[ADVAPI32]
authorAmine Khaldi <amine.khaldi@reactos.org>
Fri, 24 Oct 2014 15:40:29 +0000 (15:40 +0000)
committerAmine Khaldi <amine.khaldi@reactos.org>
Fri, 24 Oct 2014 15:40:29 +0000 (15:40 +0000)
* Reorder functions and definitions to reduce difference to the Wine source file.
CORE-8540

svn path=/trunk/; revision=64958

reactos/dll/win32/advapi32/wine/security.c

index fe1bb85..15a543f 100644 (file)
@@ -17,6 +17,9 @@
 
 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
 
+static DWORD ComputeStringSidSize(LPCWSTR StringSid);
+static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
+
 #define MAX_GUID_STRING_LEN 39
 
 BOOL WINAPI
@@ -258,42 +261,6 @@ static const ACEFLAG AceRights[] =
     { NULL, 0 },
 };
 
-static const LPCWSTR AceRightBitNames[32] = {
-        SDDL_CREATE_CHILD,        /*  0 */
-        SDDL_DELETE_CHILD,
-        SDDL_LIST_CHILDREN,
-        SDDL_SELF_WRITE,
-        SDDL_READ_PROPERTY,       /*  4 */
-        SDDL_WRITE_PROPERTY,
-        SDDL_DELETE_TREE,
-        SDDL_LIST_OBJECT,
-        SDDL_CONTROL_ACCESS,      /*  8 */
-        NULL,
-        NULL,
-        NULL,
-        NULL,                     /* 12 */
-        NULL,
-        NULL,
-        NULL,
-        SDDL_STANDARD_DELETE,     /* 16 */
-        SDDL_READ_CONTROL,
-        SDDL_WRITE_DAC,
-        SDDL_WRITE_OWNER,
-        NULL,                     /* 20 */
-        NULL,
-        NULL,
-        NULL,
-        NULL,                     /* 24 */
-        NULL,
-        NULL,
-        NULL,
-        SDDL_GENERIC_ALL,         /* 28 */
-        SDDL_GENERIC_EXECUTE,
-        SDDL_GENERIC_WRITE,
-        SDDL_GENERIC_READ
-};
-
-
 /* set last error code from NT status and get the proper boolean return value */
 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 static __inline BOOL set_ntstatus( NTSTATUS status )
@@ -302,27 +269,50 @@ static __inline BOOL set_ntstatus( NTSTATUS status )
     return !status;
 }
 
-
-/* Exported functions */
-
-/*
- * @implemented
- */
-BOOL WINAPI
-AllocateLocallyUniqueId(PLUID Luid)
+static const RECORD SidTable[] =
 {
-    NTSTATUS Status;
-
-    Status = NtAllocateLocallyUniqueId (Luid);
-    if (!NT_SUCCESS (Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    return TRUE;
-}
+       { SDDL_ACCOUNT_OPERATORS, WinBuiltinAccountOperatorsSid },
+       { SDDL_ALIAS_PREW2KCOMPACC, WinBuiltinPreWindows2000CompatibleAccessSid },
+       { SDDL_ANONYMOUS, WinAnonymousSid },
+       { SDDL_AUTHENTICATED_USERS, WinAuthenticatedUserSid },
+       { SDDL_BUILTIN_ADMINISTRATORS, WinBuiltinAdministratorsSid },
+       { SDDL_BUILTIN_GUESTS, WinBuiltinGuestsSid },
+       { SDDL_BACKUP_OPERATORS, WinBuiltinBackupOperatorsSid },
+       { SDDL_BUILTIN_USERS, WinBuiltinUsersSid },
+       { SDDL_CERT_SERV_ADMINISTRATORS, WinAccountCertAdminsSid /* FIXME: DOMAIN_GROUP_RID_CERT_ADMINS */ },
+       { SDDL_CREATOR_GROUP, WinCreatorGroupSid },
+       { SDDL_CREATOR_OWNER, WinCreatorOwnerSid },
+       { SDDL_DOMAIN_ADMINISTRATORS, WinAccountDomainAdminsSid /* FIXME: DOMAIN_GROUP_RID_ADMINS */ },
+       { SDDL_DOMAIN_COMPUTERS, WinAccountComputersSid /* FIXME: DOMAIN_GROUP_RID_COMPUTERS */ },
+       { SDDL_DOMAIN_DOMAIN_CONTROLLERS, WinAccountControllersSid /* FIXME: DOMAIN_GROUP_RID_CONTROLLERS */ },
+       { SDDL_DOMAIN_GUESTS, WinAccountDomainGuestsSid /* FIXME: DOMAIN_GROUP_RID_GUESTS */ },
+       { SDDL_DOMAIN_USERS, WinAccountDomainUsersSid /* FIXME: DOMAIN_GROUP_RID_USERS */ },
+       { SDDL_ENTERPRISE_ADMINS, WinAccountEnterpriseAdminsSid /* FIXME: DOMAIN_GROUP_RID_ENTERPRISE_ADMINS */ },
+       { SDDL_ENTERPRISE_DOMAIN_CONTROLLERS, WinEnterpriseControllersSid },
+       { SDDL_EVERYONE, WinWorldSid },
+       { SDDL_GROUP_POLICY_ADMINS, WinAccountPolicyAdminsSid /* FIXME: DOMAIN_GROUP_RID_POLICY_ADMINS */ },
+       { SDDL_INTERACTIVE, WinInteractiveSid },
+       { SDDL_LOCAL_ADMIN, WinAccountAdministratorSid /* FIXME: DOMAIN_USER_RID_ADMIN */ },
+       { SDDL_LOCAL_GUEST, WinAccountGuestSid /* FIXME: DOMAIN_USER_RID_GUEST */ },
+       { SDDL_LOCAL_SERVICE, WinLocalServiceSid },
+       { SDDL_LOCAL_SYSTEM, WinLocalSystemSid },
+       { SDDL_NETWORK, WinNetworkSid },
+       { SDDL_NETWORK_CONFIGURATION_OPS, WinBuiltinNetworkConfigurationOperatorsSid },
+       { SDDL_NETWORK_SERVICE, WinNetworkServiceSid },
+       { SDDL_PRINTER_OPERATORS, WinBuiltinPrintOperatorsSid },
+       { SDDL_PERSONAL_SELF, WinSelfSid },
+       { SDDL_POWER_USERS, WinBuiltinPowerUsersSid },
+       { SDDL_RAS_SERVERS, WinAccountRasAndIasServersSid /* FIXME: DOMAIN_ALIAS_RID_RAS_SERVERS */ },
+       { SDDL_REMOTE_DESKTOP, WinBuiltinRemoteDesktopUsersSid },
+       { SDDL_REPLICATOR, WinBuiltinReplicatorSid },
+       { SDDL_RESTRICTED_CODE, WinRestrictedCodeSid },
+       { SDDL_SCHEMA_ADMINISTRATORS, WinAccountSchemaAdminsSid /* FIXME: DOMAIN_GROUP_RID_SCHEMA_ADMINS */ },
+       { SDDL_SERVER_OPERATORS, WinBuiltinSystemOperatorsSid },
+       { SDDL_SERVICE, WinServiceSid },
+       { NULL, 0 },
+};
 
+/* Exported functions */
 
 /*
  * @implemented
@@ -362,6 +352,19 @@ AllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
     return TRUE;
 }
 
+/*
+ * @implemented
+ *
+ * RETURNS
+ *  Docs says this function does NOT return a value
+ *  even thou it's defined to return a PVOID...
+ */
+PVOID
+WINAPI
+FreeSid(PSID pSid)
+{
+    return RtlFreeSid(pSid);
+}
 
 /*
  * @implemented
@@ -385,1041 +388,1135 @@ CopySid(DWORD nDestinationSidLength,
   return TRUE;
 }
 
-static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
+/*
+ * @unimplemented
+ */
+BOOL
+WINAPI
+CreateWellKnownSid(IN WELL_KNOWN_SID_TYPE WellKnownSidType,
+                   IN PSID DomainSid  OPTIONAL,
+                   OUT PSID pSid,
+                   IN OUT DWORD* cbSid)
 {
-    if (cch == -1)
-        cch = strlenW(string);
-
-    if (plen)
-        *plen += cch;
+    unsigned int i;
+    TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 
-    if (pwptr)
+    if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
     {
-        memcpy(*pwptr, string, sizeof(WCHAR)*cch);
-        *pwptr += cch;
+        SetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
     }
-}
 
-static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
-{
-    DWORD i;
-    WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
-    WCHAR subauthfmt[] = { '-','%','u',0 };
-    WCHAR buf[26];
-    SID *pisid = psid;
+    for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
+        if (WellKnownSids[i].Type == WellKnownSidType) {
+            DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 
-    if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
-    {
-        SetLastError(ERROR_INVALID_SID);
-        return FALSE;
+            if (*cbSid < length)
+            {
+                *cbSid = length;
+                SetLastError(ERROR_INSUFFICIENT_BUFFER);
+                return FALSE;
+            }
+            if (!pSid)
+            {
+                SetLastError(ERROR_INVALID_PARAMETER);
+                return FALSE;
+            }
+            CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
+            *cbSid = length;
+            return TRUE;
+        }
     }
 
-    if (pisid->IdentifierAuthority.Value[0] ||
-     pisid->IdentifierAuthority.Value[1])
+    if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
     {
-        FIXME("not matching MS' bugs\n");
-        SetLastError(ERROR_INVALID_SID);
+        SetLastError(ERROR_INVALID_PARAMETER);
         return FALSE;
     }
 
-    sprintfW( buf, fmt, pisid->Revision,
-        MAKELONG(
-            MAKEWORD( pisid->IdentifierAuthority.Value[5],
-                    pisid->IdentifierAuthority.Value[4] ),
-            MAKEWORD( pisid->IdentifierAuthority.Value[3],
-                    pisid->IdentifierAuthority.Value[2] )
-        ) );
-    DumpString(buf, -1, pwptr, plen);
+    for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
+        if (WellKnownRids[i].Type == WellKnownSidType) {
+            UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
+            DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
+            DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
 
-    for( i=0; i<pisid->SubAuthorityCount; i++ )
-    {
-        sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
-        DumpString(buf, -1, pwptr, plen);
-    }
-    return TRUE;
+            if (*cbSid < output_sid_length)
+            {
+                *cbSid = output_sid_length;
+                SetLastError(ERROR_INSUFFICIENT_BUFFER);
+                return FALSE;
+            }
+            if (!pSid)
+            {
+                SetLastError(ERROR_INVALID_PARAMETER);
+                return FALSE;
+            }
+            CopyMemory(pSid, DomainSid, domain_sid_length);
+            (*GetSidSubAuthorityCount(pSid))++;
+            (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
+            *cbSid = output_sid_length;
+            return TRUE;
+        }
+
+    SetLastError(ERROR_INVALID_PARAMETER);
+    return FALSE;
 }
 
-static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
+/*
+ * @unimplemented
+ */
+BOOL
+WINAPI
+IsWellKnownSid(IN PSID pSid,
+               IN WELL_KNOWN_SID_TYPE WellKnownSidType)
 {
-    size_t i;
+    unsigned int i;
+    TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
+
     for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
     {
-        if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
+        if (WellKnownSids[i].Type == WellKnownSidType)
         {
-            DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
-            return TRUE;
+            if (EqualSid(pSid, (PSID)(&WellKnownSids[i].Sid.Revision)))
+                return TRUE;
         }
     }
 
-    return DumpSidNumeric(psid, pwptr, plen);
+    return FALSE;
 }
 
-static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
+/*
+ * @implemented
+ */
+BOOL
+WINAPI
+IsValidSid(PSID pSid)
 {
-    static const WCHAR fmtW[] = {'0','x','%','x',0};
-    WCHAR buf[15];
-    size_t i;
+    return (BOOL)RtlValidSid(pSid);
+}
 
-    if (mask == 0)
-        return;
+/*
+ * @implemented
+ */
+BOOL
+WINAPI
+EqualSid(PSID pSid1,
+         PSID pSid2)
+{
+    SetLastError(ERROR_SUCCESS);
+    return RtlEqualSid (pSid1, pSid2);
+}
 
-    /* first check if the right have name */
-    for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
-    {
-        if (AceRights[i].wstr == NULL)
-            break;
-        if (mask == AceRights[i].value)
-        {
-            DumpString(AceRights[i].wstr, -1, pwptr, plen);
-            return;
-        }
-    }
-
-    /* then check if it can be built from bit names */
-    for (i = 0; i < 32; i++)
-    {
-        if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
-        {
-            /* can't be built from bit names */
-            sprintfW(buf, fmtW, mask);
-            DumpString(buf, -1, pwptr, plen);
-            return;
-        }
-    }
+/*
+ * @implemented
+ */
+BOOL
+WINAPI
+EqualPrefixSid(PSID pSid1,
+               PSID pSid2)
+{
+    return RtlEqualPrefixSid (pSid1, pSid2);
+}
 
-    /* build from bit names */
-    for (i = 0; i < 32; i++)
-        if (mask & (1 << i))
-            DumpString(AceRightBitNames[i], -1, pwptr, plen);
+/*
+ * @implemented
+ */
+DWORD
+WINAPI
+GetSidLengthRequired(UCHAR nSubAuthorityCount)
+{
+    return (DWORD)RtlLengthRequiredSid(nSubAuthorityCount);
 }
 
-static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
+/*
+ * @implemented
+ */
+BOOL
+WINAPI
+InitializeSid(PSID Sid,
+              PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
+              BYTE nSubAuthorityCount)
 {
-    ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
-    static const WCHAR openbr = '(';
-    static const WCHAR closebr = ')';
-    static const WCHAR semicolon = ';';
+    NTSTATUS Status;
 
-    if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
+    Status = RtlInitializeSid(Sid,
+                              pIdentifierAuthority,
+                              nSubAuthorityCount);
+    if (!NT_SUCCESS(Status))
     {
-        SetLastError(ERROR_INVALID_ACL);
+        SetLastError(RtlNtStatusToDosError(Status));
         return FALSE;
     }
 
-    piace = pace;
-    DumpString(&openbr, 1, pwptr, plen);
-    switch (piace->Header.AceType)
-    {
-        case ACCESS_ALLOWED_ACE_TYPE:
-            DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
-            break;
-        case ACCESS_DENIED_ACE_TYPE:
-            DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
-            break;
-        case SYSTEM_AUDIT_ACE_TYPE:
-            DumpString(SDDL_AUDIT, -1, pwptr, plen);
-            break;
-        case SYSTEM_ALARM_ACE_TYPE:
-            DumpString(SDDL_ALARM, -1, pwptr, plen);
-            break;
-    }
-    DumpString(&semicolon, 1, pwptr, plen);
-
-    if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
-        DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
-    if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
-        DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
-    if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
-        DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
-    if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
-        DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
-    if (piace->Header.AceFlags & INHERITED_ACE)
-        DumpString(SDDL_INHERITED, -1, pwptr, plen);
-    if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
-        DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
-    if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
-        DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
-    DumpString(&semicolon, 1, pwptr, plen);
-    DumpRights(piace->Mask, pwptr, plen);
-    DumpString(&semicolon, 1, pwptr, plen);
-    /* objects not supported */
-    DumpString(&semicolon, 1, pwptr, plen);
-    /* objects not supported */
-    DumpString(&semicolon, 1, pwptr, plen);
-    if (!DumpSid((PSID)&piace->SidStart, pwptr, plen))
-        return FALSE;
-    DumpString(&closebr, 1, pwptr, plen);
     return TRUE;
 }
 
-static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
+/*
+ * @implemented
+ */
+PSID_IDENTIFIER_AUTHORITY
+WINAPI
+GetSidIdentifierAuthority(PSID pSid)
 {
-    WORD count;
-    int i;
+    return RtlIdentifierAuthoritySid(pSid);
+}
 
-    if (protected)
-        DumpString(SDDL_PROTECTED, -1, pwptr, plen);
-    if (autoInheritReq)
-        DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
-    if (autoInherited)
-        DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
+/*
+ * @implemented
+ */
+PDWORD
+WINAPI
+GetSidSubAuthority(PSID pSid,
+                   DWORD nSubAuthority)
+{
+    SetLastError(ERROR_SUCCESS);
+    return (PDWORD)RtlSubAuthoritySid(pSid, nSubAuthority);
+}
 
-    if (pacl == NULL)
-        return TRUE;
+/*
+ * @implemented
+ */
+PUCHAR
+WINAPI
+GetSidSubAuthorityCount(PSID pSid)
+{
+    SetLastError(ERROR_SUCCESS);
+    return RtlSubAuthorityCountSid(pSid);
+}
 
-    if (!IsValidAcl(pacl))
-        return FALSE;
+/*
+ * @implemented
+ */
+DWORD
+WINAPI
+GetLengthSid(PSID pSid)
+{
+    return (DWORD)RtlLengthSid(pSid);
+}
 
-    count = pacl->AceCount;
-    for (i = 0; i < count; i++)
+/******************************************************************************
+ * ParseAclStringFlags
+ */
+static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
+{
+    DWORD flags = 0;
+    LPCWSTR szAcl = *StringAcl;
+
+    while (*szAcl != '(')
     {
-        LPVOID ace;
-        if (!GetAce(pacl, i, &ace))
-            return FALSE;
-        if (!DumpAce(ace, pwptr, plen))
-            return FALSE;
+        if (*szAcl == 'P')
+        {
+            flags |= SE_DACL_PROTECTED;
+        }
+        else if (*szAcl == 'A')
+        {
+            szAcl++;
+            if (*szAcl == 'R')
+                flags |= SE_DACL_AUTO_INHERIT_REQ;
+            else if (*szAcl == 'I')
+                flags |= SE_DACL_AUTO_INHERITED;
+        }
+        szAcl++;
     }
 
-    return TRUE;
+    *StringAcl = szAcl;
+    return flags;
 }
 
-static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+/******************************************************************************
+ * ParseAceStringType
+ */
+static const ACEFLAG AceType[] =
 {
-    static const WCHAR prefix[] = {'O',':',0};
-    BOOL bDefaulted;
-    PSID psid;
-
-    if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
-        return FALSE;
-
-    if (psid == NULL)
-        return TRUE;
-
-    DumpString(prefix, -1, pwptr, plen);
-    if (!DumpSid(psid, pwptr, plen))
-        return FALSE;
-    return TRUE;
-}
+    { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
+    { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
+    { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
+    { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
+    /*
+    { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
+    { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
+    { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
+    { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
+    */
+    { NULL, 0 },
+};
 
-static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+static BYTE ParseAceStringType(LPCWSTR* StringAcl)
 {
-    static const WCHAR prefix[] = {'G',':',0};
-    BOOL bDefaulted;
-    PSID psid;
+    UINT len = 0;
+    LPCWSTR szAcl = *StringAcl;
+    const ACEFLAG *lpaf = AceType;
 
-    if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
-        return FALSE;
+    while (lpaf->wstr &&
+        (len = strlenW(lpaf->wstr)) &&
+        strncmpW(lpaf->wstr, szAcl, len))
+        lpaf++;
 
-    if (psid == NULL)
-        return TRUE;
+    if (!lpaf->wstr)
+        return 0;
 
-    DumpString(prefix, -1, pwptr, plen);
-    if (!DumpSid(psid, pwptr, plen))
-        return FALSE;
-    return TRUE;
+    *StringAcl += len;
+    return lpaf->value;
 }
 
-static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
-{
-    static const WCHAR dacl[] = {'D',':',0};
-    SECURITY_DESCRIPTOR_CONTROL control;
-    BOOL present, defaulted;
-    DWORD revision;
-    PACL pacl;
-
-    if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
-        return FALSE;
-
-    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
-        return FALSE;
-
-    if (!present)
-        return TRUE;
-
-    DumpString(dacl, 2, pwptr, plen);
-    if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
-        return FALSE;
-    return TRUE;
-}
-
-static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
-{
-    static const WCHAR sacl[] = {'S',':',0};
-    SECURITY_DESCRIPTOR_CONTROL control;
-    BOOL present, defaulted;
-    DWORD revision;
-    PACL pacl;
-
-    if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
-        return FALSE;
-
-    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
-        return FALSE;
-
-    if (!present)
-        return TRUE;
-
-    DumpString(sacl, 2, pwptr, plen);
-    if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
-        return FALSE;
-    return TRUE;
-}
 
 /******************************************************************************
- * ConvertSecurityDescriptorToStringSecurityDescriptorW [ADVAPI32.@]
- * @implemented
+ * ParseAceStringFlags
  */
-BOOL WINAPI
-ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor,
-                                                     DWORD SDRevision,
-                                                     SECURITY_INFORMATION SecurityInformation,
-                                                     LPWSTR *OutputString,
-                                                     PULONG OutputLen)
+static const ACEFLAG AceFlags[] =
 {
-    ULONG len;
-    WCHAR *wptr, *wstr;
+    { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
+    { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
+    { SDDL_INHERITED,         INHERITED_ACE },
+    { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
+    { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
+    { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
+    { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
+    { NULL, 0 },
+};
 
-    if (SDRevision != SDDL_REVISION_1)
+static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
+{
+    UINT len = 0;
+    BYTE flags = 0;
+    LPCWSTR szAcl = *StringAcl;
+
+    while (*szAcl != ';')
     {
-        ERR("Program requested unknown SDDL revision %d\n", SDRevision);
-        SetLastError(ERROR_UNKNOWN_REVISION);
-        return FALSE;
-    }
+        const ACEFLAG *lpaf = AceFlags;
 
-    len = 0;
-    if (SecurityInformation & OWNER_SECURITY_INFORMATION)
-        if (!DumpOwner(SecurityDescriptor, NULL, &len))
-            return FALSE;
-    if (SecurityInformation & GROUP_SECURITY_INFORMATION)
-        if (!DumpGroup(SecurityDescriptor, NULL, &len))
-            return FALSE;
-    if (SecurityInformation & DACL_SECURITY_INFORMATION)
-        if (!DumpDacl(SecurityDescriptor, NULL, &len))
-            return FALSE;
-    if (SecurityInformation & SACL_SECURITY_INFORMATION)
-        if (!DumpSacl(SecurityDescriptor, NULL, &len))
-            return FALSE;
+        while (lpaf->wstr &&
+               (len = strlenW(lpaf->wstr)) &&
+               strncmpW(lpaf->wstr, szAcl, len))
+            lpaf++;
 
-    wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
-    if (wstr == NULL)
-        return FALSE;
-        
-    if (SecurityInformation & OWNER_SECURITY_INFORMATION)
-        if (!DumpOwner(SecurityDescriptor, &wptr, NULL))
-            return FALSE;
-    if (SecurityInformation & GROUP_SECURITY_INFORMATION)
-        if (!DumpGroup(SecurityDescriptor, &wptr, NULL))
-            return FALSE;
-    if (SecurityInformation & DACL_SECURITY_INFORMATION)
-        if (!DumpDacl(SecurityDescriptor, &wptr, NULL))
-            return FALSE;
-    if (SecurityInformation & SACL_SECURITY_INFORMATION)
-        if (!DumpSacl(SecurityDescriptor, &wptr, NULL))
-            return FALSE;
-    *wptr = 0;
+        if (!lpaf->wstr)
+            return 0;
 
-    TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
-    *OutputString = wstr;
-    if (OutputLen)
-        *OutputLen = strlenW(*OutputString)+1;
-    return TRUE;
+        flags |= lpaf->value;
+        szAcl += len;
+    }
+
+    *StringAcl = szAcl;
+    return flags;
 }
 
 
 /******************************************************************************
- * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
- * @implemented
+ * ParseAceStringRights
  */
-BOOL WINAPI
-ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor,
-                                                     DWORD SDRevision,
-                                                     SECURITY_INFORMATION Information,
-                                                     LPSTR *OutputString,
-                                                     PULONG OutputLen)
+static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
 {
-    LPWSTR wstr;
-    ULONG len;
+    UINT len = 0;
+    DWORD rights = 0;
+    LPCWSTR szAcl = *StringAcl;
 
-    if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
+    if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
     {
-        int lenA;
+        LPCWSTR p = szAcl;
 
-        lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
-        *OutputString = HeapAlloc(GetProcessHeap(), 0, lenA);
-        if (*OutputString == NULL)
+        while (*p && *p != ';')
+            p++;
+
+        if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
         {
-            LocalFree(wstr);
-            *OutputLen = 0;
-            return FALSE;
+            rights = strtoulW(szAcl, NULL, 16);
+            szAcl = p;
         }
-        WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
-        LocalFree(wstr);
-
-        if (OutputLen != NULL)
-            *OutputLen = lenA;
-        return TRUE;
+        else
+            WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
     }
     else
     {
-        *OutputString = NULL;
-        if (OutputLen)
-            *OutputLen = 0;
-        return FALSE;
-    }
-}
-
-
-/******************************************************************************
- * ComputeStringSidSize
- */
-static DWORD ComputeStringSidSize(LPCWSTR StringSid)
-{
-    if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
-    {
-        int ctok = 0;
-        while (*StringSid)
+        while (*szAcl != ';')
         {
-            if (*StringSid == '-')
-                ctok++;
-            StringSid++;
-        }
+            const ACEFLAG *lpaf = AceRights;
 
-        if (ctok >= 3)
-            return GetSidLengthRequired(ctok - 2);
-    }
-    else /* String constant format  - Only available in winxp and above */
-    {
-        unsigned int i;
+            while (lpaf->wstr &&
+                   (len = strlenW(lpaf->wstr)) &&
+                   strncmpW(lpaf->wstr, szAcl, len))
+            {
+                lpaf++;
+            }
 
-        for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
-            if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
-                return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
+            if (!lpaf->wstr)
+                return 0;
+
+            rights |= lpaf->value;
+            szAcl += len;
+        }
     }
 
-    return GetSidLengthRequired(0);
+    *StringAcl = szAcl;
+    return rights;
 }
 
+
 /******************************************************************************
- * ParseStringSidToSid
+ * ParseStringAclToAcl
+ * 
+ * dacl_flags(string_ace1)(string_ace2)... (string_acen) 
  */
-static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
+static BOOL
+ParseStringAclToAcl(LPCWSTR StringAcl,
+                    LPDWORD lpdwFlags, 
+                    PACL pAcl,
+                    LPDWORD cBytes)
 {
-    BOOL bret = FALSE;
-    SID* pisid=pSid;
+    DWORD val;
+    DWORD sidlen;
+    DWORD length = sizeof(ACL);
+    DWORD acesize = 0;
+    DWORD acecount = 0;
+    PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
 
-    TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
-    if (!StringSid)
-    {
-        SetLastError(ERROR_INVALID_PARAMETER);
-        TRACE("StringSid is NULL, returning FALSE\n");
+    TRACE("%s\n", debugstr_w(StringAcl));
+
+    if (!StringAcl)
         return FALSE;
-    }
 
-    while (*StringSid == ' ')
-        StringSid++;
+    if (pAcl) /* pAce is only useful if we're setting values */
+        pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
 
-    *cBytes = ComputeStringSidSize(StringSid);
-    if (!pisid) /* Simply compute the size */
-    {
-        TRACE("only size requested, returning TRUE\n");
-        return TRUE;
-    }
+    /* Parse ACL flags */
+    *lpdwFlags = ParseAclStringFlags(&StringAcl);
 
-    if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
+    /* Parse ACE */
+    while (*StringAcl == '(')
     {
-        DWORD i = 0, identAuth;
-        DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
-
-        StringSid += 2; /* Advance to Revision */
-        pisid->Revision = atoiW(StringSid);
+        StringAcl++;
 
-        if (pisid->Revision != SDDL_REVISION)
-        {
-            TRACE("Revision %d is unknown\n", pisid->Revision);
-            goto lend; /* ERROR_INVALID_SID */
-        }
-        if (csubauth == 0)
-        {
-            TRACE("SubAuthorityCount is 0\n");
-            goto lend; /* ERROR_INVALID_SID */
-        }
-
-        pisid->SubAuthorityCount = csubauth;
+        /* Parse ACE type */
+        val = ParseAceStringType(&StringAcl);
+        if (pAce)
+            pAce->Header.AceType = (BYTE) val;
+        if (*StringAcl != ';')
+            goto lerr;
+        StringAcl++;
 
-        /* Advance to identifier authority */
-        while (*StringSid && *StringSid != '-')
-            StringSid++;
-        if (*StringSid == '-')
-            StringSid++;
+        /* Parse ACE flags */
+        val = ParseAceStringFlags(&StringAcl);
+        if (pAce)
+            pAce->Header.AceFlags = (BYTE) val;
+        if (*StringAcl != ';')
+            goto lerr;
+        StringAcl++;
 
-        /* MS' implementation can't handle values greater than 2^32 - 1, so
-         * we don't either; assume most significant bytes are always 0
-         */
-        pisid->IdentifierAuthority.Value[0] = 0;
-        pisid->IdentifierAuthority.Value[1] = 0;
-        identAuth = atoiW(StringSid);
-        pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
-        pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
-        pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
-        pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
+        /* Parse ACE rights */
+        val = ParseAceStringRights(&StringAcl);
+        if (pAce)
+            pAce->Mask = val;
+        if (*StringAcl != ';')
+            goto lerr;
+        StringAcl++;
 
-        /* Advance to first sub authority */
-        while (*StringSid && *StringSid != '-')
-            StringSid++;
-        if (*StringSid == '-')
-            StringSid++;
+        /* Parse ACE object guid */
+        if (*StringAcl != ';')
+        {
+            FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
+            goto lerr;
+        }
+        StringAcl++;
 
-        while (*StringSid)
+        /* Parse ACE inherit object guid */
+        if (*StringAcl != ';')
         {
-            pisid->SubAuthority[i++] = atoiW(StringSid);
+            FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
+            goto lerr;
+        }
+        StringAcl++;
 
-            while (*StringSid && *StringSid != '-')
-                StringSid++;
-            if (*StringSid == '-')
-                StringSid++;
+        /* Parse ACE account sid */
+        if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
+        {
+            while (*StringAcl && *StringAcl != ')')
+                StringAcl++;
         }
 
-        if (i != pisid->SubAuthorityCount)
-            goto lend; /* ERROR_INVALID_SID */
+        if (*StringAcl != ')')
+            goto lerr;
+        StringAcl++;
 
-        bret = TRUE;
+        acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
+        length += acesize;
+        if (pAce)
+        {
+            pAce->Header.AceSize = acesize;
+            pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
+        }
+        acecount++;
     }
-    else /* String constant format  - Only available in winxp and above */
-    {
-        unsigned int i;
-        pisid->Revision = SDDL_REVISION;
 
-        for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
-            if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
-            {
-                DWORD j;
-                pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
-                pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
-                for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
-                    pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
-                bret = TRUE;
-            }
+    *cBytes = length;
 
-        if (!bret)
-            FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
+    if (length > 0xffff)
+    {
+        ERR("ACL too large\n");
+        goto lerr;
     }
 
-lend:
-    if (!bret)
-        SetLastError(ERROR_INVALID_SID);
+    if (pAcl)
+    {
+        pAcl->AclRevision = ACL_REVISION;
+        pAcl->Sbz1 = 0;
+        pAcl->AclSize = length;
+        pAcl->AceCount = acecount++;
+        pAcl->Sbz2 = 0;
+    }
+    return TRUE;
 
-    TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
-    return bret;
+lerr:
+    SetLastError(ERROR_INVALID_ACL);
+    WARN("Invalid ACE string format\n");
+    return FALSE;
 }
 
+
 /******************************************************************************
- * ParseAclStringFlags
+ * ParseStringSecurityDescriptorToSecurityDescriptor
  */
-static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
+static BOOL
+ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescriptor,
+                                                  SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
+                                                  LPDWORD cBytes)
 {
-    DWORD flags = 0;
-    LPCWSTR szAcl = *StringAcl;
+    BOOL bret = FALSE;
+    WCHAR toktype;
+    WCHAR tok[MAX_PATH];
+    LPCWSTR lptoken;
+    LPBYTE lpNext = NULL;
+    DWORD len;
 
-    while (*szAcl != '(')
+    *cBytes = sizeof(SECURITY_DESCRIPTOR);
+
+    if (SecurityDescriptor)
+        lpNext = (LPBYTE)(SecurityDescriptor + 1);
+
+    while (*StringSecurityDescriptor)
     {
-        if (*szAcl == 'P')
-        {
-            flags |= SE_DACL_PROTECTED;
-        }
-        else if (*szAcl == 'A')
+        toktype = *StringSecurityDescriptor;
+
+        /* Expect char identifier followed by ':' */
+        StringSecurityDescriptor++;
+        if (*StringSecurityDescriptor != ':')
         {
-            szAcl++;
-            if (*szAcl == 'R')
-                flags |= SE_DACL_AUTO_INHERIT_REQ;
-            else if (*szAcl == 'I')
-                flags |= SE_DACL_AUTO_INHERITED;
+            SetLastError(ERROR_INVALID_PARAMETER);
+            goto lend;
         }
-        szAcl++;
-    }
+        StringSecurityDescriptor++;
 
-    *StringAcl = szAcl;
-    return flags;
-}
+        /* Extract token */
+        lptoken = StringSecurityDescriptor;
+        while (*lptoken && *lptoken != ':')
+            lptoken++;
 
-/******************************************************************************
- * ParseAceStringType
- */
-static const ACEFLAG AceType[] =
-{
-    { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
-    { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
-    { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
-    { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
-    /*
-    { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
-    { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
-    { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
-    { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
-    */
-    { NULL, 0 },
-};
+        if (*lptoken)
+            lptoken--;
 
-static BYTE ParseAceStringType(LPCWSTR* StringAcl)
-{
-    UINT len = 0;
-    LPCWSTR szAcl = *StringAcl;
-    const ACEFLAG *lpaf = AceType;
+        len = lptoken - StringSecurityDescriptor;
+        memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
+        tok[len] = 0;
 
-    while (lpaf->wstr &&
-        (len = strlenW(lpaf->wstr)) &&
-        strncmpW(lpaf->wstr, szAcl, len))
-        lpaf++;
+        switch (toktype)
+        {
+            case 'O':
+            {
+                DWORD bytes;
 
-    if (!lpaf->wstr)
-        return 0;
+                if (!ParseStringSidToSid(tok, lpNext, &bytes))
+                    goto lend;
 
-    *StringAcl += len;
-    return lpaf->value;
-}
+                if (SecurityDescriptor)
+                {
+                    SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
+                    lpNext += bytes; /* Advance to next token */
+                }
 
+                *cBytes += bytes;
 
-/******************************************************************************
- * ParseAceStringFlags
- */
-static const ACEFLAG AceFlags[] =
-{
-    { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
-    { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
-    { SDDL_INHERITED,         INHERITED_ACE },
-    { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
-    { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
-    { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
-    { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
-    { NULL, 0 },
-};
+                break;
+            }
 
-static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
-{
-    UINT len = 0;
-    BYTE flags = 0;
-    LPCWSTR szAcl = *StringAcl;
+            case 'G':
+            {
+                DWORD bytes;
 
-    while (*szAcl != ';')
-    {
-        const ACEFLAG *lpaf = AceFlags;
+                if (!ParseStringSidToSid(tok, lpNext, &bytes))
+                    goto lend;
 
-        while (lpaf->wstr &&
-               (len = strlenW(lpaf->wstr)) &&
-               strncmpW(lpaf->wstr, szAcl, len))
-            lpaf++;
-
-        if (!lpaf->wstr)
-            return 0;
+                if (SecurityDescriptor)
+                {
+                    SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
+                    lpNext += bytes; /* Advance to next token */
+                }
 
-        flags |= lpaf->value;
-        szAcl += len;
-    }
+                *cBytes += bytes;
 
-    *StringAcl = szAcl;
-    return flags;
-}
+                break;
+            }
 
+            case 'D':
+            {
+                DWORD flags;
+                DWORD bytes;
 
-/******************************************************************************
- * ParseAceStringRights
- */
-static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
-{
-    UINT len = 0;
-    DWORD rights = 0;
-    LPCWSTR szAcl = *StringAcl;
+                if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
+                    goto lend;
 
-    if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
-    {
-        LPCWSTR p = szAcl;
+                if (SecurityDescriptor)
+                {
+                    SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
+                    SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
+                    lpNext += bytes; /* Advance to next token */
+                }
 
-        while (*p && *p != ';')
-            p++;
+                *cBytes += bytes;
 
-        if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
-        {
-            rights = strtoulW(szAcl, NULL, 16);
-            szAcl = p;
-        }
-        else
-            WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
-    }
-    else
-    {
-        while (*szAcl != ';')
-        {
-            const ACEFLAG *lpaf = AceRights;
+                break;
+            }
 
-            while (lpaf->wstr &&
-                   (len = strlenW(lpaf->wstr)) &&
-                   strncmpW(lpaf->wstr, szAcl, len))
+            case 'S':
             {
-                lpaf++;
-            }
+                DWORD flags;
+                DWORD bytes;
 
-            if (!lpaf->wstr)
-                return 0;
+                if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
+                    goto lend;
 
-            rights |= lpaf->value;
-            szAcl += len;
+                if (SecurityDescriptor)
+                {
+                    SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
+                    SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
+                    lpNext += bytes; /* Advance to next token */
+                }
+
+                *cBytes += bytes;
+
+                break;
+            }
+
+            default:
+                FIXME("Unknown token\n");
+                SetLastError(ERROR_INVALID_PARAMETER);
+                goto lend;
         }
+
+        StringSecurityDescriptor = lptoken;
     }
 
-    *StringAcl = szAcl;
-    return rights;
-}
+    bret = TRUE;
 
+lend:
+    return bret;
+}
 
+/* Winehq cvs 20050916 */
 /******************************************************************************
- * ParseStringAclToAcl
- * 
- * dacl_flags(string_ace1)(string_ace2)... (string_acen) 
+ * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
+ * @implemented
  */
-static BOOL
-ParseStringAclToAcl(LPCWSTR StringAcl,
-                    LPDWORD lpdwFlags, 
-                    PACL pAcl,
-                    LPDWORD cBytes)
+BOOL
+WINAPI
+ConvertStringSecurityDescriptorToSecurityDescriptorA(LPCSTR StringSecurityDescriptor,
+                                                     DWORD StringSDRevision,
+                                                     PSECURITY_DESCRIPTOR* SecurityDescriptor,
+                                                     PULONG SecurityDescriptorSize)
 {
-    DWORD val;
-    DWORD sidlen;
-    DWORD length = sizeof(ACL);
-    DWORD acesize = 0;
-    DWORD acecount = 0;
-    PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
+    UINT len;
+    BOOL ret = FALSE;
+    LPWSTR StringSecurityDescriptorW;
 
-    TRACE("%s\n", debugstr_w(StringAcl));
+    len = MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, NULL, 0);
+    StringSecurityDescriptorW = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
 
-    if (!StringAcl)
-        return FALSE;
+    if (StringSecurityDescriptorW)
+    {
+        MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, StringSecurityDescriptorW, len);
 
-    if (pAcl) /* pAce is only useful if we're setting values */
-        pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
+        ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
+                                                                   StringSDRevision, SecurityDescriptor,
+                                                                   SecurityDescriptorSize);
+        HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
+    }
 
-    /* Parse ACL flags */
-    *lpdwFlags = ParseAclStringFlags(&StringAcl);
+    return ret;
+}
 
-    /* Parse ACE */
-    while (*StringAcl == '(')
+/******************************************************************************
+ * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
+ * @implemented
+ */
+BOOL WINAPI
+ConvertStringSecurityDescriptorToSecurityDescriptorW(LPCWSTR StringSecurityDescriptor,
+                                                     DWORD StringSDRevision,
+                                                     PSECURITY_DESCRIPTOR* SecurityDescriptor,
+                                                     PULONG SecurityDescriptorSize)
+{
+    DWORD cBytes;
+    SECURITY_DESCRIPTOR* psd;
+    BOOL bret = FALSE;
+
+    TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
+
+    if (GetVersion() & 0x80000000)
     {
-        StringAcl++;
+        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
+        goto lend;
+    }
+    else if (!StringSecurityDescriptor || !SecurityDescriptor)
+    {
+        SetLastError(ERROR_INVALID_PARAMETER);
+        goto lend;
+    }
+    else if (StringSDRevision != SID_REVISION)
+    {
+        SetLastError(ERROR_UNKNOWN_REVISION);
+        goto lend;
+    }
 
-        /* Parse ACE type */
-        val = ParseAceStringType(&StringAcl);
-        if (pAce)
-            pAce->Header.AceType = (BYTE) val;
-        if (*StringAcl != ';')
-            goto lerr;
-        StringAcl++;
+    /* Compute security descriptor length */
+    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
+        NULL, &cBytes))
+        goto lend;
 
-        /* Parse ACE flags */
-        val = ParseAceStringFlags(&StringAcl);
-        if (pAce)
-            pAce->Header.AceFlags = (BYTE) val;
-        if (*StringAcl != ';')
-            goto lerr;
-        StringAcl++;
+    psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
+    if (!psd) goto lend;
 
-        /* Parse ACE rights */
-        val = ParseAceStringRights(&StringAcl);
-        if (pAce)
-            pAce->Mask = val;
-        if (*StringAcl != ';')
-            goto lerr;
-        StringAcl++;
+    psd->Revision = SID_REVISION;
+    psd->Control |= SE_SELF_RELATIVE;
 
-        /* Parse ACE object guid */
-        if (*StringAcl != ';')
-        {
-            FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
-            goto lerr;
-        }
-        StringAcl++;
+    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
+             (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
+    {
+        LocalFree(psd);
+        goto lend;
+    }
 
-        /* Parse ACE inherit object guid */
-        if (*StringAcl != ';')
-        {
-            FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
-            goto lerr;
-        }
-        StringAcl++;
+    if (SecurityDescriptorSize)
+        *SecurityDescriptorSize = cBytes;
 
-        /* Parse ACE account sid */
-        if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
-        {
-            while (*StringAcl && *StringAcl != ')')
-                StringAcl++;
-        }
+    bret = TRUE;
 
-        if (*StringAcl != ')')
-            goto lerr;
-        StringAcl++;
+lend:
+    TRACE(" ret=%d\n", bret);
+    return bret;
+}
 
-        acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
-        length += acesize;
-        if (pAce)
-        {
-            pAce->Header.AceSize = acesize;
-            pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
-        }
-        acecount++;
+static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
+{
+    if (cch == -1)
+        cch = strlenW(string);
+
+    if (plen)
+        *plen += cch;
+
+    if (pwptr)
+    {
+        memcpy(*pwptr, string, sizeof(WCHAR)*cch);
+        *pwptr += cch;
     }
+}
 
-    *cBytes = length;
+static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
+{
+    DWORD i;
+    WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
+    WCHAR subauthfmt[] = { '-','%','u',0 };
+    WCHAR buf[26];
+    SID *pisid = psid;
 
-    if (length > 0xffff)
+    if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
     {
-        ERR("ACL too large\n");
-        goto lerr;
+        SetLastError(ERROR_INVALID_SID);
+        return FALSE;
     }
 
-    if (pAcl)
+    if (pisid->IdentifierAuthority.Value[0] ||
+     pisid->IdentifierAuthority.Value[1])
     {
-        pAcl->AclRevision = ACL_REVISION;
-        pAcl->Sbz1 = 0;
-        pAcl->AclSize = length;
-        pAcl->AceCount = acecount++;
-        pAcl->Sbz2 = 0;
+        FIXME("not matching MS' bugs\n");
+        SetLastError(ERROR_INVALID_SID);
+        return FALSE;
+    }
+
+    sprintfW( buf, fmt, pisid->Revision,
+        MAKELONG(
+            MAKEWORD( pisid->IdentifierAuthority.Value[5],
+                    pisid->IdentifierAuthority.Value[4] ),
+            MAKEWORD( pisid->IdentifierAuthority.Value[3],
+                    pisid->IdentifierAuthority.Value[2] )
+        ) );
+    DumpString(buf, -1, pwptr, plen);
+
+    for( i=0; i<pisid->SubAuthorityCount; i++ )
+    {
+        sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
+        DumpString(buf, -1, pwptr, plen);
     }
     return TRUE;
+}
 
-lerr:
-    SetLastError(ERROR_INVALID_ACL);
-    WARN("Invalid ACE string format\n");
-    return FALSE;
+static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
+{
+    size_t i;
+    for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
+    {
+        if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
+        {
+            DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
+            return TRUE;
+        }
+    }
+
+    return DumpSidNumeric(psid, pwptr, plen);
 }
 
+static const LPCWSTR AceRightBitNames[32] = {
+        SDDL_CREATE_CHILD,        /*  0 */
+        SDDL_DELETE_CHILD,
+        SDDL_LIST_CHILDREN,
+        SDDL_SELF_WRITE,
+        SDDL_READ_PROPERTY,       /*  4 */
+        SDDL_WRITE_PROPERTY,
+        SDDL_DELETE_TREE,
+        SDDL_LIST_OBJECT,
+        SDDL_CONTROL_ACCESS,      /*  8 */
+        NULL,
+        NULL,
+        NULL,
+        NULL,                     /* 12 */
+        NULL,
+        NULL,
+        NULL,
+        SDDL_STANDARD_DELETE,     /* 16 */
+        SDDL_READ_CONTROL,
+        SDDL_WRITE_DAC,
+        SDDL_WRITE_OWNER,
+        NULL,                     /* 20 */
+        NULL,
+        NULL,
+        NULL,
+        NULL,                     /* 24 */
+        NULL,
+        NULL,
+        NULL,
+        SDDL_GENERIC_ALL,         /* 28 */
+        SDDL_GENERIC_EXECUTE,
+        SDDL_GENERIC_WRITE,
+        SDDL_GENERIC_READ
+};
 
-/******************************************************************************
- * ParseStringSecurityDescriptorToSecurityDescriptor
- */
-static BOOL
-ParseStringSecurityDescriptorToSecurityDescriptor(LPCWSTR StringSecurityDescriptor,
-                                                  SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
-                                                  LPDWORD cBytes)
+static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
 {
-    BOOL bret = FALSE;
-    WCHAR toktype;
-    WCHAR tok[MAX_PATH];
-    LPCWSTR lptoken;
-    LPBYTE lpNext = NULL;
-    DWORD len;
-
-    *cBytes = sizeof(SECURITY_DESCRIPTOR);
+    static const WCHAR fmtW[] = {'0','x','%','x',0};
+    WCHAR buf[15];
+    size_t i;
 
-    if (SecurityDescriptor)
-        lpNext = (LPBYTE)(SecurityDescriptor + 1);
+    if (mask == 0)
+        return;
 
-    while (*StringSecurityDescriptor)
+    /* first check if the right have name */
+    for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
     {
-        toktype = *StringSecurityDescriptor;
+        if (AceRights[i].wstr == NULL)
+            break;
+        if (mask == AceRights[i].value)
+        {
+            DumpString(AceRights[i].wstr, -1, pwptr, plen);
+            return;
+        }
+    }
 
-        /* Expect char identifier followed by ':' */
-        StringSecurityDescriptor++;
-        if (*StringSecurityDescriptor != ':')
+    /* then check if it can be built from bit names */
+    for (i = 0; i < 32; i++)
+    {
+        if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
         {
-            SetLastError(ERROR_INVALID_PARAMETER);
-            goto lend;
+            /* can't be built from bit names */
+            sprintfW(buf, fmtW, mask);
+            DumpString(buf, -1, pwptr, plen);
+            return;
         }
-        StringSecurityDescriptor++;
+    }
 
-        /* Extract token */
-        lptoken = StringSecurityDescriptor;
-        while (*lptoken && *lptoken != ':')
-            lptoken++;
+    /* build from bit names */
+    for (i = 0; i < 32; i++)
+        if (mask & (1 << i))
+            DumpString(AceRightBitNames[i], -1, pwptr, plen);
+}
 
-        if (*lptoken)
-            lptoken--;
+static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
+{
+    ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
+    static const WCHAR openbr = '(';
+    static const WCHAR closebr = ')';
+    static const WCHAR semicolon = ';';
 
-        len = lptoken - StringSecurityDescriptor;
-        memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
-        tok[len] = 0;
+    if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
+    {
+        SetLastError(ERROR_INVALID_ACL);
+        return FALSE;
+    }
+
+    piace = pace;
+    DumpString(&openbr, 1, pwptr, plen);
+    switch (piace->Header.AceType)
+    {
+        case ACCESS_ALLOWED_ACE_TYPE:
+            DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
+            break;
+        case ACCESS_DENIED_ACE_TYPE:
+            DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
+            break;
+        case SYSTEM_AUDIT_ACE_TYPE:
+            DumpString(SDDL_AUDIT, -1, pwptr, plen);
+            break;
+        case SYSTEM_ALARM_ACE_TYPE:
+            DumpString(SDDL_ALARM, -1, pwptr, plen);
+            break;
+    }
+    DumpString(&semicolon, 1, pwptr, plen);
+
+    if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
+        DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
+    if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
+        DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
+    if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
+        DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
+    if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
+        DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
+    if (piace->Header.AceFlags & INHERITED_ACE)
+        DumpString(SDDL_INHERITED, -1, pwptr, plen);
+    if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
+        DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
+    if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
+        DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
+    DumpString(&semicolon, 1, pwptr, plen);
+    DumpRights(piace->Mask, pwptr, plen);
+    DumpString(&semicolon, 1, pwptr, plen);
+    /* objects not supported */
+    DumpString(&semicolon, 1, pwptr, plen);
+    /* objects not supported */
+    DumpString(&semicolon, 1, pwptr, plen);
+    if (!DumpSid((PSID)&piace->SidStart, pwptr, plen))
+        return FALSE;
+    DumpString(&closebr, 1, pwptr, plen);
+    return TRUE;
+}
 
-        switch (toktype)
-        {
-            case 'O':
-            {
-                DWORD bytes;
+static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
+{
+    WORD count;
+    int i;
 
-                if (!ParseStringSidToSid(tok, lpNext, &bytes))
-                    goto lend;
+    if (protected)
+        DumpString(SDDL_PROTECTED, -1, pwptr, plen);
+    if (autoInheritReq)
+        DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
+    if (autoInherited)
+        DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
 
-                if (SecurityDescriptor)
-                {
-                    SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
-                    lpNext += bytes; /* Advance to next token */
-                }
+    if (pacl == NULL)
+        return TRUE;
 
-                *cBytes += bytes;
+    if (!IsValidAcl(pacl))
+        return FALSE;
 
-                break;
-            }
+    count = pacl->AceCount;
+    for (i = 0; i < count; i++)
+    {
+        LPVOID ace;
+        if (!GetAce(pacl, i, &ace))
+            return FALSE;
+        if (!DumpAce(ace, pwptr, plen))
+            return FALSE;
+    }
 
-            case 'G':
-            {
-                DWORD bytes;
+    return TRUE;
+}
 
-                if (!ParseStringSidToSid(tok, lpNext, &bytes))
-                    goto lend;
+static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+{
+    static const WCHAR prefix[] = {'O',':',0};
+    BOOL bDefaulted;
+    PSID psid;
 
-                if (SecurityDescriptor)
-                {
-                    SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
-                    lpNext += bytes; /* Advance to next token */
-                }
+    if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
+        return FALSE;
 
-                *cBytes += bytes;
+    if (psid == NULL)
+        return TRUE;
 
-                break;
-            }
+    DumpString(prefix, -1, pwptr, plen);
+    if (!DumpSid(psid, pwptr, plen))
+        return FALSE;
+    return TRUE;
+}
 
-            case 'D':
-            {
-                DWORD flags;
-                DWORD bytes;
+static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+{
+    static const WCHAR prefix[] = {'G',':',0};
+    BOOL bDefaulted;
+    PSID psid;
 
-                if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
-                    goto lend;
+    if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
+        return FALSE;
 
-                if (SecurityDescriptor)
-                {
-                    SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
-                    SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
-                    lpNext += bytes; /* Advance to next token */
-                }
+    if (psid == NULL)
+        return TRUE;
 
-                *cBytes += bytes;
+    DumpString(prefix, -1, pwptr, plen);
+    if (!DumpSid(psid, pwptr, plen))
+        return FALSE;
+    return TRUE;
+}
 
-                break;
-            }
+static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+{
+    static const WCHAR dacl[] = {'D',':',0};
+    SECURITY_DESCRIPTOR_CONTROL control;
+    BOOL present, defaulted;
+    DWORD revision;
+    PACL pacl;
 
-            case 'S':
-            {
-                DWORD flags;
-                DWORD bytes;
+    if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
+        return FALSE;
 
-                if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
-                    goto lend;
+    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
+        return FALSE;
 
-                if (SecurityDescriptor)
-                {
-                    SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
-                    SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
-                    lpNext += bytes; /* Advance to next token */
-                }
+    if (!present)
+        return TRUE;
 
-                *cBytes += bytes;
+    DumpString(dacl, 2, pwptr, plen);
+    if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
+        return FALSE;
+    return TRUE;
+}
 
-                break;
-            }
+static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
+{
+    static const WCHAR sacl[] = {'S',':',0};
+    SECURITY_DESCRIPTOR_CONTROL control;
+    BOOL present, defaulted;
+    DWORD revision;
+    PACL pacl;
 
-            default:
-                FIXME("Unknown token\n");
-                SetLastError(ERROR_INVALID_PARAMETER);
-                goto lend;
-        }
+    if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
+        return FALSE;
 
-        StringSecurityDescriptor = lptoken;
-    }
+    if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
+        return FALSE;
 
-    bret = TRUE;
+    if (!present)
+        return TRUE;
 
-lend:
-    return bret;
+    DumpString(sacl, 2, pwptr, plen);
+    if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
+        return FALSE;
+    return TRUE;
 }
 
-
 /******************************************************************************
- * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
+ * ConvertSecurityDescriptorToStringSecurityDescriptorW [ADVAPI32.@]
  * @implemented
  */
 BOOL WINAPI
-ConvertStringSecurityDescriptorToSecurityDescriptorW(LPCWSTR StringSecurityDescriptor,
-                                                     DWORD StringSDRevision,
-                                                     PSECURITY_DESCRIPTOR* SecurityDescriptor,
-                                                     PULONG SecurityDescriptorSize)
+ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor,
+                                                     DWORD SDRevision,
+                                                     SECURITY_INFORMATION SecurityInformation,
+                                                     LPWSTR *OutputString,
+                                                     PULONG OutputLen)
 {
-    DWORD cBytes;
-    SECURITY_DESCRIPTOR* psd;
-    BOOL bret = FALSE;
-
-    TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
+    ULONG len;
+    WCHAR *wptr, *wstr;
 
-    if (GetVersion() & 0x80000000)
-    {
-        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
-        goto lend;
-    }
-    else if (!StringSecurityDescriptor || !SecurityDescriptor)
-    {
-        SetLastError(ERROR_INVALID_PARAMETER);
-        goto lend;
-    }
-    else if (StringSDRevision != SID_REVISION)
+    if (SDRevision != SDDL_REVISION_1)
     {
+        ERR("Program requested unknown SDDL revision %d\n", SDRevision);
         SetLastError(ERROR_UNKNOWN_REVISION);
-        goto lend;
-    }
-
-    /* Compute security descriptor length */
-    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
-        NULL, &cBytes))
-        goto lend;
-
-    psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
-    if (!psd) goto lend;
-
-    psd->Revision = SID_REVISION;
-    psd->Control |= SE_SELF_RELATIVE;
-
-    if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
-             (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
-    {
-        LocalFree(psd);
-        goto lend;
+        return FALSE;
     }
 
-    if (SecurityDescriptorSize)
-        *SecurityDescriptorSize = cBytes;
+    len = 0;
+    if (SecurityInformation & OWNER_SECURITY_INFORMATION)
+        if (!DumpOwner(SecurityDescriptor, NULL, &len))
+            return FALSE;
+    if (SecurityInformation & GROUP_SECURITY_INFORMATION)
+        if (!DumpGroup(SecurityDescriptor, NULL, &len))
+            return FALSE;
+    if (SecurityInformation & DACL_SECURITY_INFORMATION)
+        if (!DumpDacl(SecurityDescriptor, NULL, &len))
+            return FALSE;
+    if (SecurityInformation & SACL_SECURITY_INFORMATION)
+        if (!DumpSacl(SecurityDescriptor, NULL, &len))
+            return FALSE;
 
-    bret = TRUE;
+    wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
+    if (wstr == NULL)
+        return FALSE;
+        
+    if (SecurityInformation & OWNER_SECURITY_INFORMATION)
+        if (!DumpOwner(SecurityDescriptor, &wptr, NULL))
+            return FALSE;
+    if (SecurityInformation & GROUP_SECURITY_INFORMATION)
+        if (!DumpGroup(SecurityDescriptor, &wptr, NULL))
+            return FALSE;
+    if (SecurityInformation & DACL_SECURITY_INFORMATION)
+        if (!DumpDacl(SecurityDescriptor, &wptr, NULL))
+            return FALSE;
+    if (SecurityInformation & SACL_SECURITY_INFORMATION)
+        if (!DumpSacl(SecurityDescriptor, &wptr, NULL))
+            return FALSE;
+    *wptr = 0;
 
-lend:
-    TRACE(" ret=%d\n", bret);
-    return bret;
+    TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
+    *OutputString = wstr;
+    if (OutputLen)
+        *OutputLen = strlenW(*OutputString)+1;
+    return TRUE;
 }
 
-
-/* Winehq cvs 20050916 */
 /******************************************************************************
- * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
+ * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
  * @implemented
  */
-BOOL
-WINAPI
-ConvertStringSecurityDescriptorToSecurityDescriptorA(LPCSTR StringSecurityDescriptor,
-                                                     DWORD StringSDRevision,
-                                                     PSECURITY_DESCRIPTOR* SecurityDescriptor,
-                                                     PULONG SecurityDescriptorSize)
+BOOL WINAPI
+ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor,
+                                                     DWORD SDRevision,
+                                                     SECURITY_INFORMATION Information,
+                                                     LPSTR *OutputString,
+                                                     PULONG OutputLen)
 {
-    UINT len;
-    BOOL ret = FALSE;
-    LPWSTR StringSecurityDescriptorW;
-
-    len = MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, NULL, 0);
-    StringSecurityDescriptorW = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
+    LPWSTR wstr;
+    ULONG len;
 
-    if (StringSecurityDescriptorW)
+    if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
     {
-        MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, StringSecurityDescriptorW, len);
+        int lenA;
 
-        ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
-                                                                   StringSDRevision, SecurityDescriptor,
-                                                                   SecurityDescriptorSize);
-        HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
-    }
+        lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
+        *OutputString = HeapAlloc(GetProcessHeap(), 0, lenA);
+        if (*OutputString == NULL)
+        {
+            LocalFree(wstr);
+            *OutputLen = 0;
+            return FALSE;
+        }
+        WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
+        LocalFree(wstr);
 
-    return ret;
+        if (OutputLen != NULL)
+            *OutputLen = lenA;
+        return TRUE;
+    }
+    else
+    {
+        *OutputString = NULL;
+        if (OutputLen)
+            *OutputLen = 0;
+        return FALSE;
+    }
 }
 
 /*
@@ -1427,133 +1524,158 @@ ConvertStringSecurityDescriptorToSecurityDescriptorA(LPCSTR StringSecurityDescri
  */
 BOOL
 WINAPI
-EqualPrefixSid(PSID pSid1,
-               PSID pSid2)
+ConvertStringSidToSidW(IN LPCWSTR StringSid,
+                       OUT PSID* sid)
 {
-    return RtlEqualPrefixSid (pSid1, pSid2);
-}
-
+    DWORD size;
+    DWORD i, cBytes, identAuth, csubauth;
+    BOOL ret;
+    SID* pisid;
 
-/*
- * @implemented
- */
-BOOL
-WINAPI
-EqualSid(PSID pSid1,
-         PSID pSid2)
-{
-    SetLastError(ERROR_SUCCESS);
-    return RtlEqualSid (pSid1, pSid2);
-}
+    TRACE("%s %p\n", debugstr_w(StringSid), sid);
 
+    if (!StringSid)
+    {
+        SetLastError(ERROR_INVALID_SID);
+        return FALSE;
+    }
 
-/*
- * @implemented
- *
- * RETURNS
- *  Docs says this function does NOT return a value
- *  even thou it's defined to return a PVOID...
- */
-PVOID
-WINAPI
-FreeSid(PSID pSid)
-{
-    return RtlFreeSid(pSid);
-}
+    for (i = 0; i < sizeof(SidTable) / sizeof(SidTable[0]) - 1; i++)
+    {
+        if (wcscmp(StringSid, SidTable[i].key) == 0)
+        {
+            WELL_KNOWN_SID_TYPE knownSid = (WELL_KNOWN_SID_TYPE)SidTable[i].value;
+            size = SECURITY_MAX_SID_SIZE;
+            *sid = LocalAlloc(0, size);
+            if (!*sid)
+            {
+                SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+                return FALSE;
+            }
+            ret = CreateWellKnownSid(knownSid,
+                                     NULL,
+                                     *sid,
+                                     &size);
+            if (!ret)
+            {
+                SetLastError(ERROR_INVALID_SID);
+                LocalFree(*sid);
+            }
+            return ret;
+        }
+    }
 
+    /* That's probably a string S-R-I-S-S... */
+    if (StringSid[0] != 'S' || StringSid[1] != '-')
+    {
+        SetLastError(ERROR_INVALID_SID);
+        return FALSE;
+    }
 
-/*
- * @implemented
- */
-DWORD
-WINAPI
-GetLengthSid(PSID pSid)
-{
-    return (DWORD)RtlLengthSid(pSid);
-}
+    cBytes = ComputeStringSidSize(StringSid);
+    pisid = (SID*)LocalAlloc( 0, cBytes );
+    if (!pisid)
+    {
+        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        return FALSE;
+    }
+    i = 0;
+    ret = FALSE;
+    csubauth = ((cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
 
+    StringSid += 2; /* Advance to Revision */
+    pisid->Revision = atoiW(StringSid);
 
-/*
- * @implemented
- */
-PSID_IDENTIFIER_AUTHORITY
-WINAPI
-GetSidIdentifierAuthority(PSID pSid)
-{
-    return RtlIdentifierAuthoritySid(pSid);
-}
+    if (pisid->Revision != SDDL_REVISION)
+    {
+        TRACE("Revision %d is unknown\n", pisid->Revision);
+        goto lend; /* ERROR_INVALID_SID */
+    }
+    if (csubauth == 0)
+    {
+        TRACE("SubAuthorityCount is 0\n");
+        goto lend; /* ERROR_INVALID_SID */
+    }
 
+    pisid->SubAuthorityCount = csubauth;
 
-/*
- * @implemented
- */
-DWORD
-WINAPI
-GetSidLengthRequired(UCHAR nSubAuthorityCount)
-{
-    return (DWORD)RtlLengthRequiredSid(nSubAuthorityCount);
-}
+    /* Advance to identifier authority */
+    while (*StringSid && *StringSid != '-')
+        StringSid++;
+    if (*StringSid == '-')
+        StringSid++;
 
+    /* MS' implementation can't handle values greater than 2^32 - 1, so
+     * we don't either; assume most significant bytes are always 0
+     */
+    pisid->IdentifierAuthority.Value[0] = 0;
+    pisid->IdentifierAuthority.Value[1] = 0;
+    identAuth = atoiW(StringSid);
+    pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
+    pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
+    pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
+    pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
 
-/*
- * @implemented
- */
-PDWORD
-WINAPI
-GetSidSubAuthority(PSID pSid,
-                   DWORD nSubAuthority)
-{
-    SetLastError(ERROR_SUCCESS);
-    return (PDWORD)RtlSubAuthoritySid(pSid, nSubAuthority);
-}
+    /* Advance to first sub authority */
+    while (*StringSid && *StringSid != '-')
+        StringSid++;
+    if (*StringSid == '-')
+        StringSid++;
 
+    while (*StringSid)
+    {
+        pisid->SubAuthority[i++] = atoiW(StringSid);
 
-/*
- * @implemented
- */
-PUCHAR
-WINAPI
-GetSidSubAuthorityCount(PSID pSid)
-{
-    SetLastError(ERROR_SUCCESS);
-    return RtlSubAuthorityCountSid(pSid);
-}
+        while (*StringSid && *StringSid != '-')
+            StringSid++;
+        if (*StringSid == '-')
+            StringSid++;
+    }
 
+    if (i != pisid->SubAuthorityCount)
+        goto lend; /* ERROR_INVALID_SID */
 
-/*
- * @implemented
- */
-BOOL
-WINAPI
-InitializeSid(PSID Sid,
-              PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
-              BYTE nSubAuthorityCount)
-{
-    NTSTATUS Status;
+    *sid = pisid;
+    ret = TRUE;
 
-    Status = RtlInitializeSid(Sid,
-                              pIdentifierAuthority,
-                              nSubAuthorityCount);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
+lend:
+    if (!ret)
+    {
+        LocalFree(pisid);
+        SetLastError(ERROR_INVALID_SID);
     }
 
-    return TRUE;
+    TRACE("returning %s\n", ret ? "TRUE" : "FALSE");
+    return ret;
 }
 
-
 /*
  * @implemented
  */
 BOOL
 WINAPI
-IsValidSid(PSID pSid)
+ConvertStringSidToSidA(IN LPCSTR StringSid,
+                       OUT PSID* sid)
 {
-    return (BOOL)RtlValidSid(pSid);
-}
+    BOOL bRetVal = FALSE;
 
+    TRACE("%s, %p\n", debugstr_a(StringSid), sid);
+    if (GetVersion() & 0x80000000)
+        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
+    else if (!StringSid || !sid)
+        SetLastError(ERROR_INVALID_PARAMETER);
+    else
+    {
+        UINT len = MultiByteToWideChar(CP_ACP, 0, StringSid, -1, NULL, 0);
+        LPWSTR wStringSid = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
+        if (wStringSid == NULL)
+            return FALSE;
+        MultiByteToWideChar(CP_ACP, 0, StringSid, - 1, wStringSid, len);
+        bRetVal = ConvertStringSidToSidW(wStringSid, sid);
+        HeapFree(GetProcessHeap(), 0, wStringSid);
+    }
+    return bRetVal;
+}
 
 /*
  * @implemented
@@ -1609,7 +1731,6 @@ ConvertSidToStringSidW(PSID Sid,
     return TRUE;
 }
 
-
 /*
  * @implemented
  */
@@ -1628,360 +1749,217 @@ ConvertSidToStringSidA(PSID Sid,
 
     Len = WideCharToMultiByte(CP_ACP, 0, StringSidW, -1, NULL, 0, NULL, NULL);
     if (Len <= 0)
-    {
-        LocalFree(StringSidW);
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return FALSE;
-    }
-
-    *StringSid = LocalAlloc(LMEM_FIXED, Len);
-    if (NULL == *StringSid)
-    {
-        LocalFree(StringSidW);
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-        return FALSE;
-    }
-
-    if (!WideCharToMultiByte(CP_ACP, 0, StringSidW, -1, *StringSid, Len, NULL, NULL))
-    {
-        LocalFree(StringSid);
-        LocalFree(StringSidW);
-        return FALSE;
-    }
-
-    LocalFree(StringSidW);
-
-    return TRUE;
-}
-
-
-/*
- * @unimplemented
- */
-BOOL
-WINAPI
-EqualDomainSid(IN PSID pSid1,
-               IN PSID pSid2,
-               OUT BOOL* pfEqual)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
-
-/*
- * @unimplemented
- */
-BOOL
-WINAPI
-GetWindowsAccountDomainSid(IN PSID pSid,
-                           OUT PSID ppDomainSid,
-                           IN OUT DWORD* cbSid)
-{
-    UNIMPLEMENTED;
-    return FALSE;
-}
-
-
-/*
- * @unimplemented
- */
-BOOL
-WINAPI
-CreateWellKnownSid(IN WELL_KNOWN_SID_TYPE WellKnownSidType,
-                   IN PSID DomainSid  OPTIONAL,
-                   OUT PSID pSid,
-                   IN OUT DWORD* cbSid)
-{
-    unsigned int i;
-    TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
-
-    if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
-    {
-        SetLastError(ERROR_INVALID_PARAMETER);
-        return FALSE;
-    }
-
-    for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
-        if (WellKnownSids[i].Type == WellKnownSidType) {
-            DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
-
-            if (*cbSid < length)
-            {
-                *cbSid = length;
-                SetLastError(ERROR_INSUFFICIENT_BUFFER);
-                return FALSE;
-            }
-            if (!pSid)
-            {
-                SetLastError(ERROR_INVALID_PARAMETER);
-                return FALSE;
-            }
-            CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
-            *cbSid = length;
-            return TRUE;
-        }
-    }
-
-    if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
-    {
-        SetLastError(ERROR_INVALID_PARAMETER);
-        return FALSE;
-    }
-
-    for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
-        if (WellKnownRids[i].Type == WellKnownSidType) {
-            UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
-            DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
-            DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
-
-            if (*cbSid < output_sid_length)
-            {
-                *cbSid = output_sid_length;
-                SetLastError(ERROR_INSUFFICIENT_BUFFER);
-                return FALSE;
-            }
-            if (!pSid)
-            {
-                SetLastError(ERROR_INVALID_PARAMETER);
-                return FALSE;
-            }
-            CopyMemory(pSid, DomainSid, domain_sid_length);
-            (*GetSidSubAuthorityCount(pSid))++;
-            (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
-            *cbSid = output_sid_length;
-            return TRUE;
-        }
-
-    SetLastError(ERROR_INVALID_PARAMETER);
-    return FALSE;
-}
-
-
-/*
- * @unimplemented
- */
-BOOL
-WINAPI
-IsWellKnownSid(IN PSID pSid,
-               IN WELL_KNOWN_SID_TYPE WellKnownSidType)
-{
-    unsigned int i;
-    TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
-
-    for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
-    {
-        if (WellKnownSids[i].Type == WellKnownSidType)
-        {
-            if (EqualSid(pSid, (PSID)(&WellKnownSids[i].Sid.Revision)))
-                return TRUE;
-        }
-    }
-
-    return FALSE;
-}
-
-
-/*
- * @implemented
- */
-BOOL
-WINAPI
-ConvertStringSidToSidA(IN LPCSTR StringSid,
-                       OUT PSID* sid)
-{
-    BOOL bRetVal = FALSE;
-
-    TRACE("%s, %p\n", debugstr_a(StringSid), sid);
-    if (GetVersion() & 0x80000000)
-        SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
-    else if (!StringSid || !sid)
-        SetLastError(ERROR_INVALID_PARAMETER);
-    else
-    {
-        UINT len = MultiByteToWideChar(CP_ACP, 0, StringSid, -1, NULL, 0);
-        LPWSTR wStringSid = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
-        if (wStringSid == NULL)
-            return FALSE;
-        MultiByteToWideChar(CP_ACP, 0, StringSid, - 1, wStringSid, len);
-        bRetVal = ConvertStringSidToSidW(wStringSid, sid);
-        HeapFree(GetProcessHeap(), 0, wStringSid);
-    }
-    return bRetVal;
-}
-
-
-static const RECORD SidTable[] =
-{
-       { SDDL_ACCOUNT_OPERATORS, WinBuiltinAccountOperatorsSid },
-       { SDDL_ALIAS_PREW2KCOMPACC, WinBuiltinPreWindows2000CompatibleAccessSid },
-       { SDDL_ANONYMOUS, WinAnonymousSid },
-       { SDDL_AUTHENTICATED_USERS, WinAuthenticatedUserSid },
-       { SDDL_BUILTIN_ADMINISTRATORS, WinBuiltinAdministratorsSid },
-       { SDDL_BUILTIN_GUESTS, WinBuiltinGuestsSid },
-       { SDDL_BACKUP_OPERATORS, WinBuiltinBackupOperatorsSid },
-       { SDDL_BUILTIN_USERS, WinBuiltinUsersSid },
-       { SDDL_CERT_SERV_ADMINISTRATORS, WinAccountCertAdminsSid /* FIXME: DOMAIN_GROUP_RID_CERT_ADMINS */ },
-       { SDDL_CREATOR_GROUP, WinCreatorGroupSid },
-       { SDDL_CREATOR_OWNER, WinCreatorOwnerSid },
-       { SDDL_DOMAIN_ADMINISTRATORS, WinAccountDomainAdminsSid /* FIXME: DOMAIN_GROUP_RID_ADMINS */ },
-       { SDDL_DOMAIN_COMPUTERS, WinAccountComputersSid /* FIXME: DOMAIN_GROUP_RID_COMPUTERS */ },
-       { SDDL_DOMAIN_DOMAIN_CONTROLLERS, WinAccountControllersSid /* FIXME: DOMAIN_GROUP_RID_CONTROLLERS */ },
-       { SDDL_DOMAIN_GUESTS, WinAccountDomainGuestsSid /* FIXME: DOMAIN_GROUP_RID_GUESTS */ },
-       { SDDL_DOMAIN_USERS, WinAccountDomainUsersSid /* FIXME: DOMAIN_GROUP_RID_USERS */ },
-       { SDDL_ENTERPRISE_ADMINS, WinAccountEnterpriseAdminsSid /* FIXME: DOMAIN_GROUP_RID_ENTERPRISE_ADMINS */ },
-       { SDDL_ENTERPRISE_DOMAIN_CONTROLLERS, WinEnterpriseControllersSid },
-       { SDDL_EVERYONE, WinWorldSid },
-       { SDDL_GROUP_POLICY_ADMINS, WinAccountPolicyAdminsSid /* FIXME: DOMAIN_GROUP_RID_POLICY_ADMINS */ },
-       { SDDL_INTERACTIVE, WinInteractiveSid },
-       { SDDL_LOCAL_ADMIN, WinAccountAdministratorSid /* FIXME: DOMAIN_USER_RID_ADMIN */ },
-       { SDDL_LOCAL_GUEST, WinAccountGuestSid /* FIXME: DOMAIN_USER_RID_GUEST */ },
-       { SDDL_LOCAL_SERVICE, WinLocalServiceSid },
-       { SDDL_LOCAL_SYSTEM, WinLocalSystemSid },
-       { SDDL_NETWORK, WinNetworkSid },
-       { SDDL_NETWORK_CONFIGURATION_OPS, WinBuiltinNetworkConfigurationOperatorsSid },
-       { SDDL_NETWORK_SERVICE, WinNetworkServiceSid },
-       { SDDL_PRINTER_OPERATORS, WinBuiltinPrintOperatorsSid },
-       { SDDL_PERSONAL_SELF, WinSelfSid },
-       { SDDL_POWER_USERS, WinBuiltinPowerUsersSid },
-       { SDDL_RAS_SERVERS, WinAccountRasAndIasServersSid /* FIXME: DOMAIN_ALIAS_RID_RAS_SERVERS */ },
-       { SDDL_REMOTE_DESKTOP, WinBuiltinRemoteDesktopUsersSid },
-       { SDDL_REPLICATOR, WinBuiltinReplicatorSid },
-       { SDDL_RESTRICTED_CODE, WinRestrictedCodeSid },
-       { SDDL_SCHEMA_ADMINISTRATORS, WinAccountSchemaAdminsSid /* FIXME: DOMAIN_GROUP_RID_SCHEMA_ADMINS */ },
-       { SDDL_SERVER_OPERATORS, WinBuiltinSystemOperatorsSid },
-       { SDDL_SERVICE, WinServiceSid },
-       { NULL, 0 },
-};
+    {
+        LocalFree(StringSidW);
+        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        return FALSE;
+    }
+
+    *StringSid = LocalAlloc(LMEM_FIXED, Len);
+    if (NULL == *StringSid)
+    {
+        LocalFree(StringSidW);
+        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        return FALSE;
+    }
+
+    if (!WideCharToMultiByte(CP_ACP, 0, StringSidW, -1, *StringSid, Len, NULL, NULL))
+    {
+        LocalFree(StringSid);
+        LocalFree(StringSidW);
+        return FALSE;
+    }
+
+    LocalFree(StringSidW);
+
+    return TRUE;
+}
 
 /*
  * @implemented
  */
-BOOL
-WINAPI
-ConvertStringSidToSidW(IN LPCWSTR StringSid,
-                       OUT PSID* sid)
+BOOL WINAPI
+AllocateLocallyUniqueId(PLUID Luid)
 {
-    DWORD size;
-    DWORD i, cBytes, identAuth, csubauth;
-    BOOL ret;
-    SID* pisid;
-
-    TRACE("%s %p\n", debugstr_w(StringSid), sid);
+    NTSTATUS Status;
 
-    if (!StringSid)
+    Status = NtAllocateLocallyUniqueId (Luid);
+    if (!NT_SUCCESS (Status))
     {
-        SetLastError(ERROR_INVALID_SID);
+        SetLastError(RtlNtStatusToDosError(Status));
         return FALSE;
     }
 
-    for (i = 0; i < sizeof(SidTable) / sizeof(SidTable[0]) - 1; i++)
+    return TRUE;
+}
+
+/******************************************************************************
+ * ComputeStringSidSize
+ */
+static DWORD ComputeStringSidSize(LPCWSTR StringSid)
+{
+    if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
     {
-        if (wcscmp(StringSid, SidTable[i].key) == 0)
+        int ctok = 0;
+        while (*StringSid)
         {
-            WELL_KNOWN_SID_TYPE knownSid = (WELL_KNOWN_SID_TYPE)SidTable[i].value;
-            size = SECURITY_MAX_SID_SIZE;
-            *sid = LocalAlloc(0, size);
-            if (!*sid)
-            {
-                SetLastError(ERROR_NOT_ENOUGH_MEMORY);
-                return FALSE;
-            }
-            ret = CreateWellKnownSid(knownSid,
-                                     NULL,
-                                     *sid,
-                                     &size);
-            if (!ret)
-            {
-                SetLastError(ERROR_INVALID_SID);
-                LocalFree(*sid);
-            }
-            return ret;
+            if (*StringSid == '-')
+                ctok++;
+            StringSid++;
         }
-    }
 
-    /* That's probably a string S-R-I-S-S... */
-    if (StringSid[0] != 'S' || StringSid[1] != '-')
+        if (ctok >= 3)
+            return GetSidLengthRequired(ctok - 2);
+    }
+    else /* String constant format  - Only available in winxp and above */
     {
-        SetLastError(ERROR_INVALID_SID);
-        return FALSE;
+        unsigned int i;
+
+        for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
+            if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
+                return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
     }
 
-    cBytes = ComputeStringSidSize(StringSid);
-    pisid = (SID*)LocalAlloc( 0, cBytes );
-    if (!pisid)
+    return GetSidLengthRequired(0);
+}
+
+/******************************************************************************
+ * ParseStringSidToSid
+ */
+static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
+{
+    BOOL bret = FALSE;
+    SID* pisid=pSid;
+
+    TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
+    if (!StringSid)
     {
-        SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+        SetLastError(ERROR_INVALID_PARAMETER);
+        TRACE("StringSid is NULL, returning FALSE\n");
         return FALSE;
     }
-    i = 0;
-    ret = FALSE;
-    csubauth = ((cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
 
-    StringSid += 2; /* Advance to Revision */
-    pisid->Revision = atoiW(StringSid);
+    while (*StringSid == ' ')
+        StringSid++;
 
-    if (pisid->Revision != SDDL_REVISION)
+    *cBytes = ComputeStringSidSize(StringSid);
+    if (!pisid) /* Simply compute the size */
     {
-        TRACE("Revision %d is unknown\n", pisid->Revision);
-        goto lend; /* ERROR_INVALID_SID */
+        TRACE("only size requested, returning TRUE\n");
+        return TRUE;
     }
-    if (csubauth == 0)
+
+    if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
     {
-        TRACE("SubAuthorityCount is 0\n");
-        goto lend; /* ERROR_INVALID_SID */
-    }
+        DWORD i = 0, identAuth;
+        DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
 
-    pisid->SubAuthorityCount = csubauth;
+        StringSid += 2; /* Advance to Revision */
+        pisid->Revision = atoiW(StringSid);
 
-    /* Advance to identifier authority */
-    while (*StringSid && *StringSid != '-')
-        StringSid++;
-    if (*StringSid == '-')
-        StringSid++;
+        if (pisid->Revision != SDDL_REVISION)
+        {
+            TRACE("Revision %d is unknown\n", pisid->Revision);
+            goto lend; /* ERROR_INVALID_SID */
+        }
+        if (csubauth == 0)
+        {
+            TRACE("SubAuthorityCount is 0\n");
+            goto lend; /* ERROR_INVALID_SID */
+        }
 
-    /* MS' implementation can't handle values greater than 2^32 - 1, so
-     * we don't either; assume most significant bytes are always 0
-     */
-    pisid->IdentifierAuthority.Value[0] = 0;
-    pisid->IdentifierAuthority.Value[1] = 0;
-    identAuth = atoiW(StringSid);
-    pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
-    pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
-    pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
-    pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
+        pisid->SubAuthorityCount = csubauth;
 
-    /* Advance to first sub authority */
-    while (*StringSid && *StringSid != '-')
-        StringSid++;
-    if (*StringSid == '-')
-        StringSid++;
+        /* Advance to identifier authority */
+        while (*StringSid && *StringSid != '-')
+            StringSid++;
+        if (*StringSid == '-')
+            StringSid++;
 
-    while (*StringSid)
-    {
-        pisid->SubAuthority[i++] = atoiW(StringSid);
+        /* MS' implementation can't handle values greater than 2^32 - 1, so
+         * we don't either; assume most significant bytes are always 0
+         */
+        pisid->IdentifierAuthority.Value[0] = 0;
+        pisid->IdentifierAuthority.Value[1] = 0;
+        identAuth = atoiW(StringSid);
+        pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
+        pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
+        pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
+        pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
 
+        /* Advance to first sub authority */
         while (*StringSid && *StringSid != '-')
             StringSid++;
         if (*StringSid == '-')
             StringSid++;
+
+        while (*StringSid)
+        {
+            pisid->SubAuthority[i++] = atoiW(StringSid);
+
+            while (*StringSid && *StringSid != '-')
+                StringSid++;
+            if (*StringSid == '-')
+                StringSid++;
+        }
+
+        if (i != pisid->SubAuthorityCount)
+            goto lend; /* ERROR_INVALID_SID */
+
+        bret = TRUE;
     }
+    else /* String constant format  - Only available in winxp and above */
+    {
+        unsigned int i;
+        pisid->Revision = SDDL_REVISION;
 
-    if (i != pisid->SubAuthorityCount)
-        goto lend; /* ERROR_INVALID_SID */
+        for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
+            if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
+            {
+                DWORD j;
+                pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
+                pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
+                for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
+                    pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
+                bret = TRUE;
+            }
 
-    *sid = pisid;
-    ret = TRUE;
+        if (!bret)
+            FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
+    }
 
 lend:
-    if (!ret)
-    {
-        LocalFree(pisid);
+    if (!bret)
         SetLastError(ERROR_INVALID_SID);
-    }
 
-    TRACE("returning %s\n", ret ? "TRUE" : "FALSE");
-    return ret;
+    TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
+    return bret;
+}
+
+/*
+ * @unimplemented
+ */
+BOOL
+WINAPI
+GetWindowsAccountDomainSid(IN PSID pSid,
+                           OUT PSID ppDomainSid,
+                           IN OUT DWORD* cbSid)
+{
+    UNIMPLEMENTED;
+    return FALSE;
+}
+
+/*
+ * @unimplemented
+ */
+BOOL
+WINAPI
+EqualDomainSid(IN PSID pSid1,
+               IN PSID pSid2,
+               OUT BOOL* pfEqual)
+{
+    UNIMPLEMENTED;
+    return FALSE;
 }
 
 /* EOF */