UEFI Create User - uefi

Question

I try to use this code
Status = gBS->OpenProtocol(handles[i], &gEfiUserManagerProtocolGuid, (void **) &mUserManager, gImageHandle, NULL, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
switch (Status)
{
case EFI_SUCCESS: Print(L"OpenProtocol _____ OK!\n\r"); break;
case EFI_INVALID_PARAMETER: Print(L"OpenProtocol _____ EFI_INVALID_PARAMETER!\n\r"); break;
case EFI_UNSUPPORTED: Print(L"OpenProtocol _____ EFI_UNSUPPORTED!\n\r"); break;
default: Print(L"OpenProtocol _____ Status = %d \n\r",Status); break;
}
Status = mUserManager->Create(mUserManager, &User);
switch (Status)
{
case EFI_SUCCESS: Print(L"Create _____ create successfully!\n\r"); break;
case EFI_ACCESS_DENIED: Print(L"Create _____ EFI_ACCESS_DENIED!\n\r"); break;
case EFI_UNSUPPORTED: Print(L"Create _____ EFI_UNSUPPORTED!\n\r"); break;
case EFI_INVALID_PARAMETER: Print(L"Create _____ EFI_INVALID_PARAMETER!\n\r"); break;
default: Print(L"Create _____ Status = %d \n\r",Status); break;
}
Status return EFI_SUCCESS, computer go to reboot. Next time i try to create user, status return EFI_ACCESS_DENIED. Where user profile storing? How to create user at second time?

Answer 1

I think you are creating a user with limited rights by default which can't create any other users that is why you have EFI_ACCESS_DENIED in return.
Here is the related quote from UEFI 2.4 Rev B specs, page 1837:
If the current user profile does not permit creation of new user profiles then
EFI_ACCESS_DENIED will be returned. If creation of new user profiles is not supported, then
EFI_UNSUPPORTED is returned.
Here you can find an example of using the protocol you are trying to use.
User profiles are stored in non-volatile memory that must be protected from tampering, so it's implementation-defined thing, but all implementations I know are using NVRAM.