Getting NULL value from 'Win32_LogonSession' through WMI [modified]

[Supriya Tonape]

Nope that query is not working. I am getting 'Win32_LogonSession.LogonId' after executing query : "SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10" what are next steps ? (in C++) Regards, Supriya Tonape

[Mark Salsbery]

Supriya Tonape wrote:

I am getting 'Win32_LogonSession.LogonId'

I thought you were already able to get the LogonId and you needed to get the name? To get the user name from the Win32_LoggedOnUser class, you need to do the second query I showed you using the LogonId from the query you've already done.

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Yes I am getting LogonId ! Second query is not working for me... Regards, Supriya Tonape

[Mark Salsbery]

What does the code look like? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

It returns S_FALSE at line "HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1);" which is in last. I really donno if I doing right things... plz have a look,, int WMIScannerModule::GetRemoteLoggedOnUsers(IWbemServices *pSvc,pWMIScanParams pScanParams) { HRESULT hres = WBEM_S_NO_ERROR; IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t("SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10"), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { pSvc->Release(); return WBEM_S_FALSE; // Program has failed. } IWbemClassObject *pclsObj; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn) { ErrorInfo(hres,11); break; } VARIANT vtProp; VariantClear(&vtProp); // Get the value of the Name property hr = pclsObj->Get(_bstr_t(L"LogonId"), 0, &vtProp, 0, 0); printf("Logon ID : %s",vtProp.bstrVal); wstring wstrQuery = L"Associators of {Win32_LogonSession.LogonId="; wstrQuery += vtProp.bstrVal; wstrQuery += L"} Where AssocClass=Win32_LoggedOnUser Role=Dependent"; IEnumWbemClassObject* pEnumerator1 = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t(wstrQuery.c_str()), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator1); IWbemClassObject *pclsObj1; ULONG uReturn1 = 0; HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); if(0 == uReturn1) { ErrorInfo(hres,11); break; } VARIANT vtProp1; hr1 = pclsObj->Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0); printf("User Name : %s",vtProp1.bstrVal); } return 0; }

[Mark Salsbery]

Excellent thank you :) Change

hr1 = pclsObj->>Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0);

to this (changes marked in red)

hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0);

Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

I had already tried that! It's not working as 'hr1' is getting as S_FALSE error and so 'vtProp1' is NULL for the time being... HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); VARIANT vtProp1; hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0); :confused: Regards, Supriya Tonape

[Mark Salsbery]

hmm I tested it and it worked for me... Here's my test code - I took your code and added stuff to the top (copied right from that MSDN sample code) for me to build it...

int GetRemoteLoggedOnUsers()
{
HRESULT hres = WBEM_S_NO_ERROR;

//hres =  CoInitializeSecurity(
//    NULL, 
//    -1,                          // COM authentication
//    NULL,                        // Authentication services
//    NULL,                        // Reserved
//    RPC\_C\_AUTHN\_LEVEL\_DEFAULT,   // Default authentication 
//    RPC\_C\_IMP\_LEVEL\_IMPERSONATE, // Default Impersonation  
//    NULL,                        // Authentication info
//    EOAC\_NONE,                   // Additional capabilities 
//    NULL                         // Reserved
//    );

//                  
//if (FAILED(hres))
//{
//    cout << "Failed to initialize security. Error code = 0x" 
//        << hex << hres << endl;
//    CoUninitialize();
//    return 1;                    // Program has failed.
//}

// Step 3: ---------------------------------------------------
// Obtain the initial locator to WMI -------------------------

IWbemLocator \*pLoc = NULL;

hres = CoCreateInstance(
    CLSID\_WbemLocator,             
    0, 
    CLSCTX\_INPROC\_SERVER, 
    IID\_IWbemLocator, (LPVOID \*) &pLoc);

if (FAILED(hres))
{
    cout << "Failed to create IWbemLocator object."
        << " Err code = 0x"
        << hex << hres << endl;
    CoUninitialize();
    return 1;                 // Program has failed.
}

// Step 4: -----------------------------------------------------
// Connect to WMI through the IWbemLocator::ConnectServer method

IWbemServices \*pSvc = NULL;

// Connect to the root\\cimv2 namespace with
// the current user and obtain pointer pSvc
// to make IWbemServices calls.
hres = pLoc->ConnectServer(
     \_bstr\_t(L"ROOT\\\\CIMV2"), // Object path of WMI namespace
     NULL,                    // User name. NULL = current user
     NULL,                    // User password. NULL = current
     0,                       // Locale. NULL indicates current
     NULL,                    // Security flags.
     0,                       // Authority (e.g. Kerberos)
     0,                       // Context object 
     &pSvc

[Supriya Tonape]

Mark :))))))))))))))))))))))))))) U are genious ! I am getting the name now :))thank you so much!!!!!!! Have a gr8 day ahead ! Best Regards, Supriya Tonape.

[Mark Salsbery]

You're welcome. You have a great day as well! :) Cheers, Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

I am still wondering what exact mistake i was doing, all flags were set properly.. let me check in detail so I wont make it in future. Thx so much again. ! :) Regards, Supriya Tonape.

[Mark Salsbery]

Also, if you remove the "WHERE LogonType = 2 OR LogonType = 10" from the outer query, you can see all logon sessions, not just the interactive ones. :) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

yup Mark. You really made my day :) U have gr8 weekend ahead! Best Regards, Supriya.

[Mark Salsbery]

Supriya Tonape wrote:

U have gr8 weekend ahead!

Thank you....you too!

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Also in this code though I have kept 'logontype' as 2 and 10 to get only active user names, but it;s returning me all users those are Disc earlier...

[Mark Salsbery]

Supriya Tonape wrote:

but it;s returning me all users those are Disc earlier..

Which means what? :) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

:) actually i will check it.. I just need usernames who has active session.

[Supriya Tonape]

Hi Mark, I just realized that 2nd query which forms like "Associators of {Win32_LogonSession.LogonId=1121214} Where AssocClass=Win32_LoggedOnUser Role=Dependent" works for local machine but when I try to execute it on remote machine after above query executes, at next line it fails... Query execution passes but enumeration fails.. at below line, HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); I have been trying different things to check out but no luck, any idea why it cud be happening or is there any change in query while running on remote machine ? Regards, Supriya Tonape

[etaig]

Hi All, For some reason, when I add the following lines, to get the StartTime property value, the get function fails. Any ideas?

VARIANT vtProp2;
HRESULT hr2 = pclsObj1->Get(L"StartTime", 0, &vtProp2, 0, 0);
if(hr1 == S_OK)
{
SYSTEMTIME t;
int res = VariantTimeToSystemTime(vtProp2.dblVal, &t);
}