Crate ms_lsad 

MS-LSAD — Local Security Authority (Domain Policy) Remote Protocol.

Companion crate to ms-lsat (LSA Translation). Both share the interface UUID 12345778-1234-abcd-ef00-0123456789ab (v0.0) on \PIPE\lsarpc. LSAT covers SID↔name lookups; this crate covers domain policy read/write and trusted-domain object management.

v0.1 opnums:

Opnum	Name	Purpose
44	LsarOpenPolicy2	(reused from ms-lsat) get policy handle
13	LsarEnumerateTrustedDomains	enumerate configured trusts (v1 API)
0	LsarClose	(reused) close policy handle

Dual use

• Audit / DFIR — enumerate every configured trust and its direction / attributes for defensive posture. Currently no pure-Rust way to do this over the wire without linking a full Windows SDK.
• Offensive — enumerate trusts as a scouting step before cross-forest attack chains (the trust-key extraction path lands with LsarQueryTrustedDomainInfoByName / opnum 48 or via DRS bulk GetNCChanges — target for v0.2).

Composes with

• dcerpc — sealed LSARPC transport.
• ms-lsat — shares the policy handle with SID/name translation calls.
• ms-drsr — alternative trust-key path via DRS replication.

Spec

Modules

opnum

MS-LSAD opnum table ([MS-LSAD] §3.1.4). LSA interface shares the numbering with LSAT but the two carve up different opnum ranges. Values here are LSAD-only.

Structs

EnumerateTrustsPage

A batched enumeration response: the trust rows + the updated context.

LsadClient

Ergonomic LSAD client. Binds the LSA interface over an already-open \lsarpc pipe, opens the policy handle lazily on the first call.

TrustedDomainInfo

One row of a LsarEnumerateTrustedDomains response.

Functions

decode_enumerate_trusted_domains

Decode a LsarEnumerateTrustedDomains response.

encode_enumerate_trusted_domains

LsarEnumerateTrustedDomains(PolicyHandle, EnumerationContext, EnumerationBuffer, PreferedMaximumLength).

lsad_syntax

The shared LSA interface (v0.0) — same UUID as LSAT.