RtlIsParentOfChildAppContainer - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTRTL_H
#if (PHNT_VERSION >= PHNT_WINDOWS_8_1)

// rev
NTSYSAPI
BOOLEAN
NTAPI
RtlIsParentOfChildAppContainer(
    _In_ PSID ParentAppContainerSid,
    _In_ PSID ChildAppContainerSid
    );

#endif
#endif

View code on GitHub

NtDoc

Determines if two SIDs represent a pair of related child and parent AppContainer SIDs.

Parameters

Implementation details

The function verifies the types of provided SIDs using RtlGetAppContainerSidType and then compares their first SECURITY_PARENT_PACKAGE_RID_COUNT (8) sub-authorities.

Remarks

For the structure and relation between parent and child AppContainer SIDs, see APPCONTAINER_SID_TYPE.

Required OS version

This function was introduced in Windows 8.1 alongside the support for child AppContainers.

See also

Edit description on GitHub