LogonUser failed with error code : 1314

[Lee Simpson]

Im trying to programmatically authenticate a user against NT under windows
2000. I use the LogonUser API. Realizing that the call needs SYSTEM
privileges, I created a COM+ component and run it under the administrator
user. However, I still get the above error!. I have even checked
WindowsIdentity.GetCurrent().Name and it returns administrator.

ps: it works on my machine (windows xp pro)

Any feedback greatly appreciated.
Lee

 

[Lee Simpson]

Solved my problem, and am posting the code here for others to benefit...

using System.Management;
using System.Runtime.InteropServices;

public enum LogonType : int
{
LOGON32_LOGON_INTERACTIVE = 2,
LOGON32_LOGON_NETWORK = 3,
LOGON32_LOGON_BATCH = 4,
LOGON32_LOGON_SERVICE = 5,
LOGON32_LOGON_UNLOCK = 7,
LOGON32_LOGON_NETWORK_CLEARTEXT = 8, // Only for Win2K or higher
LOGON32_LOGON_NEW_CREDENTIALS = 9 // Only for Win2K or higher
};

public enum LogonProvider : int
{
LOGON32_PROVIDER_DEFAULT = 0,
LOGON32_PROVIDER_WINNT35 = 1,
LOGON32_PROVIDER_WINNT40 = 2,
LOGON32_PROVIDER_WINNT50 = 3
}
;
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool LogonUser(String lpszUsername, String lpszDomain,
String lpszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr TokenHandle);

public bool Login(string Domain, string UserName, string Password)
{
ManagementObject mo = new ManagementObject(new ManagementPath( ));
mo.Scope.Options.EnablePrivileges = true;

IntPtr tokenHandle = IntPtr.Zero;
return LogonUser(
UserName,
Domain,
Password,
(int)LogonType.LOGON32_LOGON_INTERACTIVE,
(int)LogonProvider.LOGON32_PROVIDER_DEFAULT,
ref tokenHandle);
}

The magic happens here:
ManagementObject mo = new ManagementObject(new ManagementPath( ));
mo.Scope.Options.EnablePrivileges = true;
It enables the TCB privilege for you to execute the LogonUser command. I
chose to use WMI, as it saves around 9 API calls.

Lee Simpson