Added New-NtWindowStation.

Author: tyranid

NtApiDotNet/NtWindowStation.cs

@@ -203,6 +203,22 @@ public static NtResult<NtWindowStation> Create(ObjectAttributes object_attribute
             }
         }
 
+        /// <summary>
+        /// Create a Window Station by name.
+        /// </summary>
+        /// <param name="object_attributes">Object attributes for the Window Station.</param>
+        /// <param name="desired_access">Desired access for the Window Station.</param>
+        /// <param name="kbd_dll_path">Path to Keyboard DLL e.g. kbusa.dll.</param>
+        /// <param name="keyboard_locale">Locale ID, e.g. 0x4090409.</param>
+        /// <param name="language_id">Language ID e.g. 0x409.</param>
+        /// <returns>The Window Station.</returns>
+        public static NtWindowStation Create(ObjectAttributes object_attributes,
+            WindowStationAccessRights desired_access, string kbd_dll_path,
+            int language_id, int keyboard_locale)
+        {
+            return Create(object_attributes, desired_access, kbd_dll_path, language_id, keyboard_locale, true).Result;
+        }
+
         /// <summary>
         /// Create a Window Station by name.
         /// </summary>

NtObjectManager/NtObjectManager.psd1

@@ -102,7 +102,7 @@ CmdletsToExport = 'Add-NtKey', 'Get-NtDirectory', 'Get-NtEvent', 'Get-NtFile',
                'Remove-NtTokenSecurityAttribute', 'Get-AccessibleEventTrace',
                'Test-NtToken', 'Get-AccessibleToken', 'Set-NtProcessJob', 
                'Get-AccessibleWnf', 'Get-AccessibleWindowStation', 'Get-NtProcessJob',
-               'Get-NtWindowStation', 'Get-NtDesktop'
+               'Get-NtWindowStation', 'Get-NtDesktop', 'New-NtWindowStation'
 
 # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
 AliasesToExport = @()

NtObjectManager/NtWin32Cmdlets.cs

@@ -28,16 +28,16 @@ namespace NtObjectManager
     /// </example>
     /// <example>
     ///   <code>$obj = Get-NtWindowStation \Windows\WindowStations\WinSta0</code>
-    ///   <para>Get an Window Station object with an absolute path.</para>
+    ///   <para>Get a Window Station object with an absolute path.</para>
     /// </example>
     /// <example>
     ///   <code>$root = Get-NtDirectory \Windows\WindowStations&#x0A;$obj = Get-NtWindowStation ABC -Root $root</code>
-    ///   <para>Get an Window Station object with a relative path.
+    ///   <para>Get a Window Station object with a relative path.
     ///   </para>
     /// </example>
     /// <example>
     ///   <code>$obj = Get-NtWindowStation -Path WinSta0 -Win32Path</code>
-    ///   <para>Get an Window Station object from Win32 path.</para>
+    ///   <para>Get a Window Station object from Win32 path.</para>
     /// </example>
     /// <para type="link">about_ManagingNtObjectLifetime</para>
     [Cmdlet(VerbsCommon.Get, "NtWindowStation", DefaultParameterSetName = "All")]
@@ -220,4 +220,83 @@ protected override void ProcessRecord()
             }
         }
     }
+
+    /// <summary>
+    /// <para type="synopsis">Creates a Window Station object by path.</para>
+    /// <para type="description">This cmdlet creates an new Window Station object. The absolute path to the object in the NT object manager name space must be specified. 
+    /// It's also possible to create the object relative to an existing object by specified the -Root parameter.</para>
+    /// </summary>
+    /// <example>
+    ///   <code>$obj = New-NtWindowStation \Windows\WindowStations\WinSta0</code>
+    ///   <para>Create a Window Station object with an absolute path.</para>
+    /// </example>
+    /// <example>
+    ///   <code>$root = Get-NtDirectory \Windows\WindowStations&#x0A;$obj = New-NtWindowStation ABC -Root $root</code>
+    ///   <para>Create a Window Station object with a relative path.
+    ///   </para>
+    /// </example>
+    /// <example>
+    ///   <code>$obj = New-NtWindowStation -Path ABC -Win32Path</code>
+    ///   <para>Create a Window Station object from Win32 path.</para>
+    /// </example>
+    /// <para type="link">about_ManagingNtObjectLifetime</para>
+    [Cmdlet(VerbsCommon.New, "NtWindowStation")]
+    [OutputType(typeof(NtWindowStation))]
+    public sealed class NewNtWindowStationCmdlet : NtObjectBaseCmdletWithAccess<WindowStationAccessRights>
+    {
+        /// <summary>
+        /// <para type="description">The NT object manager path to the object to use.</para>
+        /// </summary>
+        [Parameter(Position = 0, Mandatory = true)]
+        public override string Path { get; set; }
+
+        /// <summary>
+        /// <para type="description">The DLL containing the Keyboard Layout information.</para>
+        /// </summary>
+        [Parameter]
+        public string KeyboardLayoutDll { get; set; }
+
+        /// <summary>
+        /// <para type="description">The language ID for the keyboard. E.g. 0x409.</para>
+        /// </summary>
+        [Parameter]
+        public int? LanguageId { get; set; }
+
+        /// <summary>
+        /// <para type="description">The keyboard local. E.g. 0x4090409.</para>
+        /// </summary>
+        [Parameter]
+        public int? KeyboardLocale { get; set; }
+
+        /// <summary>
+        /// Determine if the cmdlet can create objects.
+        /// </summary>
+        /// <returns>True if objects can be created.</returns>
+        protected override bool CanCreateDirectories()
+        {
+            return true;
+        }
+
+        /// <summary>
+        /// Get the Win32 path for a specified path.
+        /// </summary>
+        /// <param name="path">The path component.</param>
+        /// <returns>The full NT path.</returns>
+        protected override string GetWin32Path(string path)
+        {
+            return $@"{NtWindowStation.GetWindowStationDirectory()}\{path}";
+        }
+
+        /// <summary>
+        /// Method to create an object from a set of object attributes.
+        /// </summary>
+        /// <param name="obj_attributes">The object attributes to create/open from.</param>
+        /// <returns>The newly created object.</returns>
+        protected override object CreateObject(ObjectAttributes obj_attributes)
+        {
+            return NtWindowStation.Create(obj_attributes, Access, 
+                KeyboardLayoutDll ?? "kbdus.dll", 
+                LanguageId ?? 0x409, KeyboardLocale ?? 0x4090409);
+        }
+    }
 }