How to enumerate Windows user accounts?

[=?Utf-8?B?am1hZ2FyYW0=?=]

I'm trying to get a list of user accounts on the local computer - the same
list you see when you are about to log in to Windows XP or Vista. This needs
to work on a home computer (not connected to a domain). It's for a parental
control app where I want the parent to be able to assign rules for each
child's account. I've tried using the Win32 API
LsaEnumerateAcc ountsWithUserRi ght with the SE_INTERACTIVE_ LOGON_NAME
privilege, but it doesn't work. I tried passing in NULL as the UserRights
parameter, which is supposed to return ALL accounts, but I get back a list
which has the built-in accounts and a few others (see below), but not one
single normal user account. I just want the accounts for people who can log
on interactively. I'd prefer if there was a fully .NET C# solution but I'll
do Win32 if I have to. Should I be using LsaLookupNames2 instead?

NT AUTHORITY\SERVI CE
BUILTIN\Remote Desktop Users
BUILTIN\Backup Operators
BUILTIN\Users
BUILTIN\Adminis trators
Justin-Laptop\Guest
Justin-Laptop\SQLServe r2005MSSQLUser$ Justin-Laptop$SQLEXPRE SS
Justin-Laptop\SQLServe r2005SQLBrowser User$Justin-Laptop
NT AUTHORITY\NETWO RK SERVICE
NT AUTHORITY\LOCAL SERVICE
Everyone

[=?Utf-8?B?am1hZ2FyYW0=?=]

This code seems to be heading in the right direction. But I really need the
SID for each account. And I'm not sure what groups to enumerate to match what
you see when you log in to Windows XP or Vista. This ActiveDirectory stuff is
new to me.

DirectoryEntry localMachine = new DirectoryEntry( "WinNT://" +
Environment.Mac hineName);
DirectoryEntry admGroup = localMachine.Ch ildren.Find("ad ministrators",
"group");
object members = admGroup.Invoke ("members", null);
foreach (object groupMember in (IEnumerable)me mbers) {
DirectoryEntry member = new DirectoryEntry( groupMember);
Console.WriteLi ne(member.Name) ;
}
"jmagaram" wrote:

I'm trying to get a list of user accounts on the local computer - the same
list you see when you are about to log in to Windows XP or Vista. This needs
to work on a home computer (not connected to a domain). It's for a parental
control app where I want the parent to be able to assign rules for each
child's account. I've tried using the Win32 API
LsaEnumerateAcc ountsWithUserRi ght with the SE_INTERACTIVE_ LOGON_NAME
privilege, but it doesn't work. I tried passing in NULL as the UserRights
parameter, which is supposed to return ALL accounts, but I get back a list
which has the built-in accounts and a few others (see below), but not one
single normal user account. I just want the accounts for people who can log
on interactively. I'd prefer if there was a fully .NET C# solution but I'll
do Win32 if I have to. Should I be using LsaLookupNames2 instead?

NT AUTHORITY\SERVI CE
BUILTIN\Remote Desktop Users
BUILTIN\Backup Operators
BUILTIN\Users
BUILTIN\Adminis trators
Justin-Laptop\Guest
Justin-Laptop\SQLServe r2005MSSQLUser$ Justin-Laptop$SQLEXPRE SS
Justin-Laptop\SQLServe r2005SQLBrowser User$Justin-Laptop
NT AUTHORITY\NETWO RK SERVICE
NT AUTHORITY\LOCAL SERVICE
Everyone

[=?Utf-8?B?U2l2YSBN?=]

Try this inside the for loop:

string sid = new
SecurityIdentif ier((byte[])member.Propert ies["objectSid"][0], 0).Value;
Console.WriteLi ne (sid);

This works with .NET 2.0 onwards.

"jmagaram" wrote:

This code seems to be heading in the right direction. But I really need the
SID for each account. And I'm not sure what groups to enumerate to match what
you see when you log in to Windows XP or Vista. This ActiveDirectory stuff is
new to me.

DirectoryEntry localMachine = new DirectoryEntry( "WinNT://" +
Environment.Mac hineName);
DirectoryEntry admGroup = localMachine.Ch ildren.Find("ad ministrators",
"group");
object members = admGroup.Invoke ("members", null);
foreach (object groupMember in (IEnumerable)me mbers) {
DirectoryEntry member = new DirectoryEntry( groupMember);
Console.WriteLi ne(member.Name) ;
}
"jmagaram" wrote:

I'm trying to get a list of user accounts on the local computer - the same
list you see when you are about to log in to Windows XP or Vista. This needs
to work on a home computer (not connected to a domain). It's for a parental
control app where I want the parent to be able to assign rules for each
child's account. I've tried using the Win32 API
LsaEnumerateAcc ountsWithUserRi ght with the SE_INTERACTIVE_ LOGON_NAME
privilege, but it doesn't work. I tried passing in NULL as the UserRights
parameter, which is supposed to return ALL accounts, but I get back a list
which has the built-in accounts and a few others (see below), but not one
single normal user account. I just want the accounts for people who can log
on interactively. I'd prefer if there was a fully .NET C# solution but I'll
do Win32 if I have to. Should I be using LsaLookupNames2 instead?

NT AUTHORITY\SERVI CE
BUILTIN\Remote Desktop Users
BUILTIN\Backup Operators
BUILTIN\Users
BUILTIN\Adminis trators
Justin-Laptop\Guest
Justin-Laptop\SQLServe r2005MSSQLUser$ Justin-Laptop$SQLEXPRE SS
Justin-Laptop\SQLServe r2005SQLBrowser User$Justin-Laptop
NT AUTHORITY\NETWO RK SERVICE
NT AUTHORITY\LOCAL SERVICE
Everyone