Re: Interactive Service Related to Logon

From: Maxim S. Shatskih (maxim_at_storagecraft.com)
Date: 11/03/04 

Date: Wed, 3 Nov 2004 16:43:15 +0300

> I am writing a Service that will authenticate the users during the
> Login.
> The way I implement this scheme is that I start separate thread that
> draws dialog whenever the service get Event Notification (Lock,
> Logoff, Startup) from winlogon.

Showing any UI from the service is a security issue (due to window manager
being unprotected and security-unaware at all), and, according to David
LeBlanc, the next Windows versions are likely to disable all ways of doing
this.

Write a helper app which will show the UI which will communicate to the service
via RPC or COM.

If the purpose of your service is to authenticate the user - then write a
subauth package, Platform SDK has everything needed for it.

> It said that displaying a GUI from a service, especially on a
> Multi-user system is not recommended.

It will be probably disabled in the future to avoid opening a security hole.
There will be no more interactive services. 

-- 
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Relevant Pages

  • Re: [ok] [Full-Disclosure] RE: [Full-Disclosure]MS should re-write code with security in mind
    ... almost all Windows users demand backward compatibility. ... > security upgrades available on MS's site. ... > and authenticate all mail transfer. ...
    (Full-Disclosure)
  • Re: [ok] [Full-Disclosure] RE: [Full-Disclosure]MS should re-write code with security in mind
    ... almost all Windows users demand backward compatibility. ... security upgrades available on MS's site. ... and authenticate all mail transfer. ...
    (Full-Disclosure)
  • Re: How to add an extra password field to an AD?
    ... The service is not windows related at all, therefore it is not desired to integrate with Windows more than absolutely necessary. ... credentials that the users use to authenticate for other AD services. ... the service uses a system object with security on that object -- the security ... does have an LDAP interface and can authenticate against an LDAP server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Interactive Service Related to Logon
    ... I think you are correct about future versions of Windows not allowing this. ... I have a service that uses this technique so the process can display its ... >> I am writing a Service that will authenticate the users during the ... > Showing any UI from the service is a security issue (due to window manager ...
    (microsoft.public.win32.programmer.kernel)
  • Re: kerberos!
    ... If Windows presented the "connect as" dialog when falling back to NTLM, you would at least know that it was happening without having to understand the contents of this thread. ... >requires NTLMv2 to authenticate when opening a cif share via ip address. ... >security (causing many of Microsoft's security issues. ...
    (NT-Bugtraq)