Win32 LogonUser 函数需要什么权限?

发布于 2024-12-10 19:24:48 字数 81 浏览 0 评论 0原文

假设我想在代码中为具有 uid Bob 的用户运行 LogonUser 函数,那么 Bob 必须拥有什么权限才能调用此函数以 Bob 身份成功登录?

Suppose that I want to run the LogonUser function in my code for a user with uid Bob, what permissions must Bob have for me to be able to call this function to log in as Bob successfully?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

放赐 2024-12-17 19:24:48

我不知道是否有一个列表,因为安全系统的某些部分可以使用自定义“插件”(身份验证包安全支持提供商接口/安全包GINA/凭据提供程序)他们可能还有其他要求。

在默认系统上,它可能是这样的:

  • 传递给 LogonUser 的指定用户帐户需要 SE_*_LOGON_NAME 与登录类型 (LOGON32_LOGON_*) 和登录需求相匹配的帐户权限通过LSA和/或域控制器要求(登录时间、密码未过期等)
  • 调用LogonUser的进程需要SE_CHANGE_NOTIFY_NAME(默认情况下每个人都有这个),也许SE_TCB_NAME(Win2000上必需)。如果您要在返回的令牌上调用 CreateProcessAsUser,您还需要 SE_INCREASE_QUOTA_NAME,也许还需要 SE_ASSIGNPRIMARYTOKEN_NAME...

如果您只想以另一个用户身份启动进程,您可能需要使用 CreateProcessWithLogonW,如果您只想验证凭据此知识库文章 a> 有一个不使用 LogonUser 的代码示例(不过,它似乎可能存在一些来宾帐户问题)

I don't know if there is a list anywhere since parts of the security system can use custom "plugins" (Authentication Packages, Security Support Provider Interface/Security packages and GINA/Credential Providers) and they might have other requirements.

On a default system it probably goes something like this:

  • The named user account passed to LogonUser needs the SE_*_LOGON_NAME account right that matches the logon type (LOGON32_LOGON_*) and the logon needs to pass the LSA and/or domain controller requirements (Logon hours, password not expired etc)
  • The process calling LogonUser needs SE_CHANGE_NOTIFY_NAME (Everyone has this by default), maybe SE_TCB_NAME (Required on Win2000). If you are going to call CreateProcessAsUser on the returned token you also need SE_INCREASE_QUOTA_NAME and maybe SE_ASSIGNPRIMARYTOKEN_NAME...

If you just want to start a process as another user you might want to use CreateProcessWithLogonW, if you just want to validate the credentials this KB article has a code example that does not use LogonUser (It seems like it might have some guest account issues though)

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文