#ifndef _NTSEAPI_H
#if (PHNT_VERSION >= PHNT_WINDOWS_8)

/**
 * The NtFilterTokenEx routine creates a new access token that is a restricted version of an existing access token.
 *
 * \param ExistingTokenHandle Handle to a primary or impersonation token. The token can also be a restricted token. This token must already be open for TOKEN_DUPLICATE access.
 * \param Flags Specifies additional privilege options.
 * \param SidsToDisable The deny-only SIDs to include in the restricted token. The system uses a deny-only SID to deny access to a securable object. The absence of a deny-only SID does not allow access.
 * \param PrivilegesToDelete The privileges to delete in the restricted token. This parameter is optional and can be NULL.
 * \param RestrictedSids The list of restricting SIDs for the new token. This parameter is optional and can be NULL.
 * \param DisableUserClaimsCount The number of user claims to disable.
 * \param UserClaimsToDisable The list of user claims to disable in the restricted token. This parameter is optional and can be NULL.
 * \param DisableDeviceClaimsCount The number of device claims to disable.
 * \param DeviceClaimsToDisable The list of device claims to disable in the restricted token. This parameter is optional and can be NULL.
 * \param DeviceGroupsToDisable The list of device groups to disable in the restricted token. This parameter is optional and can be NULL.
 * \param RestrictedUserAttributes The list of restricted user attributes for the new token. This parameter is optional and can be NULL.
 * \param RestrictedDeviceAttributes The list of restricted device attributes for the new token. This parameter is optional and can be NULL.
 * \param RestrictedDeviceGroups The list of restricted device groups for the new token. This parameter is optional and can be NULL.
 * \param NewTokenHandle The new restricted token. The new token is the same type, primary or impersonation, as the existing token.
 * \return NTSTATUS Successful or errant status.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFilterTokenEx(
    _In_ HANDLE ExistingTokenHandle,
    _In_ ULONG Flags,
    _In_opt_ PTOKEN_GROUPS SidsToDisable,
    _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
    _In_opt_ PTOKEN_GROUPS RestrictedSids,
    _In_ ULONG DisableUserClaimsCount,
    _In_opt_ PCUNICODE_STRING UserClaimsToDisable,
    _In_ ULONG DisableDeviceClaimsCount,
    _In_opt_ PCUNICODE_STRING DeviceClaimsToDisable,
    _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
    _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,
    _Out_ PHANDLE NewTokenHandle
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwFilterTokenEx(
    _In_ HANDLE ExistingTokenHandle,
    _In_ ULONG Flags,
    _In_opt_ PTOKEN_GROUPS SidsToDisable,
    _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
    _In_opt_ PTOKEN_GROUPS RestrictedSids,
    _In_ ULONG DisableUserClaimsCount,
    _In_opt_ PCUNICODE_STRING UserClaimsToDisable,
    _In_ ULONG DisableDeviceClaimsCount,
    _In_opt_ PCUNICODE_STRING DeviceClaimsToDisable,
    _In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
    _In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,
    _Out_ PHANDLE NewTokenHandle
    );

#endif
View code on GitHub