Getting NULL value from 'Win32_LogonSession' through WMI [modified]

[David Crow]

Strange. I couldn't get any of the fields to return a non-null value. Can you use GetUserName() instead?

"Love people and use things, not love things and use people." - Unknown

"The brick walls are there for a reason...to stop the people who don't want it badly enough." - Randy Pausch

[Supriya Tonape]

'GetUserName' returns user associated with the current thread only. I wanted to run my program on any host machine and get all usernames who are logged on that host machine n has active sessions...

[David Crow]

Supriya Tonape wrote:

I wanted to run my program on any host machine and get all usernames who are logged on that host machine...

Can you use NetWkstaUserEnum()?

"Love people and use things, not love things and use people." - Unknown

"The brick walls are there for a reason...to stop the people who don't want it badly enough." - Randy Pausch

[Supriya Tonape]

Thanks but my requirement is that I have to get these names through WMI only. In fact after you told I tried API NetWkstaUserEnuma() and got Usernames too! but I donno whats gng wrong to not give me results...

[Supriya Tonape]

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ? I am getting this though! I guess there shud be some way by using this ID I can get the required name. any suggestion ?

[Mark Salsbery]

Supriya Tonape wrote:

any idea how can I get the username from {Win32_LogonSession.LogonId="50493851"} ?

Try:

#include <ntsecapi.h>
#pragma comment(lib, "Secur32.lib")
...

LUID luid;
luid.HighPart = 0;
luid.LowPart = 50493851;
PSECURITY\_LOGON\_SESSION\_DATA pLogonSessionData;
if (0 == ::LsaGetLogonSessionData(&luid, &pLogonSessionData))
{
    // user name is pLogonSessionData->UserName

    ::LsaFreeReturnBuffer(pLogonSessionData);
}

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Thx Mark but I wanna use these APIs(Win32_LogonSession,Win32_LoggedOnUser etc) only so it will be gr8 help if you can tell me how to get my required info thru them... Any idea how to use "Win32_LoggedOnUser.Antecedent" when I have 'LoginID' of user ? Regards, Supriya Tonape

[Mark Salsbery]

Here's some C# that lists the interactive sessions - you should be able to extract the right queries from this...

ManagementObjectSearcher logonsessionsearcher = new ManagementObjectSearcher("SELECT * FROM Win32_LogonSession Where LogonType = 2 OR LogonType = 10");
foreach (ManagementObject logonsession in logonsessionsearcher.Get())
{
Console.WriteLine("LogonId: {0}", logonsession["LogonId"].ToString());
Console.WriteLine("LogonType: {0}", logonsession["LogonType"].ToString());

ManagementObjectSearcher associationsearcher = new ManagementObjectSearcher("Associators of {Win32\_LogonSession.LogonId=" + logonsession\["LogonId"\].ToString() + "} Where AssocClass=Win32\_LoggedOnUser Role=Dependent");
foreach (ManagementObject association in associationsearcher.Get())
{
    Console.WriteLine("   Name: {0}", association\["Name"\].ToString());
    Console.WriteLine("   Domain: {0}", association\["Domain"\].ToString());
}
Console.WriteLine("");

}

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Thx Mark I will see how I can do this in C++. I guess we cant use this "Associators of {Win32_LogonSession.LogonId=" etc. in C++ so I need to check out the way how i can accomplish it in C++... I am not getting that though and tried multiple queries/combinations in C++ already... will check.. :( :confused: I am :~ though. Regards, Supriya Tonape.

[Mark Salsbery]

How do you do WMI queries in C++? I've always used .NET like shown which is the same in C++ or C#. The query should be the same in native C++ I would think...

Associators of {Win32_LogonSession.LogonId=50493851} Where AssocClass=Win32_LoggedOnUser Role=Dependent

where 50493851 is the logon session ID (insert an actual ID) Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Mark Salsbery]

I just looked at this link Example: Getting WMI Data from the Local Computer[^] and it looks like query text just like I used. The "while (pEnumerator)" loop is the same as my foreach loop. Where's the problem? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Yes I am using the same for looping. But I am not getting 'Name'field when I query diretly to 'Win32_LogonSession'class. There is some other way for it.. I am new to WMI stuff.. thru Win32_LoggedOnUser i shud get it but I am exploring it...I will try the query you had given me above.. Regards, Supriya Tonape

[Supriya Tonape]

Nope that query is not working. I am getting 'Win32_LogonSession.LogonId' after executing query : "SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10" what are next steps ? (in C++) Regards, Supriya Tonape

[Mark Salsbery]

Supriya Tonape wrote:

I am getting 'Win32_LogonSession.LogonId'

I thought you were already able to get the LogonId and you needed to get the name? To get the user name from the Win32_LoggedOnUser class, you need to do the second query I showed you using the LogonId from the query you've already done.

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

Yes I am getting LogonId ! Second query is not working for me... Regards, Supriya Tonape

[Mark Salsbery]

What does the code look like? Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

It returns S_FALSE at line "HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1);" which is in last. I really donno if I doing right things... plz have a look,, int WMIScannerModule::GetRemoteLoggedOnUsers(IWbemServices *pSvc,pWMIScanParams pScanParams) { HRESULT hres = WBEM_S_NO_ERROR; IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t("SELECT * FROM Win32_LogonSession WHERE LogonType = 2 OR LogonType = 10"), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { pSvc->Release(); return WBEM_S_FALSE; // Program has failed. } IWbemClassObject *pclsObj; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn) { ErrorInfo(hres,11); break; } VARIANT vtProp; VariantClear(&vtProp); // Get the value of the Name property hr = pclsObj->Get(_bstr_t(L"LogonId"), 0, &vtProp, 0, 0); printf("Logon ID : %s",vtProp.bstrVal); wstring wstrQuery = L"Associators of {Win32_LogonSession.LogonId="; wstrQuery += vtProp.bstrVal; wstrQuery += L"} Where AssocClass=Win32_LoggedOnUser Role=Dependent"; IEnumWbemClassObject* pEnumerator1 = NULL; hres = pSvc->ExecQuery( bstr_t("WQL"), bstr_t(wstrQuery.c_str()), WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator1); IWbemClassObject *pclsObj1; ULONG uReturn1 = 0; HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); if(0 == uReturn1) { ErrorInfo(hres,11); break; } VARIANT vtProp1; hr1 = pclsObj->Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0); printf("User Name : %s",vtProp1.bstrVal); } return 0; }

[Mark Salsbery]

Excellent thank you :) Change

hr1 = pclsObj->>Get(_bstr_t(L"Win32_LogonSession.Name"), 0, &vtProp1, 0, 0);

to this (changes marked in red)

hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0);

Mark

Mark Salsbery Microsoft MVP - Visual C++ :java:

[Supriya Tonape]

I had already tried that! It's not working as 'hr1' is getting as S_FALSE error and so 'vtProp1' is NULL for the time being... HRESULT hr1 = pEnumerator1->Next(WBEM_INFINITE, 1, &pclsObj1, &uReturn1); VARIANT vtProp1; hr1 = pclsObj1->Get(_bstr_t(L"Name"), 0, &vtProp1, 0, 0); :confused: Regards, Supriya Tonape

[Mark Salsbery]

hmm I tested it and it worked for me... Here's my test code - I took your code and added stuff to the top (copied right from that MSDN sample code) for me to build it...

int GetRemoteLoggedOnUsers()
{
HRESULT hres = WBEM_S_NO_ERROR;

//hres =  CoInitializeSecurity(
//    NULL, 
//    -1,                          // COM authentication
//    NULL,                        // Authentication services
//    NULL,                        // Reserved
//    RPC\_C\_AUTHN\_LEVEL\_DEFAULT,   // Default authentication 
//    RPC\_C\_IMP\_LEVEL\_IMPERSONATE, // Default Impersonation  
//    NULL,                        // Authentication info
//    EOAC\_NONE,                   // Additional capabilities 
//    NULL                         // Reserved
//    );

//                  
//if (FAILED(hres))
//{
//    cout << "Failed to initialize security. Error code = 0x" 
//        << hex << hres << endl;
//    CoUninitialize();
//    return 1;                    // Program has failed.
//}

// Step 3: ---------------------------------------------------
// Obtain the initial locator to WMI -------------------------

IWbemLocator \*pLoc = NULL;

hres = CoCreateInstance(
    CLSID\_WbemLocator,             
    0, 
    CLSCTX\_INPROC\_SERVER, 
    IID\_IWbemLocator, (LPVOID \*) &pLoc);

if (FAILED(hres))
{
    cout << "Failed to create IWbemLocator object."
        << " Err code = 0x"
        << hex << hres << endl;
    CoUninitialize();
    return 1;                 // Program has failed.
}

// Step 4: -----------------------------------------------------
// Connect to WMI through the IWbemLocator::ConnectServer method

IWbemServices \*pSvc = NULL;

// Connect to the root\\cimv2 namespace with
// the current user and obtain pointer pSvc
// to make IWbemServices calls.
hres = pLoc->ConnectServer(
     \_bstr\_t(L"ROOT\\\\CIMV2"), // Object path of WMI namespace
     NULL,                    // User name. NULL = current user
     NULL,                    // User password. NULL = current
     0,                       // Locale. NULL indicates current
     NULL,                    // Security flags.
     0,                       // Authority (e.g. Kerberos)
     0,                       // Context object 
     &pSvc