Home/ Questions/Q 581477
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T14:34:58+00:00

Greetings, I’m working with a vendor who has implemented some code that uses a

  • 0

Greetings,

I’m working with a vendor who has implemented some code that uses a Windows LSA MSV1_0 subauthentication package (MSDN info if you’re interested: http://msdn.microsoft.com/en-us/library/aa374786(VS.85).aspx ) and I’m trying to figure out if it’s necessary.

As far as I can tell, the subauthentication routine and filter allow for hooking or customizing the standard LSA MSV1_0 logon event processing. The issue is that I don’t understand why the vendor’s product would need these capabilities.

I’ve asked them and they said they use it to perform impersonation. The product definitely does need to do impersonation, but based on my limited win32 knowledge, they could get the functionality they need using the normal auth APIs (LsaLogonUser, ImpersonateLoggedOnUser, etc) without the subauthentication package. Furthermore, I’ve worked with a number of similar products that all do impersonation, and this is the only one that’s used a subauthentication package.

If you’re wondering why I would care, a previous version of the product had a bug in the subauthentication package dll that would cause lockups or bluescreens. That makes me rather nervous and has me questioning the use of such a low-level, kernel sensitive interface. I’d like to go back to the vendor and say “There’s no way you could need an LSA subauth package for impersonation – take it out”, but I’m not sure I understand the use cases and possible limitations of the standard win32 authentication/impersonation APIs well enough to make that claim definitively.

So, to the win32 security gurus out there, is there any reason you would need an LSA MSV1_0 subauthentication package if all you were doing is impersonation?

Thanks in advance for any thoughts!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I do not believe packages are just for Impersonation.
    In the link you gave, there is no nothing related to ‘impersonation’

    I think you may have subauthentication package to verify user, at extended level, like checking the finger print, or asking user more details like DOB, security question etc.

    The package, I do believe is not kernel mode service, so there is no question of BSOD.

    • 0