問題:通過LoadUserProfile API爲漫遊用戶創建漫遊用戶配置文件程序在Windows 2008
登錄和負荷分佈不正確創建配置文件。這隻發生在Windows 2008(UAC off和on)下。登錄使用標準的Windows登錄正常工作和相同的代碼工作正常在Windows 2003上
日誌:
- http://drop.io/6t2b3f3 通過命令創建用戶配置文件服務的ETL: logman - 啓動配置文件-p {eb7428f5 -ab1f-4322-a4cc-1f1a9b2c5e98} 255 3 -ets 該文件需要由有權訪問源的人進行分析,並希望能夠了解爲什麼配置文件始終以臨時文件加載的原因。
環境:
- 的Windows 2008模式域/林
- 服務器fs001 - 的Windows 2008標準版SP2 x86機器
- 文件共享上fs001 「分享」 與每個人+系統,具有全控制共享和NTFS。
重現:
- 與漫遊配置文件設置爲\ fs001 \共享\ tuser1 \簡介
- 運行該程序的任何域管理員和本地管理員帳戶上fs001創建域用戶tuser1 (如果UAC以管理員身份運行),臨時用戶配置文件將加載到c:\ users \ temp *而不是c:\ users \ tuser1中
ETL可能是最佳方式在這裏,並將提供最快捷的診斷。用戶配置文件服務svchost實例和系統級別跟蹤登錄的Procmon沒有透露太多有關錯誤的信息(如果需要,我可以提供更多信息,但它是死路一條)。 Windows 2003上的userenv.log會有所幫助,但ETL只能由MSFT的人員分析。
任何想法?
謝謝, 亞歷克斯
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;
namespace consoleLogon {
class Program {
#region Helpers for setting privilegies functionality
[StructLayout(LayoutKind.Sequential, Pack = 4)]
public struct LUID_AND_ATTRIBUTES {
public long Luid;
public int Attributes;
}
[StructLayout(LayoutKind.Sequential, Pack = 4)]
public struct TOKEN_PRIVILEGES {
public int PrivilegeCount;
public LUID_AND_ATTRIBUTES Privileges;
}
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool AdjustTokenPrivileges(
IntPtr TokenHandle,
bool DisableAllPrivileges,
ref TOKEN_PRIVILEGES NewState,
int BufferLength,
IntPtr PreviousState,
IntPtr ReturnLength
);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool LookupPrivilegeValue(
string lpSystemName,
string lpName,
ref long lpLuid
);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool OpenProcessToken(
IntPtr ProcessHandle,
int DesiredAccess,
ref IntPtr TokenHandle
);
public const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
public const int TOKEN_QUERY = 0x00000008;
public const int TOKEN_DUPLICATE = 0x00000002;
public const int TOKEN_IMPERSONATE = 0x00000004;
public const int SE_PRIVILEGE_ENABLED = 0x00000002;
public const string SE_RESTORE_NAME = "SeRestorePrivilege";
public const string SE_BACKUP_NAME = "SeBackupPrivilege";
[DllImport("advapi32.dll", SetLastError = true)]
static public extern bool LogonUser(String lpszUsername, String lpszDomain,
String lpszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
[DllImport("Userenv.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool LoadUserProfile(
IntPtr hToken, // user token
ref PROFILEINFO lpProfileInfo // profile
);
[DllImport("Userenv.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool UnloadUserProfile(
IntPtr hToken, // user token
IntPtr hProfile // handle to registry key
);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private extern static bool DuplicateToken(
IntPtr ExistingTokenHandle,
int SECURITY_IMPERSONATION_LEVEL,
ref IntPtr DuplicateTokenHandle
);
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct PROFILEINFO {
public static readonly int SizeOf = Marshal.SizeOf(typeof(PROFILEINFO));
public int dwSize; // Set to sizeof(PROFILEINFO) before calling
public int dwFlags; // See PI_ flags defined in userenv.h
public string lpUserName; // User name (required)
public string lpProfilePath; // Roaming profile path (optional, can be NULL)
public string lpDefaultPath; // Default user profile path (optional, can be NULL)
public string lpServerName; // Validating domain controller name in netbios format (optional, can be NULL but group NT4 style policy won't be applied)
public string lpPolicyPath; // Path to the NT4 style policy file (optional, can be NULL)
public IntPtr hProfile; // Filled in by the function. Registry key handle open to the root.
}
#endregion
static void Main(string[] args) {
string domain = "dev1";
string userName = "tuser1";
string password = "asd!234";
string profilePath = @"\\fs001\TestProfiles\tuser9\profile";
bool retVal = false;
IntPtr primaryToken = IntPtr.Zero;
IntPtr dupeToken = IntPtr.Zero;
PROFILEINFO profileInfo = new PROFILEINFO();
try {
// Add RESTORE AND BACUP privileges to process primary token, this is needed for LoadUserProfile function
IntPtr processToken = IntPtr.Zero;
OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref processToken);
long luidRestore = 0;
long luidBackup = 0;
retVal = LookupPrivilegeValue(null, SE_RESTORE_NAME, ref luidRestore);
retVal = LookupPrivilegeValue(null, SE_BACKUP_NAME, ref luidBackup);
TOKEN_PRIVILEGES tpRestore = new TOKEN_PRIVILEGES();
TOKEN_PRIVILEGES tpBackup = new TOKEN_PRIVILEGES();
tpRestore.PrivilegeCount = 1;
tpRestore.Privileges = new LUID_AND_ATTRIBUTES();
tpRestore.Privileges.Attributes = SE_PRIVILEGE_ENABLED;
tpRestore.Privileges.Luid = luidRestore;
tpBackup.PrivilegeCount = 1;
tpBackup.Privileges = new LUID_AND_ATTRIBUTES();
tpBackup.Privileges.Attributes = SE_PRIVILEGE_ENABLED;
tpBackup.Privileges.Luid = luidBackup;
retVal = AdjustTokenPrivileges(processToken, false, ref tpRestore, 0, IntPtr.Zero, IntPtr.Zero);
if (false == retVal) {
throw new Win32Exception();
}
retVal = AdjustTokenPrivileges(processToken, false, ref tpBackup, 0, IntPtr.Zero, IntPtr.Zero);
if (false == retVal) {
throw new Win32Exception();
}
// Logon as user + password in clear text for sake of simple sample (protocol transitioning is better).
retVal = LogonUser(userName, domain, password, 3 /* LOGON32_LOGON_NETWORK */, 0 /*LOGON32_PROVIDER_DEFAULT */, ref primaryToken);
if (false == retVal) {
throw new Win32Exception();
}
// Duplicate primary token.
// LoadUserProfile needs a token with TOKEN_IMPERSONATE and TOKEN_DUPLICATE access flags.
retVal = DuplicateToken(primaryToken, 2 /* securityimpersonation */, ref dupeToken);
if (false == retVal) {
throw new Win32Exception();
}
// Load user profile for roaming profile
profileInfo.dwSize = PROFILEINFO.SizeOf;
profileInfo.lpUserName = domain + @"\" + userName;
profileInfo.lpProfilePath = profilePath;
Console.WriteLine("UserName: {0}", profileInfo.lpUserName);
Console.WriteLine("ProfilePath: {0}", profileInfo.lpProfilePath);
retVal = LoadUserProfile(dupeToken, ref profileInfo);
if (false == retVal) {
throw new Win32Exception();
}
// What should happen
// 1. Local new profile in c:\users\tuser1.dev1 folder with copy from default.
// 2. Valid user registry hive ntuser.dat
// 3. Loaded profile session entry in the registry entry
// HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\SID of tuser1\
// State bit mask should have new local profile (x004), new central profile (x008),
// update the central profile (0010).
//
// "State"=dword:0000021c
// "CentralProfile"="\\fs001\Share\tuser1\profile.V2"
// "ProfileImagePath"="C:\Users\tuser1"
//
// See http://technet.microsoft.com/en-us/library/cc775560(WS.10).aspx fpr more info
// Roaming Profile - New User section.
//
// What actually happens:
// 1. Temp profile is loaded in c:\users\temp
// 2. Registry entry ProfieList/SID is showing temporary profile
// "State"=dword:00000a04
// "CentralProfile"="\\fs001\Share\tuser1\profile.V2"
// "ProfileImagePath"="C:\Users\TEMP"
Console.WriteLine("Profile loaded, hit enter to unload profile");
Console.ReadLine();
}
catch (Exception e) {
Console.WriteLine(e.ToString());
Console.ReadLine();
}
finally {
// Unload profile properly.
if (IntPtr.Zero != dupeToken) {
retVal = UnloadUserProfile(dupeToken, profileInfo.hProfile);
if (false == retVal) {
throw new Win32Exception();
}
}
}
}
}
}
當你得到用戶的令牌時,我沒有看到TOKEN_IMPERSONATE和TOKEN_DUPLICATE被請求作爲特權...有時他們在那裏,但明確地要求他們可能引發一個失敗,指出你在正確的方向。 – 2011-08-28 14:04:29
另外,如果這些基於bool的函數目前失敗了,它們將不會給你帶來任何幫助,因爲它們不會捕獲Win32的最後一個錯誤。查看這篇博客文章,瞭解如何操作的快速示例: http://blogs.msdn.com/b/adam_nathan/archive/2003/04/25/56643.aspx – 2011-08-28 14:07:51