Call a CloudAP plugin function. You may not call this function directly with the tool, but it will be implicitly called when running a cloudap plugin command.

Loads a user’s CacheData from their CloudAPCache folder, updates the "cache node flags" to disable optimized logons, then saves the CacheData back to the user’s folder. Any user logon session may be specified. If no logon session is specified then optimized logons will be disabled for the logon session.

Generate a Winlogon Automatic Restart Sign-On (ASRO) password and store it as a pair of LSA secrets. The LSA secrets will have the following names:

1. M$CLOUDAP_TBAL{4416F0BD-3A59-4590-9579-DA6E08AF19B3}_HASH

2. M$CLOUDAP_TBAL{8283D8D4-55B6-466F-B7D7-17A1352D9CAB}_HASH

The value of HASH should be the sha256 hash the plugin GUID string for your logon session combined with your user’s identity name. The first secret will be the output of ext-ms-win-cloudap-tbal-l1-1-0!TbalSealBuffer. The second secret will be the value you provide which must be at least 4 bytes long.

Needs further auditing.

The _LOGON_SESSION structure has a GUID entry to identify which cloudap plugin was used (e.g., AzureAD or MicrosoftAccount) This function returns that GUID entry for a specified logon session.

Return if the DPAPI cred key for user logon session has been decrypted.

Retrieve PublicCacheData from disk, deserialize, and return it. Needs further auditing.

Get a string and time with information about when password will expire for a logon session. A client must have`SeTcbPrivilege` to specify another logon session. Otherwise, the specified session will be ignored and the current session will be used instead.

The _USER_CACHE_ENTRY structure has a DPAPI protected entry named TokenBlob, also referred to as the CloudTGT. This function unprotects and returns the TokenBlob entry for a specified logon session. You may specify a specific logon session, otherwise the current logon session will be used.

LSA Whisperer’s implementation of GetTokenBlob is believed to be correct, but only the following errors have been observed during testing:

• 0xc0000022 - Access is denied.

• 0xc000005f - A specified logon session does not exist. It may already have been terminated.

It is still unknown what setup and access is needed for the command to return successfully.

Returns the UnlockKeyType entry of the the _USER_CACHE_ENTRY structure for a logon session. The value will between 1 and 6 inclusively. Internally, GetUnlockKeyType remaps value 5 to 2, value 6 to 5, and value 7 to 6. The meaning of each of these values is currently unknown.

A client must have`SeTcbPrivilege` to specify another logon session. Otherwise, the specified session will be ignored and the current session will be used instead.

Inspects the TicketCache inside the _USER_CACHE_ENTRY structure for a logon session to see if it contains a "cloud to on-prem TGT." A client must have`SeTcbPrivilege` to specify another logon session. Otherwise, the specified session will be ignored and the current session will be used instead.

Adds a provided SID as a subkey under HKLM\Software\Microsoft\IdentityStore\DeferredCacheCleanup.

Provision an NGC node in the CloudAPCache for the current logon session. Needs further auditing.

Refresh a logon session’s TokenBlob using the RefreshToken cloudap function plugin.

Unloads then reloads all cloudap plugins.

Will update the account name in the Security Accounts Manager (SAM). Needs further auditing.

Sets an internal TestFlags value used by cloudap. The following is the value for each currently used TestFlags bit:

Transfer data between two cloudap logon sessions. The specific data that is transferred and privileges that may be required are still being determined. Will generate a new logon session for dst if needed. The function does not take any flags.

The Azure AD (AAD) plugin supports additional calls through the GenericCallPkg plugin function. The full list and their call IDs are listed here. The version numbers are anecdotal and will not account for all NT builds for which a function may be present.

The Microsoft Account (MSA) plugin supports additional functionality through the GenericCallPkg plugin function. This functionality has not been fully analyzed.

If you make an MSA request from an AppContainer, it must have the liveIdService capability. Input data is a WlidPropertyBag.

Cloudap may store the DPAPI "Cred Key" for a user profile on the file system. If it does, information about the CredKey will be stored under C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\CloudAPCache under a subfolder (AzureAD or MicrosoftAccount) in a file named [User Profile Id]\Keys\CredKeyInfo in the _CLOUDAP_CREDKEY_INFO format.

Cloudap maintains a linked list of _LOGON_SESSION structures for each cloudap provided user logon session. New entries have been appended to this structure over time, but the current list of known entries and their offsets are as follows.

Cloudap maintains a _USER_CACHE_ENTRY structure for each cloudap user logon session to maintain user specific information about the session.