Hello, I am trying to use Win32LogonSession to retrieve the LogonType in my C++ code. However, I'm encountering several errors and I am unsure if I'm writing the correct code. Can anyone provide assistance? Thank you.

You can get the logon type using the Windows API without WMI -- #define WIN32_LEAN_AND_MEAN #include <Windows.h> #include <NTSecAPI.h> #pragma comment(lib, "secur32") #include <stdio.h> #include <memory> PCWSTR GetLogonTypeAsString(SECURITY_LOGON_TYPE type) { switch (type) { case UndefinedLogonType: return L"UndefinedLogonType"; case Interactive: return L"Interactive"; case Network: return L"Network"; case Batch: return L"Batch"; case Service: return L"Service"; case Proxy: return L"Proxy"; case Unlock: return L"Unlock"; case NetworkCleartext: return L"NetworkCleartext"; case NewCredentials: return L"NewCredentials"; case RemoteInteractive: return L"RemoteInteractive"; case CachedInteractive: return L"CachedInteractive"; case CachedRemoteInteractive: return L"CachedRemoteInteractive"; case CachedUnlock: return L"CachedUnlock"; default: return L"Error"; } } int main() { DWORD dwLength{}; GetTokenInformation(GetCurrentProcessToken(), TokenStatistics, nullptr, 0, &dwLength); std::unique_ptr<BYTE[]> buffer = std::make_unique<BYTE[]>(dwLength); if (GetTokenInformation(GetCurrentProcessToken(), TokenStatistics, buffer.get(), dwLength, &dwLength)) { PTOKEN_STATISTICS pts = reinterpret_cast<PTOKEN_STATISTICS>(buffer.get()); PSECURITY_LOGON_SESSION_DATA pLogonSessionData{}; auto status = LsaGetLogonSessionData(&pts->AuthenticationId, &pLogonSessionData); if (status == 0) { wprintf_s(L"Logon type was %s\n", GetLogonTypeAsString((SECURITY_LOGON_TYPE) pLogonSessionData->LogonType)); LsaFreeReturnBuffer(pLogonSessionData); } } return 0; }

Help needed to retrieve the LogonType using Win32LogonSession class in C++

Accepted answer

RLWA32 45,691 Reputation points

2024-07-12T07:02:31.25+00:00
You can get the logon type using the Windows API without WMI --

#define WIN32_LEAN_AND_MEAN #include <Windows.h> #include <NTSecAPI.h> #pragma comment(lib, "secur32") #include <stdio.h> #include <memory> PCWSTR GetLogonTypeAsString(SECURITY_LOGON_TYPE type) { switch (type) { case UndefinedLogonType: return L"UndefinedLogonType"; case Interactive: return L"Interactive"; case Network: return L"Network"; case Batch: return L"Batch"; case Service: return L"Service"; case Proxy: return L"Proxy"; case Unlock: return L"Unlock"; case NetworkCleartext: return L"NetworkCleartext"; case NewCredentials: return L"NewCredentials"; case RemoteInteractive: return L"RemoteInteractive"; case CachedInteractive: return L"CachedInteractive"; case CachedRemoteInteractive: return L"CachedRemoteInteractive"; case CachedUnlock: return L"CachedUnlock"; default: return L"Error"; } } int main() { DWORD dwLength{}; GetTokenInformation(GetCurrentProcessToken(), TokenStatistics, nullptr, 0, &dwLength); std::unique_ptr<BYTE[]> buffer = std::make_unique<BYTE[]>(dwLength); if (GetTokenInformation(GetCurrentProcessToken(), TokenStatistics, buffer.get(), dwLength, &dwLength)) { PTOKEN_STATISTICS pts = reinterpret_cast<PTOKEN_STATISTICS>(buffer.get()); PSECURITY_LOGON_SESSION_DATA pLogonSessionData{}; auto status = LsaGetLogonSessionData(&pts->AuthenticationId, &pLogonSessionData); if (status == 0) { wprintf_s(L"Logon type was %s\n", GetLogonTypeAsString((SECURITY_LOGON_TYPE) pLogonSessionData->LogonType)); LsaFreeReturnBuffer(pLogonSessionData); } } return 0; }
Please sign in to rate this answer.

1 person found this answer helpful.
Rohan Pande 445 Reputation points

2024-07-12T09:45:33.25+00:00

Thanks @RLWA32 for helping.

One doubt when I ran this piece of code while running it as a service it didn't came under Service. But went as undefined Log type should not be expected here?

RLWA32 45,691 Reputation points

2024-07-12T10:20:22.6433333+00:00

If your service is running under the SYSTEM account this is expected. You can use Sysinternals' LogonSessions utility to display logon session information, including the logon type.

Rohan Pande 445 Reputation points

2024-07-15T01:47:47.3233333+00:00

Yeah this alternative works. Thanks. I tried even after WER restart it gave me interactive @RLWA32 . However this is without using COM we think this is more helpful.

Rohan Pande 445 Reputation points

2024-07-15T07:30:11.16+00:00

I have one doubt, Why did you retrieve two times, GetTokenInformation? @RLWA32

Rohan Pande 445 Reputation points

2024-07-15T08:08:07.25+00:00

sizeof could have been used I was thinking

RLWA32 45,691 Reputation points

2024-07-15T08:17:56.6566667+00:00

GetTokenInformation is capable of retrieving variable sized structures depending on the parameter passed for TOKEN_INFORMATION_CLASS. Like many other Windows API functions it is common to call the function once to get the required size of the buffer and a second time to retrieve the data.

The example that I posted followed this pattern for illustrative purposes.

However, a TOKEN_STATISTICS structure has a fixed size. So you can simplify your code by passing the address and size of a TOKEN_STATISTICS structure in a single call to GetTokenInformation. So in this specific instance the code could be simplified to

DWORD dwLength{}; TOKEN_STATISTICS ts{}; if (GetTokenInformation(GetCurrentProcessToken(), TokenStatistics, &ts, sizeof ts, &dwLength)) { PSECURITY_LOGON_SESSION_DATA pLogonSessionData{}; auto status = LsaGetLogonSessionData(&ts.AuthenticationId, &pLogonSessionData); if (status == 0) { wprintf_s(L"Logon type was %s\n", GetLogonTypeAsString((SECURITY_LOGON_TYPE) pLogonSessionData->LogonType)); LsaFreeReturnBuffer(pLogonSessionData); } }

RLWA32 45,691 Reputation points

2024-07-15T08:24:32.7433333+00:00

To see what I mean about variable size you cannot successfully use sizeof to retrieve information that require structures like TOKEN_GROUPS or TOKEN_PRIVILEGES.

Rohan Pande 445 Reputation points

2024-07-15T09:18:10.4633333+00:00

Thanks It helps....
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Help needed to retrieve the LogonType using Win32LogonSession class in C++

0 additional answers

Your answer