WindowsIdentity non current

[Varangian]

Hello

how do I get a WindowsIdentity on a machine other than the
GetCurrent(); ?

 

[Nicholas Paldino [.NET/C# MVP]]

Varangian,

Take a look at the about documentation for the
WindowsImpersonationContext object. There is a code example on how to
impersonate another user using the Impersonate method on the WindowsIdentity
class.

Hope this helps.

 

[Vadym Stetsyak]

Hello, Varangian!

You can use LogonUser API.

It will look in this way:
- you call LogonUser win32 function via P/Invoke and obtain user token
- instantiate WindowsIdentity and pass obtained token


You wrote on 18 Dec 2006 07:06:02 -0800:

V> Hello

V> how do I get a WindowsIdentity on a machine other than the
V> GetCurrent(); ?

With best regards, Vadym Stetsyak. E-mail: (e-mail address removed)

 

[Varangian]

ok thanks for the reply....

what if I need to manipulate the local Administation group? I'm on the
right track using the method you said?

Thanks!

Varangian,

Take a look at the about documentation for the
WindowsImpersonationContext object. There is a code example on how to
impersonate another user using the Impersonate method on the WindowsIdentity
class.

Hope this helps.


--
- Nicholas Paldino [.NET/C# MVP]
- (e-mail address removed)

Hello

how do I get a WindowsIdentity on a machine other than the
GetCurrent(); ?

 

[Willy Denoyette [MVP]]

ok thanks for the reply....

what if I need to manipulate the local Administation group? I'm on the
right track using the method you said?

Please be more explicit, what exactly are you trying to achieve? What exactly do you mean by
"manipulate the local Administrators group"? If by manipulate you mean "create, remove or
update" local administrator accounts, you will need to use the System.Directory namespace
classes.


Willy.

 

[Varangian]

Basically it worked .. I used the LoginUser DllImport "advapi32.dll". I
got another username using LoginUser and then taking its Token.

however now I need to check if that User exists in a Role - like
adminiistrators and if doesn't exist add it to that Group...

WindowsIdentity seem to have a collection Group of IdentityReference
however the actual Groups seem to be either encrypted and dunno how to
get that name

thats what I want to achieve..
Thanks!

 

[Vadym Stetsyak]

Hello, Varangian!

They are not encrypted, value you're observing is SID (security identifier).
To obtain readable name of that IdentityReference you have to translate it.

This can be done with code like this:

WindowsIndetity wIdent; //contains specific identity
//iterate over groups identity is member of
foreach(IdentityReference identRef in wIdent.Groups)
{
//now to obtain readable name we'll convert IdentityReference into
NTAccount
NTAccount account = (NTAccount)identRef.Translate(typeof(NTAccount));

//account has a readable name of that SID.
}

To Add user to windows group you can use NetGroupAddUser win32 function.

HTH


You wrote on 19 Dec 2006 00:13:32 -0800:

V> however now I need to check if that User exists in a Role - like
V> adminiistrators and if doesn't exist add it to that Group...

V> WindowsIdentity seem to have a collection Group of IdentityReference
V> however the actual Groups seem to be either encrypted and dunno how to
V> get that name

V> thats what I want to achieve..
V> Thanks!

V> Willy Denoyette [MVP] wrote:
??>> ??>>> ok thanks for the reply....
??>>>
??>>> what if I need to manipulate the local Administation group? I'm on
??>>> the right track using the method you said?
??>>
??>> Please be more explicit, what exactly are you trying to achieve? What
??>> exactly do you mean by "manipulate the local Administrators group"? If
??>> by manipulate you mean "create, remove or update" local administrator
??>> accounts, you will need to use the System.Directory namespace classes.
??>>

With best regards, Vadym Stetsyak. E-mail: (e-mail address removed)

 

[Varangian]

oh nice man thanks very much for your help.

I'll search for "NetGroupAddUser" must be a function from DllImport..

 

[Willy Denoyette [MVP]]

oh nice man thanks very much for your help.

I'll search for "NetGroupAddUser" must be a function from DllImport..

Don't do this, there is no need to PInvoke "NetGroupAddUser", the FCL includes a namespace
"System.DirectoryServices" which is specicially designed for this.

Following snip shows you how you can search a local account and add it to the administrators
group if found...

....
string userToAdd = "xxxxx"; // user to add to "administrators"
using (DirectoryEntry AD = new DirectoryEntry("WinNT://" +
Environment.MachineName + ",computer"))
{
try
{
using (DirectoryEntry user = AD.Children.Find(userToAdd, "user"))
{
using (DirectoryEntry grp = AD.Children.Find("Administrators", "group"))
{
if (grp != null)
grp.Invoke("Add", new object[] { user.Path.ToString() });
}
}
}
catch (System.Runtime.InteropServices.COMException e)
{ Console.WriteLine(e.Message); }
}
}



Willy.