LogonUser error 1326 on non-domain computer

[Kenneth Dale]

Hello,
I am a newbie in C++ but I managed to create a program (with online help) which utilizes CreateProcessWithLogonW to execute a process with Administrator privileges on a network.

I am currently trying to execute a command on a remote computer which is NOT PART OF A DOMAIN.

When I do this, I am getting 1326 error on the LogonUser function when executing this program with its user/password parameters on a non-domain computer.

For example, the application is executed in the following way:

iedoz administrador@192.168.1.86 123456 "aprogram.exe"


C:\Users\myuser>iedoz administrador@192.168.1.86 123456 "aprogram.exe"
ERROR: API = LogonUser.
error code = 1326.
message = Logon failure: unknown user name or bad password
.


I would really appreciate it if you guys could help me because I am not too familiar with C++ and am not experienced in debugging with Visual Studio.

This is my code. iedoz.cpp

//
//
/**
int _tmain(int argc, _TCHAR* argv[])
{
    cout << "Hello world!";
    return 0;
}*/
#include "stdafx.h"


HANDLE g_hChildStd_IN_Rd = NULL;
HANDLE g_hChildStd_IN_Wr = NULL;
HANDLE g_hChildStd_OUT_Rd = NULL;
HANDLE g_hChildStd_OUT_Wr = NULL;

HANDLE g_hInputFile = NULL;


int BUFSIZE = 1064;
void CreateChildProcess(void); 
void WriteToPipe(void); 
void ReadFromPipe(void); 
void ErrorExit(PTSTR); 

void DisplayError(LPWSTR pszAPI)
{
    LPVOID lpvMessageBuffer;

    FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | 
        FORMAT_MESSAGE_FROM_SYSTEM,
        NULL, GetLastError(), 
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), 
        (LPWSTR)&lpvMessageBuffer, 0, NULL);

    //
    //... now display this string
    //
    wprintf(L"ERROR: API        = %s.\n", pszAPI);
    wprintf(L"       error code = %d.\n", GetLastError());
    wprintf(L"       message    = %s.\n", (LPWSTR)lpvMessageBuffer);

    //
    // Free the buffer allocated by the system
    //
    LocalFree(lpvMessageBuffer);

    ExitProcess(GetLastError());
}





void _tmain(int argc, WCHAR *argv[])
{
    SECURITY_ATTRIBUTES saAttr; 
   saAttr.nLength = sizeof(SECURITY_ATTRIBUTES); 
   saAttr.bInheritHandle = TRUE; 
   saAttr.lpSecurityDescriptor = NULL; 

   if ( ! CreatePipe(&g_hChildStd_OUT_Rd, &g_hChildStd_OUT_Wr, &saAttr, 0) ) 
      ErrorExit(TEXT("StdoutRd CreatePipe")); 

   if ( ! SetHandleInformation(g_hChildStd_OUT_Rd, HANDLE_FLAG_INHERIT, 0) )
      ErrorExit(TEXT("Stdout SetHandleInformation")); 

    if (! CreatePipe(&g_hChildStd_IN_Rd, &g_hChildStd_IN_Wr, &saAttr, 0)) 
      ErrorExit(TEXT("Stdin CreatePipe")); 

    if ( ! SetHandleInformation(g_hChildStd_IN_Wr, HANDLE_FLAG_INHERIT, 0) )
      ErrorExit(TEXT("Stdin SetHandleInformation")); 

    /////////////////////////////Start CreateChildProcess////////



    STARTUPINFO si;
    ZeroMemory( &si, sizeof(STARTUPINFO) );
    si.cb = sizeof(STARTUPINFO);


    si.dwFlags |= STARTF_USESHOWWINDOW;
    si.dwFlags |= STARTF_USESTDHANDLES;
    si.hStdError = g_hChildStd_OUT_Wr;
    si.hStdOutput = g_hChildStd_OUT_Wr;
    si.hStdInput = g_hChildStd_IN_Rd;
    if (argc == 5)
    {
        if(0 == wcscmp(argv[4], L"/i") )
        {
            si.lpDesktop = 0;
            si.wShowWindow = SW_HIDE;
        }
    }

    DWORD     dwSize;
    HANDLE    hToken;
    LPVOID    lpvEnv;
    PROCESS_INFORMATION pi = {0};
    WCHAR               szUserProfile[256] = L"";

    si.cb = sizeof(STARTUPINFO);

    if (argc != 4 && argc != 5)
    {
        wprintf(L"Usage: %s [user@domain] [password] [cmd] [/i (invisible console)]", argv[1]);
        wprintf(L"\n\n");
        return;
    }

    //
    // TO DO: change NULL to '.' to use local account database
    //
    if (!LogonUser(argv[1], NULL, argv[2], LOGON32_LOGON_INTERACTIVE, 
            LOGON32_PROVIDER_DEFAULT, &hToken))
        DisplayError(L"LogonUser");

    if (!CreateEnvironmentBlock(&lpvEnv, hToken, TRUE))
        DisplayError(L"CreateEnvironmentBlock");

    dwSize = sizeof(szUserProfile)/sizeof(WCHAR);

    if (!GetUserProfileDirectory(hToken, szUserProfile, &dwSize))
        DisplayError(L"GetUserProfileDirectory");

    //
    // TO DO: change NULL to '.' to use local account database
    //
    if (!CreateProcessWithLogonW(argv[1], NULL, argv[2], 
            LOGON_WITH_PROFILE, NULL, argv[3], 
            CREATE_UNICODE_ENVIRONMENT, lpvEnv, szUserProfile, 
            &si, &pi))
        DisplayError(L"CreateProcessWithLogonW");

    if (!DestroyEnvironmentBlock(lpvEnv))
        DisplayError(L"DestroyEnvironmentBlock");

    CloseHandle(hToken);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);



    /////////////////////////////End CreateChildProcess///////////
       CloseHandle(g_hChildStd_OUT_Wr);

    /**
     if (argc == 1) 
      ErrorExit(TEXT("Please specify an input file.\n")); 

   g_hInputFile = CreateFile(
       argv[3], 
       GENERIC_READ, 
       0, 
       NULL, 
       OPEN_EXISTING, 
       FILE_ATTRIBUTE_READONLY, 
       NULL); 

   if ( g_hInputFile == INVALID_HANDLE_VALUE ) 
      ErrorExit(TEXT("CreateFile")); 

     WriteToPipe(); 
   printf( "\n->Contents of %s written to child STDIN pipe.\n", argv[1]);

   */
      printf( "\n->Contents of child process STDOUT:\n\n", argv[1]);
   ReadFromPipe(); 


   CloseHandle(g_hChildStd_OUT_Rd);
}

void WriteToPipe(void) 

// Read from a file and write its contents to the pipe for the child's STDIN.
// Stop when there is no more data. 
{ 
   DWORD dwRead, dwWritten; 
   CHAR chBuf[4096];
   BOOL bSuccess = FALSE;

   for (;;) 
   { 
      bSuccess = ReadFile(g_hInputFile, chBuf, BUFSIZE, &dwRead, NULL);
      if ( ! bSuccess || dwRead == 0 ) break; 

      bSuccess = WriteFile(g_hChildStd_IN_Wr, chBuf, dwRead, &dwWritten, NULL);
      if ( ! bSuccess ) break; 
   } 

// Close the pipe handle so the child process stops reading. 

   if ( ! CloseHandle(g_hChildStd_IN_Wr) ) 
      ErrorExit(TEXT("StdInWr CloseHandle")); 
} 

 void ReadFromPipe(void) 

// Read output from the child process's pipe for STDOUT
// and write to the parent process's pipe for STDOUT. 
// Stop when there is no more data. 
{ 
   DWORD dwRead, dwWritten; 
   CHAR chBuf[4096]; 
   BOOL bSuccess = FALSE;
   HANDLE hParentStdOut = GetStdHandle(STD_OUTPUT_HANDLE);

   for (;;) 
   { 
      bSuccess = ReadFile( g_hChildStd_OUT_Rd, chBuf, BUFSIZE, &dwRead, NULL);
      if( ! bSuccess || dwRead == 0 ) break; 

      bSuccess = WriteFile(hParentStdOut, chBuf, 
                           dwRead, &dwWritten, NULL);
      if (! bSuccess ) break; 
   } 
} 

void ErrorExit(PTSTR lpszFunction) 

// Format a readable error message, display a message box, 
// and exit from the application.
{ 
    LPVOID lpMsgBuf;
    LPVOID lpDisplayBuf;
    DWORD dw = GetLastError(); 

    FormatMessage(
        FORMAT_MESSAGE_ALLOCATE_BUFFER | 
        FORMAT_MESSAGE_FROM_SYSTEM |
        FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL,
        dw,
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPTSTR) &lpMsgBuf,
        0, NULL );

    lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT, 
        (lstrlen((LPCTSTR)lpMsgBuf)+lstrlen((LPCTSTR)lpszFunction)+40)*sizeof(TCHAR)); 
    StringCchPrintf((LPTSTR)lpDisplayBuf, 
        LocalSize(lpDisplayBuf) / sizeof(TCHAR),
        TEXT("%s failed with error %d: %s"), 
        lpszFunction, dw, lpMsgBuf); 
    MessageBox(NULL, (LPCTSTR)lpDisplayBuf, TEXT("Error"), MB_OK); 

    LocalFree(lpMsgBuf);
    LocalFree(lpDisplayBuf);
    ExitProcess(1);
}

[kbw]

I am currently trying to execute a command on a remote computer which is NOT PART OF A DOMAIN.

Your code is littered with:

    //
    // TO DO: change NULL to '.' to use local account database
    // 

A Windows computer that is not part of a domain, logs on using its local account database.

[Computergeek01]

If I read this correctly then you're running this executable from System_A and trying to get it to launch another program on System_B where there is no domain trust between the two correct? This isn't even close to how you do that. Right now nothing you have written is connecting to the remote machine except maybe the authentication attempt, but that's going to fail every time with the way you have this written unless both systems share a logon provider.

Prerequisite: Rewrite your launcher as a valid Windows Service and make sure the binary is in a directory that the remote machine can read.

Step 1: Ensure that the remote machine will allow System_A to connect to System_B through the firewall. With out this everything you send will be ignored.

Step 2: Get a valid security token on System_B by calling "LogonUser()" with the 'LOGON32_LOGON_NEW_CREDENTIALS' flag set in 'dwLogonType' and the 'LOGON32_PROVIDER_WINNT50' flag passed for 'dwLogonProvider'. This part is right there in the documentation for this function, I really don't know how you could have missed it.: http://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx

Step 3: Get a handle to the remote machines Service Control Manager by using "OpenSCManager()". : http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx

Step 4: Create an entry on the remote machine for your Service using the "CreateService()" function. : http://msdn.microsoft.com/en-us/library/windows/desktop/ms682450(v=vs.85).aspx

Step 5: Launch your launcher using the "StartService()" function. : http://msdn.microsoft.com/en-us/library/windows/desktop/ms686321(v=vs.85).aspx

[Computergeek01]

I don't mean to be purposefully vague or condescending, nor do I mean to make you ask for help again. It's just that I don't know you and there is a certain percentage of the population that reacts very negatively to being handed the answer outright, these same people are often the most productive of our little community and I don't want to discourage or run you off if that happens to be the case. If you need further clarification then please just ask. I know this documentation can be unbelievably dry at times so we can help you bull through that if you need us to.

[Kenneth Dale]

Computergeek01: I appreciate your answer and your help. It was very informative and if I work through it it will allow me to learn more about Windows programming.

I do appreciate it and it was very informative as I said so thank you.

As to the the 1326 error itself, kbw's answer did the trick. So thank you kbw. I made sure to write a "." for domain whenever I worked with non-domain computers. It worked.

Anyway, thank you both. I believe I shall utilize computergeek01's steps in the future.

Thanks guys!

[Computergeek01]

Wait a minute, how is what you have here executing code on a remote machine? This doesn't make any sense...