Re: LogonUser fails with no password in W2k3

From: Amit Rahul [MS] (arahul_at_online.microsoft.com)
Date: 05/28/04 

Date: Thu, 27 May 2004 18:09:22 -0700

You can get around this by setting the registry key "limitblankpassworduse"
in currentcontrolset\control\lsa to 0. This will let LogonUser succeed with
null password. But from security perspective its highly advisable to not do
this and rather enforce no blank password policy. 

-- 
Thanks,
Amit Rahul [MS]
This posting is provided "AS IS" with no warranties, and confers no rights.
"SatB" <anonymous@discussions.microsoft.com> wrote in message
news:88752EB6-F983-4078-82F5-A91B7B98EAE0@microsoft.com...
> Hi all,
> I have an application which authenticates users by using the username and
password that the user enters and trying to validate the user by calling
LogonUser() API. It works fine. The only time it does not work is when a
user account is created with no password in W2k3 (Windows Server 2003).
However it works fine in W2k. GetLastError() in W2k3 returns 1326 (Invalid
user name/bad password). I am surprised that W2k3 allows users to logon to
windows without entering any password but if you try the same using the
LogonUser() API it fails. Any help to work around this problem or alternate
solutions will be highly appreciated.
> Thanks in advance,
> Sat

Relevant Pages

  • Re: Get list of the Groups a User belongs to
    ... On a Windows Server 2003 domain you can construct a WindowsIdentity by ... Then you can access the Groups property (2.0 framework only): ... the unmanaged APIs such as LogonUser: ...
    (microsoft.public.dotnet.languages.csharp)
  • RE: Validating an NT password
    ... Note LogonUser Win32 API does not require TCB privilege in Microsoft ... const long LOGON32_LOGON_INTERACTIVE = 2; ... string lpszUsername, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: LogonUser problem...
    ... > combination of Username and Password for a user account, ... > Which API do you think is better? ... I have tried LogOnUser ... > in Interactive mode, it is pretty fast when compared to ...
    (microsoft.public.win2000.security)
  • Re: [Chris P.[MVP]] I can use Local System under I call API LogonUser(
    ... Teddy wrote: ... when I create a thread in my application and it call API ... > LogonUser() first, then I can call WNetConnection2 successfully? ... system" right in the system policy editor if it is not already. ...
    (microsoft.public.win32.programmer.networks)
  • Re: LogonUser()
    ... I tried this but the application seems to abend at the call to GetLastError, ... > You still need to call LogonUser() API to get the token in .NET. ...
    (microsoft.public.dotnet.security)