int
main(argc, argv)
int argc;
char *argv[];
{
NTSTATUS
status;
PSECURITY_LOGON_SESSION_DATA
// This structure contains information about a logon session.
data = NULL;
PLUID
/*
* The pointer receives the first element of an array of logon
* session identifiers.
*/
list;
ULONG
count;
int i;
char
username[MAX_PRINT_BUFFER],
logontype[MAX_PRINT_BUFFER],
package[MAX_PRINT_BUFFER],
domain[MAX_PRINT_BUFFER],
buffer[256];
/*
* The LsaEnumerateLogonSessions function retrieves the set of existing logon
* session identifiers (LUIDs) and the number of sessions.
*
* Parameters:
* LogonSessionCount [out]
* Pointer to a long integer that receives the number of elements
* returned in the array returned in LogonSessionList parameter.
*
* LogonSessionList [out]
* Address of a pointer to a LUID. The pointer receives the first
* element of an array of logon session identifiers.
* The memory used by the array is allocated by the LSA.
* When the array is no longer needed, call the LSAFreeReturnBuffer
* function to free it.
*
* Return Value:
* If the function succeeds, the return value is STATUS_SUCCESS.
* If the function fails, the return value is an NTSTATUS code indicating the reason.
*/
status = LsaEnumerateLogonSessions(&count, &list);
if (status != STATUS_SUCCESS)
{
GetNtStatusErrorText(status, buffer, 256);
fprintf(stderr, buffer);
return 1;
}
fprintf(stdout, " No. User LogonType Package Domain Error\n");
for (i = 0; i < 75; i++)
fprintf(stdout, "-");
fprintf(stdout, "\n");
// Process the array of session LUIDs...
for (i =0; i < count; i++)
{
lstrcpy(username, "-");
lstrcpy(logontype, username);
lstrcpy(package, username);
lstrcpy(domain, username);
data = NULL;
// Check for a valid session.
if (&list[i])
{
/*
* The LsaGetLogonSessionData function retrieves information
* about a specified logon session. To retrieve information about a logon session,
* the caller must be the owner of the session or a local system administrator.
*
* Parameters:
* LogonId [in]
* Specifies a pointer to a LUID that identifies the logon session whose
* information will be retrieved. For information about valid values for this parameter,
* see Remarks.
*
* ppLogonSessionData [out]
* Address of a pointer to a SECURITY_LOGON_SESSION_DATA structure containing
* information on the logon session specified by LogonId. This structure is allocated
* by the LSA. When the information is no longer needed, call the LSAFreeReturnBuffer
* function to free the memory used by this structure.
*
* Return Value:
* If the function succeeds, the return value is STATUS_SUCCESS.
* If the function fails, the return value is an NTSTATUS code indicating the reason.
*/
status = LsaGetLogonSessionData(&list[i], &data);
if (status != STATUS_SUCCESS)
{
// If have an error occurred.
GetNtStatusErrorText(status, buffer, 256);
// Free the memory returned by the LSA.
if (data)
LsaFreeReturnBuffer(data);
data = NULL;
}
else
// no data for session
lstrcpy(buffer, "Invalid session data.\n");
}
else
// no data for session
lstrcpy(buffer, "Invalid session data.\n");
// Determine whether there is session data to parse.
if (data)
{
// Get the user name.
PW2A(&data->UserName, username, MAX_PRINT_BUFFER);
// Get the authentication package name.
PW2A(&data->AuthenticationPackage, package, MAX_PRINT_BUFFER);
// Get the domain name.
PW2A(&data->LogonDomain, domain, MAX_PRINT_BUFFER);
// Get the logon type.
switch ((SECURITY_LOGON_TYPE)data->LogonType)
{
case Interactive:
lstrcpy(logontype, "Interactive");
break;
case Network:
lstrcpy(logontype, "Network");
break;
case Batch:
lstrcpy(logontype, "Batch");
break;
case Service:
lstrcpy(logontype, "Service");
break;
case Proxy:
lstrcpy(logontype, "Proxy");
break;
case Unlock:
lstrcpy(logontype, "Unlock");
break;
case NetworkCleartext:
lstrcpy(logontype, "NetworkCleartext");
break;
case NewCredentials:
lstrcpy(logontype, "NewCredentials");
break;
case RemoteInteractive:
lstrcpy(logontype, "RemoteInteractive");
break;
case CachedInteractive:
lstrcpy(logontype, "CachedInteractive");
break;
case CachedRemoteInteractive:
lstrcpy(logontype, "CachedRemoteInteractive");
break;
case CachedUnlock:
lstrcpy(logontype, "CachedUnlock");
break;
default:
lstrcpy(logontype, "Unknown");
}
lstrcpy(buffer, "\n");
// Free the session data.
LsaFreeReturnBuffer(data);
data = NULL;
}
// Adjust the length of print texts.
FillRightSpace(username, 16);
FillRightSpace(logontype, 15);
FillRightSpace(package, 12);
FillRightSpace(domain, 15);
FillRightSpace(buffer, 0);
fprintf(stdout, " %02u %s%s%s%s%s", i + 1, username, logontype, package, domain, buffer);
}
fprintf(stdout, "\n\tTotal %lu users.\n", count);
// Free the array of session LUIDs allocated by the LSA.
LsaFreeReturnBuffer(list);
return 0;
}
列举当前连接的会话
最新推荐文章于 2026-03-05 02:29:01 发布
本文详细介绍了如何在Windows系统中使用LSA(Local Security Authority)API来枚举并获取所有登录会话的详细信息,包括用户名、登录类型、认证包、所属域等。

7244

被折叠的 条评论
为什么被折叠?



