LogonUserExExW function
The LogonUserExExW function attempts to log a user on to the local computer. The local computer is the computer from which LogonUserExExW was called. You cannot use LogonUserExExW to log on to a remote computer. Specify the user by using a user name and domain and authenticate the user by using a plaintext password. If the function succeeds, it receives a handle to a token that represents the logged-on user. You can then use this token handle to impersonate the specified user or, in most cases, to create a process that runs in the context of the specified user.
This function is similar to the LogonUserEx function, except that it takes the additional parameter, pTokenGroups, which is a set of one or more security identifiers (SIDs) that are added to the token returned to the caller when the logon is successful.
This function is not declared in a public header and has no associated import library. You must use the LoadLibrary and GetProcAddress functions to dynamically link to Advapi32.dll.
Syntax
BOOL WINAPI LogonUserExExW(
_In_ LPTSTR lpszUsername,
_In_opt_ LPTSTR lpszDomain,
_In_opt_ LPTSTR lpszPassword,
_In_ DWORD dwLogonType,
_In_ DWORD dwLogonProvider,
_In_opt_ PTOKEN_GROUPS pTokenGroups,
_Out_opt_ PHANDLE phToken,
_Out_opt_ PSID *ppLogonSid,
_Out_opt_ PVOID *ppProfileBuffer,
_Out_opt_ LPDWORD pdwProfileLength,
_Out_opt_ PQUOTA_LIMITS pQuotaLimits
);
Parameters
-
lpszUsername [in]
-
A pointer to a null-terminated string that specifies the name of the user. This is the name of the user account to log on to. If you use the user principal name (UPN) format, the lpszDomain parameter must be NULL.
-
lpszDomain [in, optional]
-
A pointer to a null-terminated string that specifies the name of the domain or server whose account database contains the lpszUsername account. If this parameter is NULL, the user name must be specified in UPN format. If this parameter is ".", the function validates the account by using only the local account database.
-
lpszPassword [in, optional]
-
A pointer to a null-terminated string that specifies the plaintext password for the user account specified by lpszUsername. When you have finished using the password, clear the password from memory by calling the SecureZeroMemory function. For more information about protecting passwords, see Handling Passwords.
-
dwLogonType [in]
-
The type of logon operation to perform. This parameter can be one of the following values.
Value Meaning - LOGON32_LOGON_INTERACTIVE
- 2
This logon type is intended for users who will be interactively using the computer, such as a user being logged on by a terminal server, remote shell, or similar process. This logon type has the additional expense of caching logon information for disconnected operations; therefore, it is inappropriate for some client/server applications, such as a mail server. - LOGON32_LOGON_NETWORK
- 3
This logon type is intended for high performance servers to authenticate plaintext passwords. The LogonUserExExW function does not cache credentials for this logon type. - LOGON32_LOGON_BATCH
- 4
This logon type is intended for batch servers, where processes may be executing on behalf of a user without their direct intervention. This type is also for higher performance servers that process many plaintext authentication attempts at a time, such as mail or web servers. The LogonUserExExW function does not cache credentials for this logon type. - LOGON32_LOGON_SERVICE
- 5
Indicates a service-type logon. The account provided must have the service privilege enabled. - LOGON32_LOGON_UNLOCK
- 7
This logon type is for GINA DLLs that log on users who will be interactively using the computer. This logon type can generate a unique audit record that shows when the workstation was unlocked. - LOGON32_LOGON_NETWORK_CLEARTEXT
- 8
This logon type preserves the name and password in the authentication package, which allows the server to make connections to other network servers while impersonating the client. A server can accept plaintext credentials from a client, call LogonUserExExW, verify that the user can access the system across the network, and still communicate with other servers. - LOGON32_LOGON_NEW_CREDENTIALS
- 9
This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identifier but uses different credentials for other network connections.
This logon type is supported only by the LOGON32_PROVIDER_WINNT50 logon provider. -
dwLogonProvider [in]
-
The logon provider. This parameter can be one of the following values.
Value Meaning - LOGON32_PROVIDER_DEFAULT
Use the standard logon provider for the system. The default security provider is NTLM. - LOGON32_PROVIDER_WINNT50
Use the negotiate logon provider. - LOGON32_PROVIDER_WINNT40
Use the NTLM logon provider. -
pTokenGroups [in, optional]
-
A pointer to a TOKEN_GROUPS structure that specifies a list of group SIDs that are added to the token that this function receives upon successful logon. Any SIDs added to the token also effect group expansion. For example, if the added SIDs are members of local groups, those groups are also added to the received access token.
If this parameter is not NULL, the caller of this function must have the SE_TCB_PRIVILEGE privilege granted and enabled.
-
phToken [out, optional]
-
A pointer to a handle variable that receives a handle to a token that represents the specified user.
You can use the returned handle in calls to the ImpersonateLoggedOnUser function.
In most cases, the returned handle is a primary token that you can use in calls to the CreateProcessAsUser function. However, if you specify the LOGON32_LOGON_NETWORK flag, LogonUserExExW returns an impersonation token that you cannot use in CreateProcessAsUser unless you call DuplicateTokenEx to convert the impersonation token to a primary token.
When you no longer need this handle, close it by calling the CloseHandle function.
-
ppLogonSid [out, optional]
-
A pointer to a pointer to a SID that receives the SID of the user logged on.
When you have finished using the SID, free it by calling the LocalFree function.
-
ppProfileBuffer [out, optional]
-
A pointer to a pointer that receives the address of a buffer that contains the logged on user's profile.
-
pdwProfileLength [out, optional]
-
A pointer to a DWORD that receives the length of the profile buffer.
-
pQuotaLimits [out, optional]
-
A pointer to a QUOTA_LIMITS structure that receives information about the quotas for the logged on user.
Return value
If the function succeeds, the function returns nonzero.
If the function fails, it returns zero. To get extended error information, call GetLastError.
Remarks
The LOGON32_LOGON_NETWORK logon type is fastest, but it has the following limitations:
- The function returns an impersonation token, not a primary token. You cannot use this token directly in the CreateProcessAsUser function. However, you can call the DuplicateTokenEx function to convert the token to a primary token, and then use it in CreateProcessAsUser.
- If you convert the token to a primary token and use it in CreateProcessAsUser to start a process, the new process cannot access other network resources, such as remote servers or printers, through the redirector. An exception is that if the network resource is not access controlled, then the new process will be able to access it.
The account specified by lpszUsername must have the necessary account rights. For example, to log on a user with the LOGON32_LOGON_INTERACTIVE flag, the user (or a group to which the user belongs) must have the SE_INTERACTIVE_LOGON_NAME account right. For a list of the account rights that affect the various logon operations, see Account Object Access Rights.
A user is considered logged on if at least one token exists. If you call CreateProcessAsUser and then close the token, the user is still logged on until the process (and all child processes) have ended.
If the optional pTokenGroups parameter is supplied, LSA will not add either the local SID or the logon SID automatically.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista [desktop apps only] |
| Minimum supported server |
Windows Server 2008 [desktop apps only] |
| Version |
LogonUserExExW is also available onWindows Server 2003 or Windows XPwith the General Distribution Release. |
| Header |
|
| DLL |
|
See also