Getting NULL value from 'Win32_LogonSession' through WMI [modified]

[Supriya Tonape]

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ? I am getting this though! I guess there shud be some way by using this ID I can get the required name. any suggestion ?

[Mark Salsbery]

Supriya Tonape wrote:

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ?

Try:

#include <ntsecapi.h>
#pragma comment(lib, "Secur32.lib")
...

LUID luid;
luid.HighPart = 0;
luid.LowPart = 50493851;
PSECURITY\_LOGON\_SESSION\_DATA pLogonSessionData;
if (0 == ::LsaGetLogonSessionData(&luid, &pLogonSessionData))
{
    // user name is pLogonSessionData->UserName

    ::LsaFreeReturnBuffer(pLogonSessionData);
}

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Thx Mark but I wanna use these APIs(Win32_LogonSession,Win32_LoggedOnUser etc) only so it will be gr8 help if you can tell me how to get my required info thru them... Any idea how to use "Win32_LoggedOnUser.Antecedent" when I have 'LoginID' of user ? Regards, Supriya Tonape

[Mark Salsbery]

Here's some C# that lists the interactive sessions - you should be able to extract the right queries from this...

ManagementObjectSearcher logonsessionsearcher = new ManagementObjectSearcher("SELECT * FROM Win32_LogonSession Where LogonType = 2 OR LogonType = 10");
foreach (ManagementObject logonsession in logonsessionsearcher.Get())
{
Console.WriteLine("LogonId: {0}", logonsession["LogonId"].ToString());
Console.WriteLine("LogonType: {0}", logonsession["LogonType"].ToString());

ManagementObjectSearcher associationsearcher = new ManagementObjectSearcher("Associators of {Win32\_LogonSession.LogonId=" + logonsession\["LogonId"\].ToString() + "} Where AssocClass=Win32\_LoggedOnUser Role=Dependent");
foreach (ManagementObject association in associationsearcher.Get())
{
    Console.WriteLine("   Name: {0}", association\["Name"\].ToString());
    Console.WriteLine("   Domain: {0}", association\["Domain"\].ToString());
}
Console.WriteLine("");

}

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Thx Mark I will see how I can do this in C++. I guess we cant use this "Associators of {Win32_LogonSession.LogonId=" etc. in C++ so I need to check out the way how i can accomplish it in C++... I am not getting that though and tried multiple queries/combinations in C++ already... will check.. :( :confused: I am :~ though. Regards, Supriya Tonape.

[Mark Salsbery]

How do you do WMI queries in C++? I've always used .NET like shown which is the same in C++ or C#. The query should be the same in native C++ I would think...

Associators of {Win32_LogonSession.LogonId=50493851} Where AssocClass=Win32_LoggedOnUser Role=Dependent

where 50493851 is the logon session ID (insert an actual ID) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Mark Salsbery]

I just looked at this link Example: Getting WMI Data from the Local Computer[^] and it looks like query text just like I used. The "while (pEnumerator)" loop is the same as my foreach loop. Where's the problem? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Yes I am using the same for looping. But I am not getting 'Name'field when I query diretly to 'Win32_LogonSession'class. There is some other way for it.. I am new to WMI stuff.. thru Win32_LoggedOnUser i shud get it but I am exploring it...I will try the query you had given me above.. Regards, Supriya Tonape

[Supriya Tonape]

Nope that query is not working. I am getting 'Win32_LogonSession.LogonId' after executing query : "SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10" what are next steps ? (in C++) Regards, Supriya Tonape

[Mark Salsbery]

Supriya Tonape wrote:

I am getting 'Win32_LogonSession.LogonId'

I thought you were already able to get the LogonId and you needed to get the name? To get the user name from the Win32_LoggedOnUser class, you need to do the second query I showed you using the LogonId from the query you've already done.

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Yes I am getting LogonId ! Second query is not working for me... Regards, Supriya Tonape

[Mark Salsbery]

What does the code look like? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

It returns S_FALSE at line "HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1);" which is in last. I really donno if I doing right things... plz have a look,, int WMIScannerModule::GetRemoteLoggedOnUsers(IWbemServices *pSvc,pWMIScanParams pScanParams) { HRESULT hres = WBEM_S_NO_ERROR; IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t("SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10"), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { pSvc->Release(); return WBEM_S_FALSE; // Program has failed. } IWbemClassObject *pclsObj; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn) { ErrorInfo(hres,11); break; } VARIANT vtProp; VariantClear(&vtProp); // Get the value of the Name property hr = pclsObj->Get(_bstr_t(L"LogonId"), 0, &vtProp, 0, 0); printf("Logon ID : %s",vtProp.bstrVal); wstring wstrQuery = L"Associators of {Win32_LogonSession.LogonId="; wstrQuery += vtProp.bstrVal; wstrQuery += L"} Where AssocClass=Win32_LoggedOnUser Role=Dependent"; IEnumWbemClassObject* pEnumerator1 = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t(wstrQuery.c_str()), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator1); IWbemClassObject *pclsObj1; ULONG uReturn1 = 0; HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); if(0 == uReturn1) { ErrorInfo(hres,11); break; } VARIANT vtProp1; hr1 = pclsObj->Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0); printf("User Name : %s",vtProp1.bstrVal); } return 0; }

[Mark Salsbery]

Excellent thank you :) Change

hr1 = pclsObj->>Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0);

to this (changes marked in red)

hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0);

Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

I had already tried that! It's not working as 'hr1' is getting as S_FALSE error and so 'vtProp1' is NULL for the time being... HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); VARIANT vtProp1; hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0); :confused: Regards, Supriya Tonape

[Mark Salsbery]

hmm I tested it and it worked for me... Here's my test code - I took your code and added stuff to the top (copied right from that MSDN sample code) for me to build it...

int GetRemoteLoggedOnUsers()
{
HRESULT hres = WBEM_S_NO_ERROR;

//hres =  CoInitializeSecurity(
//    NULL, 
//    -1,                          // COM authentication
//    NULL,                        // Authentication services
//    NULL,                        // Reserved
//    RPC\_C\_AUTHN\_LEVEL\_DEFAULT,   // Default authentication 
//    RPC\_C\_IMP\_LEVEL\_IMPERSONATE, // Default Impersonation  
//    NULL,                        // Authentication info
//    EOAC\_NONE,                   // Additional capabilities 
//    NULL                         // Reserved
//    );

//                  
//if (FAILED(hres))
//{
//    cout << "Failed to initialize security. Error code = 0x" 
//        << hex << hres << endl;
//    CoUninitialize();
//    return 1;                    // Program has failed.
//}

// Step 3: ---------------------------------------------------
// Obtain the initial locator to WMI -------------------------

IWbemLocator \*pLoc = NULL;

hres = CoCreateInstance(
    CLSID\_WbemLocator,             
    0, 
    CLSCTX\_INPROC\_SERVER, 
    IID\_IWbemLocator, (LPVOID \*) &pLoc);

if (FAILED(hres))
{
    cout << "Failed to create IWbemLocator object."
        << " Err code = 0x"
        << hex << hres << endl;
    CoUninitialize();
    return 1;                 // Program has failed.
}

// Step 4: -----------------------------------------------------
// Connect to WMI through the IWbemLocator::ConnectServer method

IWbemServices \*pSvc = NULL;

// Connect to the root\\cimv2 namespace with
// the current user and obtain pointer pSvc
// to make IWbemServices calls.
hres = pLoc->ConnectServer(
     \_bstr\_t(L"ROOT\\\\CIMV2"), // Object path of WMI namespace
     NULL,                    // User name. NULL = current user
     NULL,                    // User password. NULL = current
     0,                       // Locale. NULL indicates current
     NULL,                    // Security flags.
     0,                       // Authority (e.g. Kerberos)
     0,                       // Context object 
     &pSvc

[Supriya Tonape]

Mark :))))))))))))))))))))))))))) U are genious ! I am getting the name now :))thank you so much!!!!!!! Have a gr8 day ahead ! Best Regards, Supriya Tonape.

[Mark Salsbery]

You're welcome. You have a great day as well! :) Cheers, Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

I am still wondering what exact mistake i was doing, all flags were set properly.. let me check in detail so I wont make it in future. Thx so much again. ! :) Regards, Supriya Tonape.

[Mark Salsbery]

Also, if you remove the "WHERE LogonType = 2 OR LogonType = 10" from the outer query, you can see all logon sessions, not just the interactive ones. :) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java: