CredUIPromptForWindowsCredentials (credui.dll) not working Windows 11

Leon Wolf 41

Hello,
i am currently working on a C# project that contains interaction with the credui.dll, calling the CredUIPromptForWindowsCredentials on a secure desktop. When executing on a Windows 10 machine, it all executes the way i want it to, however the same code fails to call up the CredUI and i am then stuck on a secure desktop when executing on Windows 11.
Are there any known bugs about this, or any changes made to Windows 11 that have changed the behaviour of the CredUI?
I haven't found anything on common help sites.

Thank you for your help!

Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-05-30T06:44:16.12+00:00

I successfully used CredUIPromptForWindowsCredentials in win11.
Could you show how you use this function?

Leon Wolf 41

Have you used it in combination with secure desktop?
Heres my function that i use:

public static Credentials? OpenCredentialsPrompt()
        {
            Credentials credential = new();

            IntPtr hOldDesktop = CredentialsPromptHelper.GetThreadDesktop(CredentialsPromptHelper.GetCurrentThreadId());

            IntPtr hNewDesktop = CredentialsPromptHelper.CreateDesktop("SecureDesktop", IntPtr.Zero, IntPtr.Zero, 0, (uint)CredentialsPromptHelper.DESKTOP_ACCESS.GENERIC_ALL, IntPtr.Zero);

            CredentialsPromptHelper.SwitchDesktop(hNewDesktop);

            Task.Factory.StartNew(() =>
            {
                CredentialsPromptHelper.SetThreadDesktop(hNewDesktop);

                CredentialsFormHelper form = new();
                form.FormClosing += (sender, e) =>
                {
                    credential.Username = form.Username;
                    credential.Password = form.Password;

                    if (!form.Successful)
                        credential = null;
                };

                Application.Run(form);
            }).Wait();

            CredentialsPromptHelper.SwitchDesktop(hOldDesktop);

            CredentialsPromptHelper.CloseDesktop(hNewDesktop);

            return credential;
        }

Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-05-30T07:05:07.527+00:00

I don't see where you used CredUIPromptForWindowsCredentialsA, and I can't use the code you provided, Could you please provide a reproducible, runnable code sample. In this way, I can reproduce your problem on my machine and help you solve the problem more quickly.
Leon Wolf 41 Reputation points

2022-05-30T07:21:59.047+00:00

I have trouble uploading my code to this page, do you have an email adress of yours for me so that i can send you the code?

Leon Wolf 41

Maybe if i split up my code it works: 
    public bool GetCredentials(string serverName, IntPtr hwndParent, out NetworkCredential? networkCredential)
            {
                bool save = false;
                int errorcode = 0;
                uint dialogReturn;
                uint authPackage = 0;
                IntPtr outCredBuffer = new IntPtr();
                uint outCredSize;

            CredentialsPromptHelper.CREDUI_INFO credui = new();
            credui.cbSize = Marshal.SizeOf(credui);
            credui.pszCaptionText = "Login";
            credui.pszMessageText = "Bitte geben Sie ihre Logindaten ein!";
            credui.hwndParent = hwndParent;

            dialogReturn = CredentialsPromptHelper.CredUIPromptForWindowsCredentials(ref credui, errorcode, ref authPackage, IntPtr.Zero, 0, out outCredBuffer, out outCredSize, ref save, CredentialsPromptHelper.PromptForWindowsCredentialsFlags.CREDUIWIN_GENERIC);

Leon Wolf 41

var usernameBuf = new StringBuilder(100);
            var passwordBuf = new StringBuilder(100);
            var domainBuf = new StringBuilder(100);

        int maxUserName = 100;
        int maxDomain = 100;
        int maxPassword = 100;

        if (dialogReturn == 0)
        {
            if (CredentialsPromptHelper.CredUnPackAuthenticationBuffer(0, outCredBuffer, outCredSize, usernameBuf, ref maxUserName, domainBuf, ref maxDomain, passwordBuf, ref maxPassword))
            {
                CredentialsPromptHelper.CoTaskMemFree(outCredBuffer);
                networkCredential = new NetworkCredential()
                {
                    UserName = usernameBuf.ToString(),
                    Password = passwordBuf.ToString(),
                    Domain = domainBuf.ToString()
                };
                return true;
            }
        }
        networkCredential = null;
        return false;
    }

Leon Wolf 41

[DllImport("ole32.dll")]
        internal static extern void CoTaskMemFree(IntPtr ptr);

    [DllImport("credui.dll", CharSet = CharSet.Unicode)]
    internal static extern uint CredUIPromptForWindowsCredentials(ref CREDUI_INFO notUsedHere,
        int authError,
        ref uint authPackage,
        IntPtr InAuthBuffer,
        uint InAuthBufferSize,
        out IntPtr refOutAuthBuffer,
        out uint refOutAuthBufferSize,
        ref bool fSave,
        PromptForWindowsCredentialsFlags flags);

    [DllImport("credui.dll", CharSet = CharSet.Auto)]
    internal static extern bool CredUnPackAuthenticationBuffer(int dwFlags,
        IntPtr pAuthBuffer,
        uint cbAuthBuffer,
        StringBuilder pszUserName,
        ref int pcchMaxUserName,
        StringBuilder pszDomainName,
        ref int pcchMaxDomainname,
        StringBuilder pszPassword,
        ref int pcchMaxPassword);

    [DllImport("user32.dll")]
    internal static extern IntPtr CreateDesktop(string lpszDesktop,
        IntPtr lpszDevice,
        IntPtr pDevmode,
        int dwFlags,
        uint dwDesiredAccess,
        IntPtr lpsa);

Leon Wolf 41

[DllImport("user32.dll")]
            internal static extern bool SwitchDesktop(IntPtr hDesktop);

        [DllImport("user32.dll")]
        internal static extern bool CloseDesktop(IntPtr handle);

        [DllImport("user32.dll")]
        internal static extern bool SetThreadDesktop(IntPtr hDesktop);

        [DllImport("user32.dll")]
        internal static extern IntPtr GetThreadDesktop(int dwThreadId);

        [DllImport("kernel32.dll")]
        internal static extern int GetCurrentThreadId();

Leon Wolf 41

internal enum DESKTOP_ACCESS : uint
            {
                DESKTOP_NONE = 0,
                DESKTOP_READOBJECTS = 0x0001,
                DESKTOP_CREATEWINDOW = 0x0002,
                DESKTOP_CREATEMENU = 0x0004,
                DESKTOP_HOOKCONTROL = 0x0008,
                DESKTOP_JOURNALRECORD = 0x0010,
                DESKTOP_JOURNALPLAYBACK = 0x0020,
                DESKTOP_ENUMERATE = 0x0040,
                DESKTOP_WRITEOBJECTS = 0x0080,
                DESKTOP_SWITCHDESKTOP = 0x0100,

                GENERIC_ALL = (DESKTOP_READOBJECTS | DESKTOP_CREATEWINDOW | DESKTOP_CREATEMENU |
                                DESKTOP_HOOKCONTROL | DESKTOP_JOURNALRECORD | DESKTOP_JOURNALPLAYBACK |
                                DESKTOP_ENUMERATE | DESKTOP_WRITEOBJECTS | DESKTOP_SWITCHDESKTOP)
            }


        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        internal struct CREDUI_INFO
        {
            public int cbSize;
            public IntPtr hwndParent;
            public string pszMessageText;
            public string pszCaptionText;
            public IntPtr hbmBanner;
        }

Leon Wolf 41

[Flags]
        internal enum PromptForWindowsCredentialsFlags
        {
            /// <summary>
            /// The caller is requesting that the credential provider return the user name and password in plain text.
            /// This value cannot be combined with SECURE_PROMPT.
            /// </summary>
            CREDUIWIN_GENERIC = 0x1,
            /// <summary>
            /// The Save check box is displayed in the dialog box.
            /// </summary>
            CREDUIWIN_CHECKBOX = 0x2,
            /// <summary>
            /// Only credential providers that support the authentication package specified by the authPackage parameter should be enumerated.
            /// This value cannot be combined with CREDUIWIN_IN_CRED_ONLY.
            /// </summary>
            CREDUIWIN_AUTHPACKAGE_ONLY = 0x10,
            /// <summary>
            /// Only the credentials specified by the InAuthBuffer parameter for the authentication package specified by the authPackage parameter should be enumerated.
            /// If this flag is set, and the InAuthBuffer parameter is NULL, the function fails.
            /// This value cannot be combined with CREDUIWIN_AUTHPACKAGE_ONLY.
            /// </summary>

Leon Wolf 41

 CREDUIWIN_IN_CRED_ONLY = 0x20,
            /// <summary>
            /// Credential providers should enumerate only administrators. This value is intended for User Account Control (UAC) purposes only. We recommend that external callers not set this flag.
            /// </summary>
            CREDUIWIN_ENUMERATE_ADMINS = 0x100,
            /// <summary>
            /// Only the incoming credentials for the authentication package specified by the authPackage parameter should be enumerated.
            /// </summary>
            CREDUIWIN_ENUMERATE_CURRENT_USER = 0x200,
            /// <summary>
            /// The credential dialog box should be displayed on the secure desktop. This value cannot be combined with CREDUIWIN_GENERIC.
            /// Windows Vista: This value is not supported until Windows Vista with SP1.
            /// </summary>
            CREDUIWIN_SECURE_PROMPT = 0x1000,
            /// <summary>
            /// The credential provider should align the credential BLOB pointed to by the refOutAuthBuffer parameter to a 32-bit boundary, even if the provider is running on a 64-bit system.
            /// </summary>
            CREDUIWIN_PACK_32_WOW = 0x10000000,
        }

Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-05-30T07:44:03.88+00:00

I would like to know your CredentialsPromptHelper class, and Credentials, could you share the code without any personal privacy? (You can share these codes via txt file)
Leon Wolf 41 Reputation points

2022-05-30T07:47:33.047+00:00

206671-credentials-credentialsprompthelper.txt
Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-05-30T07:55:16.107+00:00

Coud the CredentialsFormHelper class be shared?
Leon Wolf 41 Reputation points

2022-05-30T07:56:46.587+00:00

206619-credentialsformhelper.txt
Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-05-30T09:45:22.48+00:00

I successfully reproduced your issue, it takes time to test, if there is any progress, I will contact you as soon as possible

Accepted answer

Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-06-20T07:11:42.613+00:00
Hello, Leon
Welcome to Microsoft Q&A!

Microsoft does not want ISVs to continue to create their own custom desktops through CreateDesktop() in win11, so the correct solution is to use the CREDUIWIN_SECURE_PROMPT flag, cancel the use of CreateDesktop, and use Ctrl+Alt+Delete to enter CredUI, which should also meet your needs.

dialogReturn = CredentialsPromptHelper.CredUIPromptForWindowsCredentials(ref credui, errorcode, ref authPackage, IntPtr.Zero, 0, out outCredBuffer, out outCredSize, ref save, CredentialsPromptHelper.PromptForWindowsCredentialsFlags.CREDUIWIN_SECURE_PROMPT);

Thank you.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Leon Wolf 41 Reputation points

2022-06-20T07:29:24.623+00:00

Alright, it works now! Thank you very much!
Sign in to comment

1 additional answer

Limitless Technology 39,351 Reputation points

2022-06-06T07:20:29.743+00:00

Hello Leon,

If the desktop becomes out of focus or secured, most likely is due to the way that UAC handles the credentials popup request.

To confirm this, just disable temporary UAC through powershell with:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force

--If the reply is helpful, please Upvote and Accept as answer--
Please sign in to rate this answer.
Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-06-06T07:27:27.567+00:00

May I ask you to test successfully in win11? it does not seem to solve the problem.

Leon Wolf 41 Reputation points

2022-06-07T07:29:44.82+00:00

I have tested it, unfortunately it does not solve my issue

Junjie Zhu - MSFT 14,751 Reputation points Microsoft Vendor

2022-06-07T07:31:57.3+00:00

Our engineers are working hard to deal with this bug issue in win11, if there is any progress, we will notify you as soon as possible.
Sign in to comment