c++windowswinapirdplocal-security-authority

How to determine whether an LSA session is active in Windows XP

I'm trying to get the list of users currently logged into a machine.

On Windows 7, I can call LsaEnumerateLogonSessions, then WTSQuerySessionInformation with WTSConnectState.

But on XP, each LSA session has 0 for the TS Session field (unless it's a Remote Desktop session), which always has WTSConnectState of WTSActive, and I end up listing all of the people who have logged out of the machine already. WTSQuerySessionInformation fails when the session is a Remote Desktop session.

Solution

  • I believe this codeproject article uses a workaround that might be what you are after, it enumerates all running processes, checking the AuthenticationId (TokenStatistics on the process token) against the list of LUID's LsaEnumerateLogonSessions gives you. This allows you to filter out stale LUID's