Re: Impersonation and accessing Windows file share

I can see on the Event log on my web server that the service account is
logging in successfully.
However, on the file server, the event log shows that the user is connecting
to the file server as NT AUTHORITY\ANONYMOUS LOGON. Interesting.

My Logon code looks like this:
Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal
lpszUsername As [String], _
ByVal lpszDomain As [String], ByVal lpszPassword As [String], _
ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer, _
ByRef phToken As IntPtr) As Boolean


Private Function Logon() As WindowsIdentity
Dim handle As IntPtr = New IntPtr(0)
handle = IntPtr.Zero

Const LOGON32_LOGON_NETWORK As Integer = 3
Const LOGON32_PROVIDER_DEFAULT As Integer = 0

Dim logonSucceeded As Boolean = LogonUser(Me.sUsername, Me.sDomain,
Me.sPassword, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, handle)

If Not logonSucceeded Then
Dim errorCode As Integer = Marshal.GetLastWin32Error
Throw New Exception("User logon failed. Error number: " &
errorCode)
Exit Function
End If

Dim winIdentity As WindowsIdentity = New WindowsIdentity(handle)
CloseHandle(handle)
Return winIdentity
End Function




"Joe Kaplan (MVP - ADSI)" wrote:

If you enable logon event auditing on the file server, what does the logon
failure say on that end? That may give you some clues.

Also, when you called LogonUser, what type of logon did you do? You need to
make sure you use one that gives you network credentials.

Joe K.

"Julie" <hermie@xxxxxxxxxxxxx> wrote in message
news:674C986D-5107-420D-A65C-3FC8B440766B@xxxxxxxxxxxxxxxx
I use that code and I can confirm that impersonation is impersonating the
correct user. And yes, I can access the file share as the system
account -
thanks for checking. :-)


"Luke Zhang [MSFT]" wrote:

Hello,

First, you can use the following code to determine what user the thread
is
executing as:

System.Security.Principal.WindowsIdentity.GetCurrent().Name

Also, you if logon as the System account on the server, can you access
the
Windows file share like "\\Myserver\Myshare"?

Regards,

Luke Zhang
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

(This posting is provided "AS IS", with no warranties, and confers no
rights.)





.

Relevant Pages

  • Changing password based on Change password at next logon flag
    ... I'm trying to use the script below to change the password for every account ... Rem Changes the password of all users in a given OU with the change ... Dim strTargetOU ... 'Querying the User Must Change Password at Next Logon Status Flag ...
    (microsoft.public.scripting.vbscript)
  • Re: Impersonation and accessing Windows file share
    ... logon doesn't have network credentials. ... However, on the file server, the event log shows that the user is ... Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal ... Dim handle As IntPtr = New IntPtr ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Impersonation and accessing Windows file share
    ... logon doesn't have network credentials. ... However, on the file server, the event log shows that the user is ... Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal ... Dim handle As IntPtr = New IntPtr ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Impersonation and accessing Windows file share
    ... correct me if i am wrong - but when delegation is configured, NETWORK logons do have network credentials ??! ... this type of logon doesn't have network credentials. ... However, on the file server, the event log shows that the user is ... Dim handle As IntPtr = New IntPtr ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Manage 30 XP, 2000, 98 without Domain Controller
    ... account on 98 machines) ... folders on the File Server, setup NTFS permission on each folder. ... How to prevent them from share out local folders, ... So is it possible to make the workgroup change ...
    (microsoft.public.windowsxp.security_admin)