Re: WindowsIdentity.Impersonate() vs ImpersonateLoggedOnUser()

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Willy Denoyette [MVP] (willy.denoyette_at_pandora.be)
Date: 02/22/05 

Date: Wed, 23 Feb 2005 00:49:33 +0100

See inline ***

Willy.

"BLiTZWiNG" <BLiTZWiNG@discussions.microsoft.com> wrote in message
news:FBF2AE74-5B9D-40C4-8528-2507A1314ECA@microsoft.com...
> To answer your questions:
>
> I refer to the DLL import functions as unmanaged, though this is probably
> incorrect to do so. So LogonUser, ImpersonateLoggedOnUser and RevertToSelf
> I
> refer to as unmanaged, and the .NET classes as managed.
>
*** No problem, just to be sure we are talking about the same thing.

> The OS I am connecting to is Windows 2003 Server in all cases. I assume
> the
> server is setup in a valid manner as I can copy files to it from my
> machine
> but only if I use unmanaged (I should start referring to it as imported)
> code.
>
> Note that I have since modified my code in the posted example to better
> handle the errors returned.
>
> Ok, structured test results:
>
> When calling LogonUser with LOGON32_LOGON_NETWORK (3) or
> LOGON32_LOGON_NETWORK_CLEARTEXT (8) and either 0 or 3 as the provider, the
> code fails at LogonUser with GetLastWin32Error being 1326 (Logon failure).
>

> When using a WindowsIdentity class and calling LogonUser with
> LOGON32_LOGON_NEW_CREDENTIALS (9) and either 0 or 3 as the provider, the
> code
> fails on WindowsIdentity.Impersonate(). The error code from
> GetLastWin32Error
> is 0, and the exception message is "Unable to impersonate user" on Windows
> XP. On Windows 2000 Professional the code fails at LogonUser with error
> code
> 1314 "A required privilege is not held by the client."

***
1. Not sure why WindowsIdentity.Impersonate(). works for me on XP SP2
running .NET v1.1 SP1, will try to investigate why it throws on you. Note
that LogonUser didn't fail, but aparantly Impersonate doesn't like the token
returned.
2. Windows 2000 needs the "Act as part of the operating system" privilege
(also called TCB privilege) in order to call LogonUser, this super privilege
is no longer required on XP and W2K3. This is very unfortunate, but unless
you are willing to spend some hard time to interop with the SSP API's there
is no other way to call LogonUser than enabling the TCB privilege for the
calling user account..

>
> When using DLL imported code ImpersonateLoggedOnUser and calling LogonUser
> with LOGON32_LOGON_NEW_CREDENTIALS (9) and either 0 or 3 as the provider,
> the
> code succeeds at copying the file on Windows XP. On Windows 2000
> Professional
> the code fails at LogonUser with error code 1314 "A required privilege is
> not
> held by the client."

*** See above for privilege error on W2K.
>
> This is the latest set of results, which now seem to be consistent as this
> whole testing process has had to suffer my learning curve. I was
> previously
> getting different errors on the 2k pro box, but it seems now that I know I
> need to use (9) that I can consistently get 1314 at LogonUser, which if I
> could fix would solve my immediate issue of needing to get the code
> working.
> However I still don't understand why WindowsIdentity.Impersonate() always
> fails.

*** To resume:
- Call LogonUser with Logontype 9 and preferaby specifying the Kerberos
authentication provider (3).
- Add user account to the TCB when running your code on W2K :-(

>
> Thanks.
>
> "Willy Denoyette [MVP]" wrote:

Relevant Pages

  • Re: CreateProcessAsUser, error code 6
    ... >> As long as the user I use with LogonUser is in the administrators ... >> administrators group, the exitcode that comes from GetExitCodeProcess ... > calling process does not have this privilege, ... CreateProcessasUser fails. ...
    (microsoft.public.platformsdk.security)
  • Re: How to Validate User Credentials on Windows 2000 OS?
    ... On the other hand, in Windows 2000, LogonUser requires this privilege. ... The net result is that you cannot use LogonUser on Windows 2000 except from the code running as LocalSystem. ... it answers exactly your question: how to validate user credentials in Windows 2000. ...
    (microsoft.public.platformsdk.security)
  • Re: Change process user for app in VB 6
    ... Windows 2000, and under 2000 LogOnUser requires 'Act as part of opperating ... system' privilege. ... > Dim blnResult As Boolean ...
    (microsoft.public.vb.winapi)
  • Re: Detecting Admin Privileges Via Code
    ... I didn't bother checking in my code to see if I had SE_TCB_NAME privilege, I just called LogonUser. ... As a result, when Windows 2003 came out, and didn't have that restriction, my code just plain worked exactly the same. ... Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers. ...
    (microsoft.public.security)
  • Re: CreateProcessAsUser Doubt
    ... I have a problem with windows 2000. ... I need to execute this program to give SE_TCB_NAME privilege to execute ... LogonUser and become administrator user. ...
    (microsoft.public.platformsdk.security)