Impersonate and LogonUser()

S

schaf

Hi NG !
I used the examples on the internet to create a Impersonate class which
allows me to log on as another user. After logged on as the new user I
could access files on a remote computer, which is in the same domain.
So I tried the same on a computer which is not in the same domain. I
could not access these files.
I saw this in the MSDN:
"You cannot use LogonUser to log on to a remote computer"

So now I'm a little confused. It is written, that LogonUser attempts to
log on on the local computer. Why I could access the remote computer in
the first case and why I could not in the second ?

What I would like to do I to connect to a remote computer (not in the
same domain) and start and stop there a service.

Thanks and regards
Marcel (Schaf)
 
T

Tom Spink

schaf said:
Hi NG !
I used the examples on the internet to create a Impersonate class which
allows me to log on as another user. After logged on as the new user I
could access files on a remote computer, which is in the same domain.
So I tried the same on a computer which is not in the same domain. I
could not access these files.
I saw this in the MSDN:
"You cannot use LogonUser to log on to a remote computer"

So now I'm a little confused. It is written, that LogonUser attempts to
log on on the local computer. Why I could access the remote computer in
the first case and why I could not in the second ?

What I would like to do I to connect to a remote computer (not in the
same domain) and start and stop there a service.

Thanks and regards
Marcel (Schaf)

Hi Schaf,

Presumably, when you called LogonUser in your domain, you were authenticated
across the domain, and inherited all the access rights specific to your
account. So you can access remote files, on computers in the domain your
authenticated in, so long as your account has the necessary permissions.

-- Tom Spink
 
S

schaf

Hi Tom !
First thank you for all your help!

This sound good, but how can I connect to the computer which is not in
my domain ?
I tried to call LogonUser with the computername (or IP) as domain
parameter but it did not work. How can I get access to this computer ?
Do I have to write a remote application ?

Thanks and have a nice weekend
Marcel (Schaf)
 
C

chanmm

By right once your logon and password is identical with one of the
registered domain logon you should not have any problem. Have you tried it
using Windows Explorer first?

chanmm
 
S

schaf

HI !
Ohh that sounds good. Yes I do not have any problem, when I try to
connect from the Windows Explorer. So I tried almost every kind of
username password variant, that I'm not shure if it works really.

As domain i tried with: IPAddress (of the host which is not in the
domain), Hostname,

Tried username format like: \\pcname\username, \\ipaddress\username,
username, pcname\username, ipaddress\username....My user is the
administrator

But it still don't work. I allways get the error 1326 !

When you say that it should not be a problem, how do I have to
understand this sentence from the MDSN ? "You cannot use LogonUser to
log on to a remote computer".

Do you have any hint for me how to solve the my challenge to start and
stop a service on another pc which is not in my domain ?. Is it
possible, that the host has a policy or anything like that, what would
it make impossible to connect over the network ?

Thanks
 
W

Willy Denoyette [MVP]

"domain" name must be the "computer" name of the remote host, the
credentials (user name and password) specified,must be these of a local user
on the remote computer.

Say you have:

Alice & Bob as computers, and "UserBob" as local account on Bob with
Password "BobsPwd".
When you need to access Bob from Alice, you need to call LogonUser
specifying "Bob" as domain name, "UserBob" as username and "BobsPwd" as
password. The token returned can be used to impersonate "UserBob" when
accessing resources exposed by Bob.


Willy.


| HI !
| Ohh that sounds good. Yes I do not have any problem, when I try to
| connect from the Windows Explorer. So I tried almost every kind of
| username password variant, that I'm not shure if it works really.
|
| As domain i tried with: IPAddress (of the host which is not in the
| domain), Hostname,
|
| Tried username format like: \\pcname\username, \\ipaddress\username,
| username, pcname\username, ipaddress\username....My user is the
| administrator
|
| But it still don't work. I allways get the error 1326 !
|
| When you say that it should not be a problem, how do I have to
| understand this sentence from the MDSN ? "You cannot use LogonUser to
| log on to a remote computer".
|
| Do you have any hint for me how to solve the my challenge to start and
| stop a service on another pc which is not in my domain ?. Is it
| possible, that the host has a policy or anything like that, what would
| it make impossible to connect over the network ?
|
| Thanks
|
|
|
| > By right once your logon and password is identical with one of the
| > registered domain logon you should not have any problem. Have you tried
it
| > using Windows Explorer first?
| >
| > chanmm
| >
| >
| >
| > | > > Hi Tom !
| > > First thank you for all your help!
| > >
| > > This sound good, but how can I connect to the computer which is not in
| > > my domain ?
| > > I tried to call LogonUser with the computername (or IP) as domain
| > > parameter but it did not work. How can I get access to this computer ?
| > > Do I have to write a remote application ?
| > >
| > > Thanks and have a nice weekend
| > > Marcel (Schaf)
| > >
| > >> schaf wrote:
| > >>
| > >> > Hi NG !
| > >> > I used the examples on the internet to create a Impersonate class
which
| > >> > allows me to log on as another user. After logged on as the new
user I
| > >> > could access files on a remote computer, which is in the same
domain.
| > >> > So I tried the same on a computer which is not in the same domain.
I
| > >> > could not access these files.
| > >> > I saw this in the MSDN:
| > >> > "You cannot use LogonUser to log on to a remote computer"
| > >> >
| > >> > So now I'm a little confused. It is written, that LogonUser
attempts to
| > >> > log on on the local computer. Why I could access the remote
computer in
| > >> > the first case and why I could not in the second ?
| > >> >
| > >> > What I would like to do I to connect to a remote computer (not in
the
| > >> > same domain) and start and stop there a service.
| > >> >
| > >> > Thanks and regards
| > >> > Marcel (Schaf)
| > >>
| > >> Hi Schaf,
| > >>
| > >> Presumably, when you called LogonUser in your domain, you were
| > >> authenticated
| > >> across the domain, and inherited all the access rights specific to
your
| > >> account. So you can access remote files, on computers in the domain
your
| > >> authenticated in, so long as your account has the necessary
permissions.
| > >>
| > >> -- Tom Spink
| > >
|
 
S

schaf

Hi Willy

That sounds very good for me. That means, that it should work, despite
of the MSDN-sentence: "You cannot use LogonUser to log on to a remote
computer".
So I have to check something in the network or on the remote computer
if it does not work ?! I'm going to try it.
Thanks and regards
Marcel
 
W

Willy Denoyette [MVP]

| Hi Willy
|
| That sounds very good for me. That means, that it should work, despite
| of the MSDN-sentence: "You cannot use LogonUser to log on to a remote
| computer".
| So I have to check something in the network or on the remote computer
| if it does not work ?! I'm going to try it.
| Thanks and regards
| Marcel
|

MSDN is correct, there is simply no way to login to a remote (Windows)
computer and this is also not what you are doing when calling LogonUser.
LogonUser only provides a way to get an "access token" that can be used when
one needs to access a resource on a remote machine over the 'network', but
this is not the same as thing as "log on to a remote computer". On Windows,
login sessions are always "machine local" or "domain local".

Willy.
 
S

schaf

HI Willy

Ahh Ok! I see I misunderstood the meaning of LogonUser. Thanks for your
help. So if I've to start and stop a service on the remote computer or
if I would like to copy a file from that computer, than LogonUser is
the right approche to solve this challange ?

Thanks
 
S

schaf

Hi Willy !
I tried again like you wrote. My PC is called PC56 and is in the domain
ABC
The remote PC is called PC20 and is in the workgroup ABCWG. On PC20 the
user administrator exists with the password PC20.
When I call LogonUser with the domain ABCWG and the user administrator
and the password PC20 I still get the error message 1326 (and the
message DuplicateToken failed with error 6)

I do not know why, then I can access the computer with net use under
the same username.

Thanks for hints

Marcel
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top