LogonUser fails across different domains

From: Prasanna Padmanabhan (prasannap_at_citrix.nospam.com.)
Date: 01/29/04

  • Next message: Drew Cooper [MSFT]: "Re: LogonUser fails across different domains" 
    Date: Wed, 28 Jan 2004 22:37:21 -0500

    LogonUser() fails if the user (specified as parameter) is in a domain
    different from that with which the executing process is running as.
    For example, if the process that is executing LogonUser is running as
    DomainA\UserA and if I want to LogonUser as DomainB\UserA it fails (unless
    DomainA and DomainB have some sort of trust relationship).

    My question is this:-
    ---------------------

    Can one of you gurus please tell me what is the workaround for this is? That
    is how can I get a user's token from LogonUser if the domains are different.
    My intention is to get the user's token from the LogonUser call and make my
    executing process run as that user (impersonation), and then use that
    "impersonated user" to access remote file shares (that are on a different
    domain).

    I did several google searches and all of them agree that LogonUser does not
    work across different untrusted domains, but they don't offer a solution.

    Thanks a lot!
    Prasanna

  • Next message: Drew Cooper [MSFT]: "Re: LogonUser fails across different domains"

    Relevant Pages

    • Re: LogonUser fails across different domains
      ... You shouldn't be able to log on as a user from an untrusted domain (except ... And you shouldn't need to do an impersonate to access files on a ... > LogonUser() fails if the user is in a domain ... > different from that with which the executing process is running as. ...
      (microsoft.public.platformsdk.security)
    • Re: Impersonate a user to gain access of EFS on a local machine
      ... CreateFile to gain access of the EFS, but it fails. ... values from LogOnUser and ImpersonateLoggedOnUser are TRUE, ...
      (microsoft.public.platformsdk.security)
    • Problem with LogonUser in my own GINA provider.
      ... LogonUser fails to logon user when PDC and BDC are in down ... MS GINA provider it can do login while been disconnected from network, ...
      (microsoft.public.platformsdk.security)
    • Re: WindowsIdentity.Impersonate() vs ImpersonateLoggedOnUser()
      ... So LogonUser, ImpersonateLoggedOnUser and RevertToSelf ... On Windows 2000 Professional the code fails at LogonUser with error ... Windows 2000 needs the "Act as part of the operating system" privilege ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: Problem with LogonUser in my own GINA provider.
      ... However, in my case, LogonUser in my GINA dll running in the system ... LogonUser fails to logon user when PDC and BDC are in down ... MS GINA provider it can do login while been disconnected from network, ...
      (microsoft.public.platformsdk.security)