The MASM Forum Archive 2004 to 2012

General Forums => The Workshop => Topic started by: Darrel on April 24, 2009, 08:47:12 PM

Title: Enumerate Users
Post by: Darrel on April 24, 2009, 08:47:12 PM
I'm looking for a method to find all the user accounts on a computer.

Thanks for your time and consideration,

Darrel
Title: Re: Enumerate Users
Post by: dedndave on April 24, 2009, 09:30:22 PM
Query the registry - best way
there are certain numbers set aside for certain "users"
administrator, default, so on
if i remember correctly, the first created user also always has a specific value
i saw these listed in a book about the system registry
i hope that helps you find the information

Title: Re: Enumerate Users
Post by: dedndave on April 24, 2009, 09:37:58 PM

http://support.microsoft.com/kb/154599

http://msdn.microsoft.com/en-us/library/ms162144(SQL.90).aspx
Title: Re: Enumerate Users
Post by: Darrel on April 24, 2009, 09:38:08 PM
It looks like I'm suppose to use NetQueryDisplayInformation. Will test it.
Title: Re: Enumerate Users
Post by: dedndave on April 27, 2009, 02:08:25 AM
you want to use that first link above and
RegOpenKeyEx / RegCloseKeyEx
RegQueryKeyEx
Title: Re: Enumerate Users
Post by: Obivan on April 28, 2009, 06:33:10 PM
Hi Darrel,

you must use the API NetUserEnum (http://msdn.microsoft.com/en-us/library/aa370652(VS.85).aspx") to do this.
Title: Re: Enumerate Users
Post by: Darrel on April 29, 2009, 03:21:23 AM
What I settled on.

Use NetQueryDisplayInformation (http://msdn.microsoft.com/en-us/library/aa370610(VS.85).aspx) level 1 to fill an array of NET_DISPLAY_USER structures (they say to use this method over NetUserEnum). Go to the registry and open HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Profilelist then enumerate the subkeys and open them and retrieve the Sid values. Then using GetWellKnownUserSIDFromRID (http://support.microsoft.com/kb/288900) build the Sid, then use your NET_DISPLAY_USER.usri1_user_id and see if it matches any of the Sid values from the registry, if it does then NET_DISPLAY_USER.usri1_name is an actual user account.

Regards,

Darrel