尝试为vb.net win表单应用程序登录时，它仅允许特定组中的域用户。 使用advapi32.dll API LogonUser时，我没有正确设置标志，或者发生了其他未知事件。
出于兴趣，多年以来，我已经知道在多台计算机上使用具有相同用户名和密码的本地用户可以进行简单的用户管理，而无需在（例如：在家）之间共享文件的完整域。计算机上的政策将其关闭-请注意是否知道？？
在域计算机上使用时，登录类型（INTERACTIVE，NETWORK，BATCH，NEW_CREDENTIALS）的参数似乎都可以正常工作。
在工作组计算机上使用时，例如：在与域相同的网络上的工作组“ WORKGROUP”中，但不在该域中，因此我尝试使用的任何组合均无法使用。如果您使用的帐户（例如：MyDomain \ User1）作为MyComputer \ User1存在，则无论在“呼叫”中将域指定为“ MyDomain”，它都会返回MyComputer \ User1。 这台计算机可以与域共享进行通信（通过登录）-因此，我希望能够仅出于登录屏幕（如果可用）登录到域。这根本不是出于假冒的原因，只是为了证明您是谁，而不论是使用Work Domain PC还是BYOD。
此处包含一些代码：
Public Class WinSecurity
Private Declare Auto Function LogonUser Lib "advapi32.dll" (
ByVal lpszUsername As String,
ByVal lpszDomain As String,
ByVal lpszPassword As String,
ByVal dwLogonType As Integer,
ByVal dwLogonProvider As Integer,
ByRef phToken As IntPtr) As Boolean
Private Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal handle As IntPtr) As Boolean
Public Const LOGON32_LOGON_INTERACTIVE As Long = 2
Public Const LOGON32_LOGON_NETWORK As Long = 3
Public Const LOGON32_LOGON_BATCH As Long = 4
Public Const LOGON32_LOGON_SERVICE As Long = 5
Public Const LOGON32_LOGON_CLEARTEXT As Long = 8
Public Const LOGON32_LOGON_NEW_CREDENTIALS As Long = 9
Public Const LOGON32_PROVIDER_DEFAULT As Long = 0
Public Const LOGON32_PROVIDER_WINNT50 As Long = 3
Public Const LOGON32_PROVIDER_WINNT40 As Long = 2
Public Const LOGON32_PROVIDER_WINNT35 As Long = 1
Public Shared Function checkUserLogin(ByVal LoginCode As String, ByVal Password As String, ByVal Domain As String, Login As integer, Provider As integer) As WindowsIdentity
Dim token As IntPtr
LogonUser(LoginCode, Domain, Password, Login, Provider, token)
If (token.ToInt32 > 0) Then
Dim newId As New WindowsIdentity(token)
Track.LogDEBUG(String.Format("Attempto PASS: {0}, Auth: {1}, method: {2}, Provider: {3}", newId.Name, newId.Token, Login, Provider))
CloseHandle(token)
Else
Track.LogDEBUG(String.Format("Attempto FAIL: {0}, Auth: {1}, method: {2}, Provider: {3}", LoginCode, Domain, Login, Provider))
End If
End Function
End Class
''Calling Code
dim sDomain as string = "MyDomain"
WinSecurity.checkUserLogin(txtUserName.Text, txtPassword.Text, sDomain, WinSecurity.LOGON32_LOGON_INTERACTIVE, WinSecurity.LOGON32_PROVIDER_DEFAULT)
WinSecurity.checkUserLogin(txtUserName.Text, txtPassword.Text, sDomain, WinSecurity.LOGON32_LOGON_NETWORK, WinSecurity.LOGON32_PROVIDER_DEFAULT)
WinSecurity.checkUserLogin(txtUserName.Text, txtPassword.Text, sDomain, WinSecurity.LOGON32_LOGON_BATCH, WinSecurity.LOGON32_PROVIDER_DEFAULT)
WinSecurity.checkUserLogin(txtUserName.Text, txtPassword.Text, sDomain, WinSecurity.LOGON32_LOGON_NEW_CREDENTIALS, WinSecurity.LOGON32_PROVIDER_DEFAULT)
WinSecurity.checkUserLogin(txtUserName.Text, txtPassword.Text, sDomain, WinSecurity.LOGON32_LOGON_INTERACTIVE, WinSecurity.LOGON32_PROVIDER_DEFAULT)
注意：测试工作组计算机正在运行“ Windows Server 2012 RC2”，但假定Win10的结果相同，等等，不在域中。
我在工作组计算机上的结果-本地用户处于活动状态：
Attempto PASS: MyComputer\User1, Auth: 1088, method: 2, Provider: 0
Attempto PASS: MyComputer\User1, Auth: 1100, method: 3, Provider: 0
Attempto PASS: MyComputer\User1, Auth: 1060, method: 4, Provider: 0
Attempto PASS: MyComputer\LoggedOnUser, Auth: 1108, method: 9, Provider: 0
Attempto PASS: MyComputer\User1, Auth: 1076, method: 2, Provider: 0
工作组计算机上的结果-本地用户已禁用/未退出：
Attempto FAIL: User1, Auth: MyDomain, method: 2, Provider: 0
Attempto FAIL: User1, Auth: MyDomain, method: 3, Provider: 0
Attempto FAIL: User1, Auth: MyDomain, method: 4, Provider: 0
Attempto FAIL: User1, Auth: MyDomain, method: 9, Provider: 0
Attempto FAIL: User1, Auth: MyDomain, method: 2, Provider: 0
域计算机上的结果
Attempto PASS: MyDomain\User1, Auth: 1340, method: 2, Provider: 0
Attempto PASS: MyDomain\User1, Auth: 1724, method: 3, Provider: 0
Attempto PASS: MyDomain\User1, Auth: 1736, method: 4, Provider: 0
Attempto PASS: MyDomain\User1, Auth: 1648, method: 9, Provider: 0
Attempto PASS: MyDomain\User1, Auth: 1744, method: 2, Provider: 0
显然我没有对此计算机进行信任设置，但是我假设如果可以浏览到网络共享，类似的东西仍然可以正常工作？
欢呼
答案 0 :(得分：0)
猜测我将不得不改用directoryservices方法。