return FALSE;
1560     }
1561 }
1562 
1563 
1564 BOOL
1565 WINAPI
1566 GetProfileType(
1567     _Out_ PDWORD pdwFlags)
1568 {
1569     UNICODE_STRING SidString = {0, 0, NULL};
1570     HANDLE hToken;
1571     HKEY hProfilesKey = NULL, hProfileKey = NULL;
1572     DWORD dwType, dwLength, dwState = 0;
1573     DWORD dwError;
1574     BOOL bResult = FALSE;
1575 
1576     DPRINT("GetProfileType(%p)\n", pdwFlags);
1577 
1578     if (pdwFlags == NULL)
1579     {
1580         SetLastError(ERROR_INVALID_PARAMETER);
1581         return FALSE;
1582     }
1583 
1584     if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken))
1585     {
1586         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
1587         {
1588             DPRINT1("Failed to open a token (Error %lu)\n", GetLastError());
1589             return FALSE;
1590         }
1591     }
1592 
1593     /* Get the user SID string */
1594     if (!GetUserSidStringFromToken(hToken, &SidString))
1595     {
1596         DPRINT1("GetUserSidStringFromToken() failed\n");
1597         goto done;
1598     }
1599 
1600     DPRINT("SID: %wZ\n", &SidString);
1601 
1602     dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1603                             L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
1604                             0,
1605                             KEY_QUERY_VALUE,
1606                             &hProfilesKey);
1607     if (dwError != ERROR_SUCCESS)
1608     {
1609         DPRINT1("Error: %lu\n", dwError);
1610         SetLastError(dwError);
1611         goto done;
1612     }
1613 
1614     dwError = RegOpenKeyExW(hProfilesKey,
1615                             SidString.Buffer,
1616                             0,
1617                             KEY_QUERY_VALUE | KEY_SET_VALUE,
1618                             &hProfileKey);
1619     if (dwError != ERROR_SUCCESS)
1620     {
1621         DPRINT1("Error: %lu\n", dwError);
1622         SetLastError(dwError);
1623         goto done;
1624     }
1625 
1626     /* Get the State value */
1627     dwLength = sizeof(dwState);
1628     dwError = RegQueryValueExW(hProfileKey,
1629                                L"State",
1630                                NULL,
1631                                &dwType,
1632                                (PBYTE)&dwState,
1633                                &dwLength);
1634     if (dwError != ERROR_SUCCESS)
1635     {
1636         DPRINT1("Error: %lu\n", dwError);
1637         SetLastError(dwError);
1638         goto done;
1639     }
1640 
1641     *pdwFlags = 0;
1642 
1643     if (dwState & 0x80) /* PROFILE_GUEST_USER */
1644         *pdwFlags |= PT_TEMPORARY;
1645 
1646     /* FIXME: Add checks for PT_MANDATORY and PT_ROAMING */
1647 
1648     bResult = TRUE;
1649 
1650 done:
1651     if (hProfileKey != NULL)
1652         RegCloseKey(hProfileKey);
1653 
1654     if (hProfilesKey != NULL)
1655         RegCloseKey(hProfilesKey);
1656 
1657     RtlFreeUnicodeString(&SidString);
1658 
1659     CloseHandle(hToken);
1660 
1661     return bResult;
1662 }
1663 
1664 
1665 BOOL
1666 WINAPI
1667 GetUserProfileDirectoryA(
1668     _In_ HANDLE hToken,
1669     _Out_opt_ LPSTR lpProfileDir,
1670     _Inout_ LPDWORD lpcchSize)
1671 {
1672     LPWSTR lpBuffer;
1673     BOOL bResult;
1674 
1675     if (!lpcchSize || !lpProfileDir)
1676     {
1677         SetLastError(ERROR_INVALID_PARAMETER);
1678         return FALSE;
1679     }
1680 
1681     lpBuffer = GlobalAlloc(GMEM_FIXED,
1682                            *lpcchSize * sizeof(WCHAR));
1683     if (lpBuffer == NULL)
1684         return FALSE;
1685 
1686     bResult = GetUserProfileDirectoryW(hToken,
1687                                        lpBuffer,
1688                                        lpcchSize);
1689     if (bResult && lpProfileDir)
1690     {
1691         bResult = WideCharToMultiByte(CP_ACP,
1692                                       0,
1693                                       lpBuffer,
1694                                       -1,
1695                                       lpProfileDir,
1696                                       *lpcchSize,
1697                                       NULL,
1698                                       NULL);
1699     }
1700 
1701     GlobalFree(lpBuffer);
1702 
1703     return bResult;
1704 }
1705 
1706 
1707 BOOL
1708 WINAPI
1709 GetUserProfileDirectoryW(
1710     _In_ HANDLE hToken,
1711     _Out_opt_ LPWSTR lpProfileDir,
1712     _Inout_ LPDWORD lpcchSize)
1713 {
1714     UNICODE_STRING SidString;
1715     WCHAR szKeyName[MAX_PATH];
1716     WCHAR szRawImagePath[MAX_PATH];
1717     WCHAR szImagePath[MAX_PATH];
1718     DWORD dwType, dwLength;
1719     HKEY hKey;
1720     LONG Error;
1721 
1722     if (!hToken)
1723     {
1724         SetLastError(ERROR_INVALID_HANDLE);
1725         return FALSE;
1726     }
1727 
1728     if (!lpcchSize)
1729     {
1730         SetLastError(ERROR_INVALID_PARAMETER);
1731         return FALSE;
1732     }
1733 
1734     /* Get the user SID string */
1735     if (!GetUserSidStringFromToken(hToken, &SidString))
1736     {
1737         DPRINT1("GetUserSidStringFromToken() failed\n");
1738         return FALSE;
1739     }
1740 
1741     DPRINT("SidString: '%wZ'\n", &SidString);
1742 
1743     StringCbCopyW(szKeyName, sizeof(szKeyName),
1744                   L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\");
1745     StringCbCatW(szKeyName, sizeof(szKeyName), SidString.Buffer);
1746 
1747     RtlFreeUnicodeString(&SidString);
1748 
1749     DPRINT("KeyName: '%S'\n", szKeyName);
1750 
1751     Error = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
1752                           szKeyName,
1753                           0,
1754                           KEY_QUERY_VALUE,
1755                           &hKey);
1756     if (Error != ERROR_SUCCESS)
1757     {
1758         DPRINT1("Error: %lu\n", Error);
1759         SetLastError((DWORD)Error);
1760         return FALSE;
1761     }
1762 
1763     dwLength = sizeof(szRawImagePath);
1764     Error = RegQueryValueExW(hKey,
1765                              L"ProfileImagePath",
1766                              NULL,
1767                              &dwType,
1768                              (LPBYTE)szRawImagePath,
1769                              &dwLength);
1770     if ((Error != ERROR_SUCCESS) || (dwType != REG_SZ && dwType != REG_EXPAND_SZ))
1771     {
1772         DPRINT1("Error: %lu\n", Error);
1773         RegCloseKey(hKey);
1774         SetLastError((DWORD)Error);
1775         return FALSE;
1776     }
1777 
1778     RegCloseKey(hKey);
1779 
1780     DPRINT("RawImagePath: '%S'\n", szRawImagePath);
1781 
1782     /* Expand it */
1783     if (!ExpandEnvironmentStringsW(szRawImagePath,
1784                                    szImagePath,
1785                                    ARRAYSIZE(szImagePath)))
1786     {
1787         DPRINT1("Error: %lu\n", GetLastError());
1788         return FALSE;
1789     }
1790 
1791     DPRINT("ImagePath: '%S'\n", szImagePath);
1792 
1793     dwLength = wcslen(szImagePath) + 1;
1794     if (lpProfileDir && (*lpcchSize >= dwLength))
1795     {
1796         StringCchCopyW(lpProfileDir, *lpcchSize, szImagePath);
1797         *lpcchSize = dwLength;
1798         return TRUE;
1799     }
1800     else // if (!lpProfileDir || (*lpcchSize < dwLength))
1801     {
1802         *lpcchSize = dwLength;
1803         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1804         return FALSE;
1805     }
1806 }
1807 
1808 
1809 BOOL
1810 WINAPI
1811 LoadUserProfileA(
1812     _In_ HANDLE hToken,
1813     _Inout_ LPPROFILEINFOA lpProfileInfo)
1814 {
1815     BOOL bResult = FALSE;
1816     PROFILEINFOW ProfileInfoW = {0};
1817     int len;
1818 
1819     DPRINT("LoadUserProfileA() called\n");
1820 
1821     /* Check profile info */
1822     if (!lpProfileInfo || (lpProfileInfo->dwSize != sizeof(PROFILEINFOA)) ||
1823         (lpProfileInfo->lpUserName == NULL) || (lpProfileInfo->lpUserName[0] == 0))
1824     {
1825         SetLastError(ERROR_INVALID_PARAMETER);
1826         return FALSE;
1827     }
1828 
1829     /* Convert the structure to UNICODE... */
1830     ProfileInfoW.dwSize = sizeof(ProfileInfoW);
1831     ProfileInfoW.dwFlags = lpProfileInfo->dwFlags;
1832 
1833     if (lpProfileInfo->lpUserName)
1834     {
1835         len = MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpUserName, -1, NULL, 0);
1836         ProfileInfoW.lpUserName = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
1837         if (!ProfileInfoW.lpUserName)
1838         {
1839             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1840             goto cleanup;
1841         }
1842         MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpUserName, -1, ProfileInfoW.lpUserName, len);
1843     }
1844 
1845     if (lpProfileInfo->lpProfilePath)
1846     {
1847         len = MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpProfilePath, -1, NULL, 0);
1848         ProfileInfoW.lpProfilePath = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
1849         if (!ProfileInfoW.lpProfilePath)
1850         {
1851             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1852             goto cleanup;
1853         }
1854         MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpProfilePath, -1, ProfileInfoW.lpProfilePath, len);
1855     }
1856 
1857     if (lpProfileInfo->lpDefaultPath)
1858     {
1859         len = MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpDefaultPath, -1, NULL, 0);
1860         ProfileInfoW.lpDefaultPath = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
1861         if (!ProfileInfoW.lpDefaultPath)
1862         {
1863             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1864             goto cleanup;
1865         }
1866         MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpDefaultPath, -1, ProfileInfoW.lpDefaultPath, len);
1867     }
1868 
1869     if (lpProfileInfo->lpServerName)
1870     {
1871         len = MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpServerName, -1, NULL, 0);
1872         ProfileInfoW.lpServerName = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
1873         if (!ProfileInfoW.lpServerName)
1874         {
1875             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1876             goto cleanup;
1877         }
1878         MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpServerName, -1, ProfileInfoW.lpServerName, len);
1879     }
1880 
1881     if ((ProfileInfoW.dwFlags & PI_APPLYPOLICY) != 0 && lpProfileInfo->lpPolicyPath)
1882     {
1883         len = MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpPolicyPath, -1, NULL, 0);
1884         ProfileInfoW.lpPolicyPath = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
1885         if (!ProfileInfoW.lpPolicyPath)
1886         {
1887             SetLastError(ERROR_NOT_ENOUGH_MEMORY);
1888             goto cleanup;
1889         }
1890         MultiByteToWideChar(CP_ACP, 0, lpProfileInfo->lpPolicyPath, -1, ProfileInfoW.lpPolicyPath, len);
1891     }
1892 
1893     /* ... and call the UNICODE function */
1894     bResult = LoadUserProfileW(hToken, &ProfileInfoW);
1895 
1896     /* Save the returned value */
1897     lpProfileInfo->hProfile = ProfileInfoW.hProfile;
1898 
1899 cleanup:
1900     /* Memory cleanup */
1901     if (ProfileInfoW.lpUserName)
1902         HeapFree(GetProcessHeap(), 0, ProfileInfoW.lpUserName);
1903 
1904     if (ProfileInfoW.lpProfilePath)
1905         HeapFree(GetProcessHeap(), 0, ProfileInfoW.lpProfilePath);
1906 
1907     if (ProfileInfoW.lpDefaultPath)
1908         HeapFree(GetProcessHeap(), 0, ProfileInfoW.lpDefaultPath);
1909 
1910     if (ProfileInfoW.lpServerName)
1911         HeapFree(GetProcessHeap(), 0, ProfileInfoW.lpServerName);
1912 
1913     if ((ProfileInfoW.dwFlags & PI_APPLYPOLICY) != 0 && ProfileInfoW.lpPolicyPath)
1914         HeapFree(GetProcessHeap(), 0, ProfileInfoW.lpPolicyPath);
1915 
1916     return bResult;
1917 }
1918 
1919 
1920 BOOL
1921 WINAPI
1922 LoadUserProfileW(
1923     _In_ HANDLE hToken,
1924     _Inout_ LPPROFILEINFOW lpProfileInfo)
1925 {
1926     WCHAR szUserHivePath[MAX_PATH];
1927     PTOKEN_USER UserSid = NULL;
1928     UNICODE_STRING SidString = { 0, 0, NULL };
1929     HANDLE hProfileMutex = NULL;
1930     LONG Error;
1931     BOOL ret = FALSE;
1932     DWORD dwLength = sizeof(szUserHivePath) / sizeof(szUserHivePath[0]);
1933 
1934     DPRINT("LoadUserProfileW(%p %p)\n", hToken, lpProfileInfo);
1935 
1936     /* Check profile info */
1937     if (!lpProfileInfo || (lpProfileInfo->dwSize != sizeof(PROFILEINFOW)) ||
1938         (lpProfileInfo->lpUserName == NULL) || (lpProfileInfo->lpUserName[0] == 0))
1939     {
1940         SetLastError(ERROR_INVALID_PARAMETER);
1941         return FALSE;
1942     }
1943 
1944     DPRINT("UserName: %S\n", lpProfileInfo->lpUserName);
1945 
1946     /* Get the user SID string */
1947     ret = GetUserSidStringFromToken(hToken, &SidString);
1948     if (!ret)
1949     {
1950         DPRINT1("GetUserSidStringFromToken() failed\n");
1951         goto cleanup;
1952     }
1953     ret = FALSE;
1954 
1955     /* Create the profile mutex */
1956     hProfileMutex = CreateProfileMutex(SidString.Buffer);
1957     if (hProfileMutex == NULL)
1958     {
1959         DPRINT1("Failed to create the profile mutex\n");
1960         goto cleanup;
1961     }
1962 
1963     /* Wait for the profile mutex */
1964     WaitForSingleObject(hProfileMutex, INFINITE);
1965 
1966     /* Don't load a profile twice */
1967     if (CheckForLoadedProfile(hToken))
1968     {
1969         DPRINT1("Profile %S already loaded\n", SidString.Buffer);
1970     }
1971     else
1972     {
1973         DPRINT1("Loading profile %S\n", SidString.Buffer);
1974 
1975         if (lpProfileInfo->lpProfilePath)
1976         {
1977             /* Use the caller's specified roaming user profile path */
1978             StringCbCopyW(szUserHivePath, sizeof(szUserHivePath), lpProfileInfo->lpProfilePath);
1979         }
1980         else
1981         {
1982             /* FIXME: check if MS Windows allows lpProfileInfo->lpProfilePath to be NULL */
1983             if (!GetProfilesDirectoryW(szUserHivePath, &dwLength))
1984             {
1985                 DPRINT1("GetProfilesDirectoryW() failed (error %ld)\n", GetLastError());
1986                 goto cleanup;
1987             }
1988         }
1989 
1990         /* Create user hive name */
1991         StringCbCatW(szUserHivePath, sizeof(szUserHivePath), L"\\");
1992         StringCbCatW(szUserHivePath, sizeof(szUserHivePath), lpProfileInfo->lpUserName);
1993         StringCbCatW(szUserHivePath, sizeof(szUserHivePath), L"\\ntuser.dat");
1994         DPRINT("szUserHivePath: %S\n", szUserHivePath);
1995 
1996         /* Create user profile directory if needed */
1997         if (GetFileAttributesW(szUserHivePath) == INVALID_FILE_ATTRIBUTES)
1998         {
1999             /* Get user sid */
2000             if (GetTokenInformation(hToken, TokenUser, NULL, 0, &dwLength) ||
2001                 GetLastError() != ERROR_INSUFFICIENT_BUFFER)
2002             {
2003                 DPRINT1 ("GetTokenInformation() failed\n");
2004                 goto cleanup;
2005             }
2006 
2007             UserSid = (PTOKEN_USER)HeapAlloc(GetProcessHeap(), 0, dwLength);
2008             if (!UserSid)
2009             {
2010                 DPRINT1("HeapAlloc() failed\n");
2011                 SetLastError(ERROR_NOT_ENOUGH_MEMORY);
2012                 goto cleanup;
2013             }
2014 
2015             if (!GetTokenInformation(hToken, TokenUser, UserSid, dwLength, &dwLength))
2016             {
2017                 DPRINT1("GetTokenInformation() failed\n");
2018                 goto cleanup;
2019             }
2020 
2021             /* Create profile */
2022             ret = CreateUserProfileW(UserSid->User.Sid, lpProfileInfo->lpUserName);
2023             if (!ret)
2024             {
2025                 DPRINT1("CreateUserProfileW() failed\n");
2026                 goto cleanup;
2027             }
2028         }
2029 
2030         /* Acquire restore privilege */
2031         if (!AcquireRemoveRestorePrivilege(TRUE))
2032         {
2033             DPRINT1("AcquireRemoveRestorePrivilege() failed (Error %ld)\n", GetLastError());
2034             goto cleanup;
2035         }
2036 
2037         /* Load user registry hive */
2038         Error = RegLoadKeyW(HKEY_USERS,
2039                             SidString.Buffer,
2040                             szUserHivePath);
2041         AcquireRemoveRestorePrivilege(FALSE);
2042 
2043         /* HACK: Do not fail if the profile has already been loaded! */
2044         if (Error == ERROR_SHARING_VIOLATION)
2045             Error = ERROR_SUCCESS;
2046 
2047         if (Error != ERROR_SUCCESS)
2048         {
2049             DPRINT1("RegLoadKeyW() failed (Error %ld)\n", Error);
2050             SetLastError((DWORD)Error);
2051             goto cleanup;
2052         }
2053 
2054         SetProfileData(SidString.Buffer,
2055                        lpProfileInfo->dwFlags,
2056                        hToken);
2057     }
2058 
2059     /* Open future HKEY_CURRENT_USER */
2060     Error = RegOpenKeyExW(HKEY_USERS,
2061                           SidString.Buffer,
2062                           0,
2063                           MAXIMUM_ALLOWED,
2064                           (PHKEY)&lpProfileInfo->hProfile);
2065     if (Error != ERROR_SUCCESS)
2066     {
2067         DPRINT1("RegOpenKeyExW() failed (Error %ld)\n", Error);
2068         SetLastError((DWORD)Error);
2069         goto cleanup;
2070     }
2071 
2072     Error = IncrementRefCount(SidString.Buffer, NULL);
2073     if (Error != ERROR_SUCCESS)
2074     {
2075         DPRINT1("IncrementRefCount() failed (Error %ld)\n", Error);
2076         SetLastError((DWORD)Error);
2077         goto cleanup;
2078     }
2079 
2080     ret = TRUE;
2081 
2082 cleanup:
2083     if (UserSid != NULL)
2084         HeapFree(GetProcessHeap(), 0, UserSid);
2085 
2086     if (hProfileMutex != NULL)
2087     {
2088         ReleaseMutex(hProfileMutex);
2089         CloseHandle(hProfileMutex);
2090     }
2091 
2092     RtlFreeUnicodeString(&SidString);
2093 
2094     DPRINT("LoadUserProfileW() done\n");
2095     return ret;
2096 }
2097 
2098 
2099 BOOL
2100 WINAPI
2101 UnloadUserProfile(
2102     _In_ HANDLE hToken,
2103     _In_ HANDLE hProfile)
2104 {
2105     UNICODE_STRING SidString = {0, 0, NULL};
2106     HANDLE hProfileMutex = NULL;
2107     HKEY hProfilesKey = NULL, hProfileKey = NULL;
2108     DWORD dwRefCount = 0, dwLength, dwType, dwState = 0;
2109     DWORD dwError;
2110     BOOL bRet = FALSE;
2111 
2112     DPRINT("UnloadUserProfile() called\n");
2113 
2114     if (hProfile == NULL)
2115     {
2116         DPRINT1("Invalid profile handle\n");
2117         SetLastError(ERROR_INVALID_PARAMETER);
2118         return FALSE;
2119     }
2120 
2121     /* Get the user SID string */
2122     if (!GetUserSidStringFromToken(hToken, &SidString))
2123     {
2124         DPRINT1("GetUserSidStringFromToken() failed\n");
2125         return FALSE;
2126     }
2127 
2128     DPRINT("SidString: '%wZ'\n", &SidString);
2129 
2130     /* Create the profile mutex */
2131     hProfileMutex = CreateProfileMutex(SidString.Buffer);
2132     if (hProfileMutex == NULL)
2133     {
2134         DPRINT1("Failed to create the profile mutex\n");
2135         goto cleanup;
2136     }
2137 
2138     /* Wait for the profile mutex */
2139     WaitForSingleObject(hProfileMutex, INFINITE);
2140 
2141     /* Close the profile handle */
2142     RegFlushKey(hProfile);
2143     RegCloseKey(hProfile);
2144 
2145     dwError = DecrementRefCount(SidString.Buffer, &dwRefCount);
2146     if (dwError != ERROR_SUCCESS)
2147     {
2148         DPRINT1("DecrementRefCount() failed (Error %lu)\n", dwError);
2149         SetLastError(dwError);
2150         goto cleanup;
2151     }
2152 
2153     if (dwRefCount == 0)
2154     {
2155         DPRINT("RefCount is 0: Unload the Hive!\n");
2156 
2157         /* Acquire restore privilege */
2158         if (!AcquireRemoveRestorePrivilege(TRUE))
2159         {
2160             DPRINT1("AcquireRemoveRestorePrivilege() failed (Error %lu)\n", GetLastError());
2161             goto cleanup;
2162         }
2163 
2164         /* HACK */
2165         {
2166             HKEY hUserKey;
2167 
2168             dwError = RegOpenKeyExW(HKEY_USERS,
2169                                     SidString.Buffer,
2170                                     0,
2171                                     KEY_WRITE,
2172                                     &hUserKey);
2173             if (dwError == ERROR_SUCCESS)
2174             {
2175                 RegDeleteKeyW(hUserKey,
2176                               L"Volatile Environment");
2177 
2178                 RegCloseKey(hUserKey);
2179             }
2180         }
2181         /* End of HACK */
2182 
2183         /* Unload the hive */
2184         dwError = RegUnLoadKeyW(HKEY_USERS,
2185                                 SidString.Buffer);
2186 
2187         /* Remove restore privilege */
2188         AcquireRemoveRestorePrivilege(FALSE);
2189 
2190         if (dwError != ERROR_SUCCESS)
2191         {
2192             DPRINT1("RegUnLoadKeyW() failed (Error %lu)\n", dwError);
2193             SetLastError(dwError);
2194             goto cleanup;
2195         }
2196 
2197         dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
2198                                 L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
2199                                 0,
2200                                 KEY_QUERY_VALUE,
2201                                 &hProfilesKey);
2202         if (dwError != ERROR_SUCCESS)
2203         {
2204             DPRINT1("RegOpenKeyExW() failed (Error %lu)\n", dwError);
2205             SetLastError(dwError);
2206             goto cleanup;
2207         }
2208 
2209         dwError = RegOpenKeyExW(hProfilesKey,
2210                                 SidString.Buffer,
2211                                 0,
2212                                 KEY_QUERY_VALUE,
2213                                 &hProfileKey);
2214         if (dwError != ERROR_SUCCESS)
2215         {
2216             DPRINT1("RegOpenKeyExW() failed (Error %lu)\n", dwError);
2217             SetLastError(dwError);
2218             goto cleanup;
2219         }
2220 
2221         /* Get the State value */
2222         dwLength = sizeof(dwState);
2223         dwError = RegQueryValueExW(hProfileKey,
2224                                    L"State",
2225                                    NULL,
2226                                    &dwType,
2227                                    (PBYTE)&dwState,
2228                                    &dwLength);
2229         if (dwError != ERROR_SUCCESS)
2230         {
2231             DPRINT1("RegQueryValueExW() failed (Error %lu)\n", dwError);
2232             SetLastError(dwError);
2233             goto cleanup;
2234         }
2235 
2236         /* Delete a guest profile */
2237         if (dwState & 0x80) // PROFILE_GUEST_USER
2238         {
2239             if (!DeleteProfileW(SidString.Buffer, NULL, NULL))
2240             {
2241                 DPRINT1("DeleteProfile(%S, NULL, NULL) failed (Error %lu)\n",
2242                         SidString.Buffer, GetLastError());
2243                 goto cleanup;
2244             }
2245         }
2246     }
2247 
2248     bRet = TRUE;
2249 
2250 cleanup:
2251     if (hProfileKey != NULL)
2252         RegCloseKey(hProfileKey);
2253 
2254     if (hProfilesKey != NULL)
2255         RegCloseKey(hProfilesKey);
2256 
2257     if (hProfileMutex != NULL)
2258     {
2259         ReleaseMutex(hProfileMutex);
2260         CloseHandle(hProfileMutex);
2261     }
2262 
2263     RtlFreeUnicodeString(&SidString);
2264 
2265     DPRINT("UnloadUserProfile() done\n");
2266 
2267     return bRet;
2268 }
2269 
2270 /* EOF */
2271