Determine Local Logged On UserName From Service

[Jm]

Hi All

Is it possible to determine who is logged onto a machine from inside a
service using code in vb.net ? I have found some code that seems to work
under vb6, but doesnt under .NET ? Any help is greatly appreciated

Thanks

 

[Guest]

Try this

Dim nc As System.Security.Principal.WindowsIdentity =
System.Security.Principal.WindowsIdentity.GetCurrent

Debug.WriteLine(nc.Name)

Sachin Gusain

 

[Jay B. Harlow [MVP - Outlook]]

Jm,

Is it possible to determine who is logged onto a machine from inside a
service using code in vb.net ?

I take it you mean the interactive user logged in & not the account the
service is running under.

I'm sure its possible, however I don't know how...

I have found some code that seems to work
under vb6, but doesnt under .NET ?

Can you post your VB6 code and your attempted .NET code I suspect there may
be a problem with your Declare statements, hence its not working.

Hope this helps
Jay

 

[Jm]

Hi Sachin

That code returns NT AUTHORITY SYSTEM which isnt what i needed unforunately.
I need the code to return the loged on user outside of the service

 

[Jm]

Yes thats right

Jm,
I take it you mean the interactive user logged in & not the account the
service is running under.

I'm sure its possible, however I don't know how...

Can you post your VB6 code and your attempted .NET code I suspect there may
be a problem with your Declare statements, hence its not working.

Hope this helps
Jay

 

[Jay B. Harlow [MVP - Outlook]]

Jm,
As I stated in my initial post:
Hope this helps
Jay

 

[Jm]

Hi Jay

Well there is fair bit of code here but here goes, first the vb6 code

****
API
****

Public Const NERR_SUCCESS As Long = 0&
Public Const MAX_PREFERRED_LENGTH As Long = -1
Public Const ERROR_MORE_DATA As Long = 234&
Public Const LB_SETTABSTOPS As Long = &H192

Public Type WKSTA_USER_INFO_0
wkui0_username As Long
End Type

Public Type WKSTA_USER_INFO_1
wkui1_username As Long
wkui1_logon_domain As Long
wkui1_oth_domains As Long
wkui1_logon_server As Long
End Type

Public Declare Function NetWkstaUserEnum Lib "netapi32" (ByVal servername As
Long, ByVal level As Long, bufptr As Long, ByVal prefmaxlen As Long,
entriesread As Long, totalentries As Long, resume_handle As Long) As Long
Public Declare Function NetApiBufferFree Lib "netapi32" (ByVal Buffer As
Long) As Long
Public Declare Function lstrlenW Lib "kernel32" (ByVal lpString As Long) As
Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal
hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As
Long

Public Const GWL_WNDPROC = (-4)
Public Const WM_ENDSESSION = &H16
Public Const WM_QUERYENDSESSION = &H11

Public WndProc As Long

Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal
lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal Msg As Long, ByVal wParam
As Long, ByVal lParam As Long) As Long
Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal
hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long

Public Const TH32CS_SNAPPROCESS As Long = 2&
Public Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * MAX_PATH
End Type

Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal
lFlags As Long, ByVal lProcessID As Long) As Long
Public Declare Function ProcessFirst Lib "kernel32" Alias "Process32First"
(ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Public Declare Function ProcessNext Lib "kernel32" Alias "Process32Next"
(ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
This is the vb.net code, i changed the API from a type to a structure only

****
CODE
****

Public Sub GetLocalUsr()


' Retrieve Locally Logged On User


Dim bufptr As Long
Dim dwServer As Long
Dim dwEntriesread As Long
Dim dwTotalentries As Long
Dim dwResumehandle As Long
Dim nStatus As Long
Dim nStructSize As Long
Dim Cnt As Long
Dim bServer As String
Dim wui1 As WKSTA_USER_INFO_1

bServer = "\\" & Environ$("COMPUTERNAME") & vbNullString
dwServer = StrPtr(bServer)

Do

nStatus = NetWkstaUserEnum(dwServer, 1, bufptr, MAX_PREFERRED_LENGTH,
dwEntriesread, dwTotalentries, dwResumehandle)

If nStatus = NERR_SUCCESS Or nStatus = ERROR_MORE_DATA Then

If dwEntriesread > 0 Then

nStructSize = LenB(wui1)

For Cnt = 0 To dwEntriesread - 1
CopyMemory wui1, ByVal bufptr + (nStructSize * Cnt),
nStructSize
CurrUsr = GetPointerToByteStringW(wui1.wkui1_username)
Next

End If
Else

End If

Loop While nStatus = ERROR_MORE_DATA

Call NetApiBufferFree(bufptr)

If LocUsr <> CurrUsr Then
If Right(CurrUsr, 1) <> "$" Then
LocUsr = CurrUsr
End If
End If

DoEvents

End Sub

***
API
****
Public Const NERR_SUCCESS As Long = 0&
Public Const MAX_PREFERRED_LENGTH As Long = -1
Public Const ERROR_MORE_DATA As Long = 234&
Public Const LB_SETTABSTOPS As Long = &H192
Public Structure WKSTA_USER_INFO_0
Public wkui0_username As Long
End Structure
Public Structure WKSTA_USER_INFO_1
Public wkui1_username As Long
Public wkui1_logon_domain As Long
Public wkui1_oth_domains As Long
Public wkui1_logon_server As Long
End Structure
Public Declare Function NetWkstaUserEnum Lib "netapi32" (ByVal servername As
Long, ByVal level As Long, ByVal bufptr As Long, ByVal prefmaxlen As Long,
ByVal entriesread As Long, ByVal totalentries As Long, ByVal resume_handle
As Long) As Long
Public Declare Function NetApiBufferFree Lib "netapi32" (ByVal Buffer As
Long) As Long
Public Declare Function lstrlenW Lib "kernel32" (ByVal lpString As Long) As
Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal
hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Any)
As Long
Public Const GWL_WNDPROC = (-4)
Public Const WM_ENDSESSION = &H16
Public Const WM_QUERYENDSESSION = &H11
Public WndProc As Long
Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal
lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal Msg As Long, ByVal wParam
As Long, ByVal lParam As Long) As Long
Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal
hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Public Const TH32CS_SNAPPROCESS As Long = 2&
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal
Destination As Any, ByVal Source As Any, ByVal Length As Long)
****
Now the Code
****

Public Function GetPointerToByteStringW(ByVal dwData As Long) As String
' Convert UserName
Dim tmp() As Byte
Dim tmplen As Long
If dwData <> 0 Then
tmplen = lstrlenW(dwData) * 2
If tmplen <> 0 Then
ReDim tmp(0 To (tmplen - 1)) As Byte
CopyMemory tmp(0), ByVal dwData, tmplen
GetPointerToByteStringW = tmp
End If
End If
End Function

Public Function DetectLocalLogonName() As String
' Retrieve Locally Logged On User
Dim bufptr As Long
Dim dwServer As Long
Dim dwEntriesread As Long
Dim dwTotalentries As Long
Dim dwResumehandle As Long
Dim nStatus As Long
Dim nStructSize As Long
Dim Cnt As Long
Dim bServer As String
Dim wui1 As WKSTA_USER_INFO_1
Dim CurrUsr As String
Dim LocUsr As String


bServer = "\\" & Environ$("COMPUTERNAME") & vbNullString
dwServer = StrPtr(bServer)
Do
nStatus = NetWkstaUserEnum(dwServer, 1, bufptr, MAX_PREFERRED_LENGTH,
dwEntriesread, dwTotalentries, dwResumehandle)
If nStatus = NERR_SUCCESS Or nStatus = ERROR_MORE_DATA Then
If dwEntriesread > 0 Then
nStructSize = LenB(wui1)
For Cnt = 0 To dwEntriesread - 1
CopyMemory wui1, ByVal bufptr + (nStructSize * Cnt), nStructSize
CurrUsr = GetPointerToByteStringW(wui1.wkui1_username)
Next
End If
Else
End If
Loop While nStatus = ERROR_MORE_DATA
Call NetApiBufferFree(bufptr)
If LocUsr <> CurrUsr Then
If Right(CurrUsr, 1) <> "$" Then
LocUsr = CurrUsr
DetectLocalLogonName = CurrUsr
End If
End If


Well thats the code as it stands so far. Under .NET the problems occur in

GETPOINTERTOBYTESTRINGW

at

CopyMemory tmp(0), ByVal dwData, tmplen
GetPointerToByteStringW = tmp

the tmp(0) says 'Method arguements must be enclosed in paranthesis' and the
ByVal says 'expression exprected
finally the = tmp on the bottom line says 'Value of type 1-dimensional array
of byte cannot be converted to string


DETECTLOCALLOGONNAME

at

dwServer = StrPtr(bServer)

the strptr says ' name not declared'

at

nStructSize = LenB(wui1)

the LenB says 'name not decalred'

at

CopyMemory wui1, ByVal bufptr + (nStructSize * Cnt), nStructSize

the wui1 says 'Method arguements must be enclosed in paranthesis'
and the ByVal says expression expected



Im assuming its like you said that variable names are not defined properly,
but im not sure what to define them as. Any help is greatly appreciated

 

[Jay B. Harlow [MVP - Outlook]]

Jm,
Lots of little problems. The ones I've noticed include:

***
API
****
Public Const NERR_SUCCESS As Long = 0&
Public Declare Function NetWkstaUserEnum Lib "netapi32" (ByVal servername
As
Long, ByVal level As Long, ByVal bufptr As Long, ByVal prefmaxlen As Long,
ByVal entriesread As Long, ByVal totalentries As Long, ByVal resume_handle
As Long) As Long

Under VB.NET: Short is 16Bit, Integer is 32Bit, and Long is 64Bit. In some
cases where you are using a Long/Integer for a pointer (such as the
servername above) you should define those pointers as System.IntPtr or
better still as String. bufptr I would define as ByRef Byte(), a byte array,
while the last three parameters I would define as ByRef Integer as they are
returning values.

For Example:

Public Structure WKSTA_USER_INFO_0
Public wkui0_username As IntPtr
End Structure

Public Structure WKSTA_USER_INFO_1
Public wkui1_username As IntPtr
Public wkui1_logon_domain As IntPtr
Public wkui1_oth_domains As IntPtr
Public wkui1_logon_server As IntPtr
End Structure

However seeing as they are actualy strings, you might be able to define them
as such. Note, in this instance they may need a
System.Runtime.InteropeServices.MarshalAsAttribute to indicate the type of
String they are

Public Structure WKSTA_USER_INFO_0
Public wkui0_username As String
End Structure

CopyMemory tmp(0), ByVal dwData, tmplen
GetPointerToByteStringW = tmp

CopyMemory is not a "valid" operation under VB.NET! Strings are managed
totally different! Based on a quick look, you should be able to replace
GetPointerToByteStringW with one of the
System.Runtime.InteropServices.Marshal.PtrToString* methods (such as
Marshal.PtrToStringUni)

dwServer = StrPtr(bServer)

Again StrPtr is not a "valid" operation under VB.NET! Strings are managed
totally different! Normally I simply define the API with String as the
parameter type & the marshaller will work it out for itself...

I will try (try) to look at this later, post back here if you get it working
or need more help. The microsoft.public.dotnet.framework.interop newsgroup
has a number of people that do interop a lot, and might provide quicker
help...

Hope this helps
Jay

 

[Jay B. Harlow [MVP - Outlook]]

Jm,
Try the following:

Public Const NERR_SUCCESS As Integer = 0&
Public Const MAX_PREFERRED_LENGTH As Integer = -1
Public Const ERROR_MORE_DATA As Integer = 234&

Public Structure WKSTA_USER_INFO_0
<MarshalAs(UnmanagedType.LPTStr)> Public wkui0_username As String
End Structure

Public Structure WKSTA_USER_INFO_1
<MarshalAs(UnmanagedType.LPTStr)> Public wkui1_username As String
<MarshalAs(UnmanagedType.LPTStr)> Public wkui1_logon_domain As
String
<MarshalAs(UnmanagedType.LPTStr)> Public wkui1_oth_domains As String
<MarshalAs(UnmanagedType.LPTStr)> Public wkui1_logon_server As
String
End Structure

Public Declare Auto Function NetWkstaUserEnum Lib "netapi32" ( _
ByVal servername As String, ByVal level As Integer, _
ByRef buffer As IntPtr, ByVal prefMaxLen As Integer, _
ByRef entriesRead As Integer, ByRef totalEntries As Integer, _
ByRef resumeHandle As Integer) As Integer

Public Declare Auto Function NetApiBufferFree Lib "netapi32" (ByVal
buffer As IntPtr) As Long



Public Shared Function DetectLocalLogonName() As String
' Retrieve Locally Logged On User
Dim server As String = "\\" & Environment.MachineName
Dim bufptr As IntPtr

Dim dwEntriesread As Integer
Dim dwTotalentries As Integer
Dim dwResumehandle As Integer
Dim nStatus As Integer

Dim nStructSize As Integer =
Marshal.SizeOf(GetType(WKSTA_USER_INFO_1))
Dim Cnt As Integer

Dim wui1 As WKSTA_USER_INFO_1

Dim CurrUsr As String
Dim LocUsr As String


Do
nStatus = NetWkstaUserEnum(server, 1, bufptr,
MAX_PREFERRED_LENGTH, dwEntriesread, dwTotalentries, dwResumehandle)
If nStatus = NERR_SUCCESS Or nStatus = ERROR_MORE_DATA Then
If dwEntriesread > 0 Then
For Cnt = 0 To dwEntriesread - 1
Dim ptr As New IntPtr(bufptr.ToInt64() + Cnt *
nStructSize)
wui1 = DirectCast(Marshal.PtrToStructure(ptr,
GetType(WKSTA_USER_INFO_1)), WKSTA_USER_INFO_1)
CurrUsr = wui1.wkui1_username
Next
End If
Else
End If
Loop While nStatus = ERROR_MORE_DATA
NetApiBufferFree(bufptr)
If LocUsr <> CurrUsr Then
If Not CurrUsr.EndsWith("$") Then
LocUsr = CurrUsr
DetectLocalLogonName = CurrUsr
End If
End If

End Function

Hope this helps
Jay

 

[Jm]

Hi Jay

Thanks for all your help with this. I attempted using the code you posted,
but it says that 'type MarshalAs is not defined' ? I thought i might need to
add an imports system.runtime.interopservices.marshal but it did not help.
Im guessing it something easy that im missing. Also at the line

Dim ptr As New IntPtr(bufptr.ToInt64() + Cnt * nStructSize)

VB says that nStructSize isnt defined, so i was wondering what to define it
as. Once again thanks so much for your help with this

 

[Jm]

Hi Jay

Figured out the problem, my fault when i copied and pasted the code from the
post, and i figured out i put to much into the imports statement. So i
changed it back and it works a treat. Thanks once again for all your help it
is greatly appreciated.

 

[Jm]

Hi Jay

I know this is a little off topic but ive asked this question in other
newsgroups and didnt get a solution. You seem to know this stuff pretty well
so i was hoping you may be able to help. Im using this code in .net

Public Type MIB_TCPROW
dwState As Long
dwLocalAddr As Long
dwLocalPort As Long
dwRemoteAddr As Long
dwRemotePort As Long
End Type

Public Type MIB_TCPTABLE
dwNumEntries As Long
table(100) As MIB_TCPROW
End Type

Public MIB_TCPTABLE As MIB_TCPTABLE

Public Declare Function GetTcpTable Lib "iphlpapi.dll" (ByRef pTcpTable As
MIB_TCPTABLE, ByRef pdwSize As Long, ByVal bOrder As Long) As Long
Public Declare Function SetTcpEntry Lib "IPhlpAPI" (pTcpRow As MIB_TCPROW)
As Long
Public Declare Function ntohs Lib "WSOCK32.DLL" (ByVal netshort As Long) As
Long


Public Sub BlockPort(Port As String)


' Port Blocking Function


Dim LTmp As Long
Dim x As Integer, i As Integer, n As Integer
Dim RemP As String
Dim tcpt As MIB_TCPTABLE

LTmp = Len(MIB_TCPTABLE)
GetTcpTable tcpt, LTmp, 0
x = tcpt.dwNumEntries

For i = 0 To tcpt.dwNumEntries - 1

RemP = ntohs(tcpt.table(i).dwRemotePort)

If RemP = Port And tcpt.table(i).dwState <> 2 Then
tcpt.table(i).dwState = 12
SetTcpEntry tcpt.table(i)
End If

Next i

End Sub

Ive changed the types to structures and changed their data types from long
to integer and changed all refernces from long to integer. I also modified
the public decalre line for MIB_TCPTABLE and tcpt declarartion so they are:

Public CodeMIB_TCPTABLE As MIB_TCPTABLE
Dim tcpt As CodeMIB_TCPTABLE

But once problem remains on this line

Public table(100) As MIB_TCPROW

Which is inside the MIB_TCPTABLE structure, which says ' Arrays declared as
structure members cannot be declared with an initial size'. I tried removing
the 100 and the code runs but it does not block the traffic, so im guessing
i need to put somewhere in the code the size that the table should be but i
wouldnt have a clue where. Any help you can give is greatly appreciated

Thanks

 

[Jay B. Harlow [MVP - Outlook]]

Jm,

Which is inside the MIB_TCPTABLE structure, which says ' Arrays declared
as
structure members cannot be declared with an initial size'. I tried
removing
the 100 and the code runs but it does not block the traffic, so im
guessing
i need to put somewhere in the code the size that the table should be but
i
wouldnt have a clue where. Any help you can give is greatly appreciated

You can either define the array after you declare the variable.

Public MIB_TCPTABLE As MIB_TCPTABLE

ReDim MIB_TCPTABLE.table(100)

Of course the ReDim needs to be inside of a method.


Or you can add a constructor to MIB_TCPTABLE to ensure the variable is
initialized:

Public Type MIB_TCPTABLE
dwNumEntries As Long
table() As MIB_TCPROW

Public Sub New(ByVal numEntries As Long)
dwNumEntries = NumEntries
Redim table(numEntries - 1)
End Sub

End Type

Then be certain to call the constructor when you need to initialize the
structure

Public MIB_TCPTABLE As New MIB_TCPTABLE(100)

Because its a Structure a default constructor is always supplied that will
initialize all the member fields to zero or Nothing.

However if MIB_TCPTABLE is being returned from an API, then you need to use
some special marshalling attributes to let the marshaller know the size of
things.

Hope this helps
Jay

 

[Jm]

Hi Jay

Thanks for the quick reply. I tried using the constructor as you said in
your post but unfortunately still didnt work, the annoying this is that you
dont get an error, it just doesnt block any traffic. This is the code as it
is now:

Public Structure MIB_TCPROW
Public dwState As Long
Public dwLocalAddr As Long
Public dwLocalPort As Long
Public dwRemoteAddr As Long
Public dwRemotePort As Long
End Structure
Public Structure MIB_TCPTABLE
Public dwNumEntries As Long
Public table() As MIB_TCPROW
Public Sub New(ByVal numEntries As Long)
dwNumEntries = numEntries
ReDim table(numEntries - 1)
End Sub
End Structure
Public CodeMIB_TCPTABLE As New MIB_TCPTABLE(100)
Public Declare Function GetTcpTable Lib "iphlpapi.dll" (ByRef pTcpTable As
MIB_TCPTABLE, ByRef pdwSize As Long, ByVal bOrder As Long) As Long
Public Declare Function SetTcpEntry Lib "IPhlpAPI" (ByVal pTcpRow As
MIB_TCPROW) As Long
Public Declare Function ntohs Lib "WSOCK32.DLL" (ByVal netshort As Long) As
Long

Public Shared Sub main()
Dim fr As New Form1
fr.ShowDialog()
End Sub
Public Sub Port()

' Port Blocking Function

Dim LTmp As Long
Dim x As Long, i As Long, n As Long
Dim RemP As String
Dim tcpt As MIB_TCPTABLE
LTmp = Len(CodeMIB_TCPTABLE)
GetTcpTable(tcpt, LTmp, 0)
x = tcpt.dwNumEntries
For i = 0 To tcpt.dwNumEntries - 1
RemP = ntohs(tcpt.table(i).dwRemotePort)
If RemP = "8080" And tcpt.table(i).dwState <> 2 Then
tcpt.table(i).dwState = 12
SetTcpEntry(tcpt.table(i))
End If
Next i
End Sub

Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles Timer1.Tick
Call Port()
End Sub
End Class

I wasnt sure whether to change all reference to long to integer in the code
so i left it. Basically the code runs on a timer set to interval of 200 so
it runs constantly when the timer is enabled, forcing the traffic to be
dropped (Well under vb6 anyhow). You said i may need to use some marshalling
somewhere in the code ? Im not sure what you meant by that