LogonUser issues

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: BLiTZWiNG (BLiTZWiNG_at_discussions.microsoft.com)
Date: 01/27/05


Date: Wed, 26 Jan 2005 19:07:01 -0800

Having a few strage behaviours with this function, mainly in that when I try
to logon to another computer with a different name/pass to the current user
of the local machine, it tries to impersonate me, not the credentials I gave
it.

LogonUser succeeds only when using LOGON32_LOGON_NEW_CREDENTIALS (9). Any
other LogonType causes error 126: Specified module could not be found -
whatever that means...

The initial WindowsIdentity.GetCurrent() reveals "DELLWING\Trent" as the
user, which is my local account. Upon success of LogonUser I create a new
WindowsIdentity with the received token. Printing out the details reveals
"DELLWING\Trent" as the user, even though I supplied "Administrator" and the
password of the remote box. I then get "Unable to Impersonate User" when
trying Impersonate().

Why would the token come back represent me when I specified a whole nother
user and computer?

My code looks like this currently (thanks to Willy Denoyette).
-----------------------
using System;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Security.Permissions;

namespace SecurityTest
{
/// <summary>
/// Summary description for Class1.
/// </summary>
class SecurityTest
{
[DllImport("advapi32.DLL")]
public static extern int LogonUser(string lpszUsername, string lpszDomain,
string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr
phToken);

/// <summary>
/// The main entry point for the application.
/// </summary>
[STAThread]
static void Main(string[] args)
{
IntPtr admin_token;

// This works fine
WindowsIdentity wid_current = WindowsIdentity.GetCurrent();
Console.WriteLine("Current Name: " + wid_current.Name);
Console.WriteLine("Current Token: " + wid_current.Token);

if (LogonUser("Administrator", "192.168.0.5", "password", 9, 0, out
admin_token) != 0)
{
        WindowsIdentity wid_admin = new WindowsIdentity(admin_token);
        Console.WriteLine("Remote Name: " + wid_admin.Name);
        Console.WriteLine("Remote Token: " + wid_admin.Token);
                                

        WindowsImpersonationContext wic = null;
        try
        {
                wic = wid_admin.Impersonate();
                // Always get an exception here after Impersonate

                System.IO.File.Copy("C:\\test_read\\test.txt",
"\\\\192.168.0.5\\trent\\test.txt", true);
                                
        }
        catch (System.Exception se)
        {
                Console.WriteLine(se.Message);
        }
        finally
        {
                if (wic != null) wic.Undo();
        }
}
else
{
        int ret = Marshal.GetLastWin32Error();
        Console.WriteLine(ret.ToString(), "Error");
}
}
}



Relevant Pages

  • Re: Remote call to COM impersonating another user
    ... When I call LogonUser, it fails, I think because the domain I need to log ... the local domain it works fine - I become the other user when I impersonate ... This can be done by calling "CoInitializeSecurity" using PInvoke, ... IntPtr asAuthSvc, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Remote call to COM impersonating another user
    ... This can be done by calling "CoInitializeSecurity" using PInvoke, when calling CoInitializeSecurity you'll have to set "DynamicCloaking" and the "Impersonate" level for proxies in order to be able to impersonate the "caller" at the server. ... IntPtr asAuthSvc, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Security and file permissions....
    ... I use the following class to impersonate a user in one of my programs. ... public static bool Impersonate(string logon, string password, string ... IntPtr tokenDuplicate = IntPtr.Zero; ... public static extern int LogonUser( ...
    (microsoft.public.dotnet.languages.vb)
  • Re: LogonUser issues
    ... > of the local machine, it tries to impersonate me, not the credentials I ... > string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr ... The clone will be used to access local resources while the secondary token ... LOGON32_PROVIDER_WINNT50 a logon provider to make sure negotiate is used ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Impersonating as another user to alter ACLs
    ... IntPtr (pointer) to that token. ... (Be sure to wrap this entire operation in a trycatchfinally ... Once the Impersonate function suceeds, ...
    (microsoft.public.dotnet.framework)