Getting NULL value from 'Win32_LogonSession' through WMI [modified]

Supriya Tonape

Hi, I am trying to get the logged on user info from 'Win32_LogonSession' Class. However when I try to get the 'Name' field from this Class I am getting NULL value in variable 'vtProp' at below line . pclsObj->Get(L"Name", 0, &vtProp, 0, 0); Below is the code snippet. ================== HRESULT hres = WBEM_S_NO_ERROR; IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t("SELECT Name FROM Win32_LogonSession WHERE LogonType = 10"), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { //cout << "Query for operating system name failed." // << " Error code = 0x" // << hex << hres << endl; pSvc->Release(); pLoc->Release(); return 1; // Program has failed. } IWbemClassObject *pclsObj; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn) { ErrorInfo(hres,11); break; } VARIANT vtProp; // Get the value of the Name property hr = pclsObj->Get(L"Name", 0, &vtProp, 0, 0); printf(" Logged On User Name : %s",vtProp.bstrVal); VariantClear(&vtProp); } ==================== Regards, Supriya Tonape.

modified on Wednesday, October 22, 2008 3:54 PM

David Crow · modified on Wednesday, October 22, 2008 3:54 PM

Strange. I couldn't get any of the fields to return a non-null value. Can you use GetUserName() instead?

"Love people and use things, not love things and use people." - Unknown

"The brick walls are there for a reason...to stop the people who don't want it badly enough." - Randy Pausch

Supriya Tonape

'GetUserName' returns user associated with the current thread only. I wanted to run my program on any host machine and get all usernames who are logged on that host machine n has active sessions...

David Crow

Supriya Tonape wrote:

I wanted to run my program on any host machine and get all usernames who are logged on that host machine...

Can you use NetWkstaUserEnum()?

"Love people and use things, not love things and use people." - Unknown

"The brick walls are there for a reason...to stop the people who don't want it badly enough." - Randy Pausch

Supriya Tonape

Thanks but my requirement is that I have to get these names through WMI only. In fact after you told I tried API NetWkstaUserEnuma() and got Usernames too! but I donno whats gng wrong to not give me results...

Supriya Tonape

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ? I am getting this though! I guess there shud be some way by using this ID I can get the required name. any suggestion ?

Mark Salsbery

Supriya Tonape wrote:

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ?

Try:

#include <ntsecapi.h>
#pragma comment(lib, "Secur32.lib")
...

LUID luid;
luid.HighPart = 0;
luid.LowPart = 50493851;
PSECURITY\_LOGON\_SESSION\_DATA pLogonSessionData;
if (0 == ::LsaGetLogonSessionData(&luid, &pLogonSessionData))
{
    // user name is pLogonSessionData->UserName

    ::LsaFreeReturnBuffer(pLogonSessionData);
}

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

Thx Mark but I wanna use these APIs(Win32_LogonSession,Win32_LoggedOnUser etc) only so it will be gr8 help if you can tell me how to get my required info thru them... Any idea how to use "Win32_LoggedOnUser.Antecedent" when I have 'LoginID' of user ? Regards, Supriya Tonape

Mark Salsbery

Here's some C# that lists the interactive sessions - you should be able to extract the right queries from this...

ManagementObjectSearcher logonsessionsearcher = new ManagementObjectSearcher("SELECT * FROM Win32_LogonSession Where LogonType = 2 OR LogonType = 10");
foreach (ManagementObject logonsession in logonsessionsearcher.Get())
{
Console.WriteLine("LogonId: {0}", logonsession["LogonId"].ToString());
Console.WriteLine("LogonType: {0}", logonsession["LogonType"].ToString());

ManagementObjectSearcher associationsearcher = new ManagementObjectSearcher("Associators of {Win32\_LogonSession.LogonId=" + logonsession\["LogonId"\].ToString() + "} Where AssocClass=Win32\_LoggedOnUser Role=Dependent");
foreach (ManagementObject association in associationsearcher.Get())
{
    Console.WriteLine("   Name: {0}", association\["Name"\].ToString());
    Console.WriteLine("   Domain: {0}", association\["Domain"\].ToString());
}
Console.WriteLine("");

}

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

Thx Mark I will see how I can do this in C++. I guess we cant use this "Associators of {Win32_LogonSession.LogonId=" etc. in C++ so I need to check out the way how i can accomplish it in C++... I am not getting that though and tried multiple queries/combinations in C++ already... will check.. :( :confused: I am :~ though. Regards, Supriya Tonape.

Mark Salsbery

How do you do WMI queries in C++? I've always used .NET like shown which is the same in C++ or C#. The query should be the same in native C++ I would think...

Associators of {Win32_LogonSession.LogonId=50493851} Where AssocClass=Win32_LoggedOnUser Role=Dependent

where 50493851 is the logon session ID (insert an actual ID) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

Mark Salsbery

I just looked at this link Example: Getting WMI Data from the Local Computer[^] and it looks like query text just like I used. The "while (pEnumerator)" loop is the same as my foreach loop. Where's the problem? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

Yes I am using the same for looping. But I am not getting 'Name'field when I query diretly to 'Win32_LogonSession'class. There is some other way for it.. I am new to WMI stuff.. thru Win32_LoggedOnUser i shud get it but I am exploring it...I will try the query you had given me above.. Regards, Supriya Tonape

Supriya Tonape

Nope that query is not working. I am getting 'Win32_LogonSession.LogonId' after executing query : "SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10" what are next steps ? (in C++) Regards, Supriya Tonape

Mark Salsbery

Supriya Tonape wrote:

I am getting 'Win32_LogonSession.LogonId'

I thought you were already able to get the LogonId and you needed to get the name? To get the user name from the Win32_LoggedOnUser class, you need to do the second query I showed you using the LogonId from the query you've already done.

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

Yes I am getting LogonId ! Second query is not working for me... Regards, Supriya Tonape

Mark Salsbery

What does the code look like? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

It returns S_FALSE at line "HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1);" which is in last. I really donno if I doing right things... plz have a look,, int WMIScannerModule::GetRemoteLoggedOnUsers(IWbemServices *pSvc,pWMIScanParams pScanParams) { HRESULT hres = WBEM_S_NO_ERROR; IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t("SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10"), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { pSvc->Release(); return WBEM_S_FALSE; // Program has failed. } IWbemClassObject *pclsObj; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn) { ErrorInfo(hres,11); break; } VARIANT vtProp; VariantClear(&vtProp); // Get the value of the Name property hr = pclsObj->Get(_bstr_t(L"LogonId"), 0, &vtProp, 0, 0); printf("Logon ID : %s",vtProp.bstrVal); wstring wstrQuery = L"Associators of {Win32_LogonSession.LogonId="; wstrQuery += vtProp.bstrVal; wstrQuery += L"} Where AssocClass=Win32_LoggedOnUser Role=Dependent"; IEnumWbemClassObject* pEnumerator1 = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t(wstrQuery.c_str()), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator1); IWbemClassObject *pclsObj1; ULONG uReturn1 = 0; HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); if(0 == uReturn1) { ErrorInfo(hres,11); break; } VARIANT vtProp1; hr1 = pclsObj->Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0); printf("User Name : %s",vtProp1.bstrVal); } return 0; }

Mark Salsbery

Excellent thank you :) Change

hr1 = pclsObj->>Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0);

to this (changes marked in red)

hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0);

Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

Supriya Tonape

I had already tried that! It's not working as 'hr1' is getting as S_FALSE error and so 'vtProp1' is NULL for the time being... HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); VARIANT vtProp1; hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0); :confused: Regards, Supriya Tonape