如何编程实现"让Administrator只能本机登陆,而远程无法用administrator登陆"

用WMI应该可以实现吧。具体我没弄过，你找点资料看看。
要不你问问jiangsheng，他应该知道。
For Windows Server 2003 and Windows XP， use the Win32_TokenGroups and the Win32_TokenPrivileges WMI Classes in \root\cimv2 namespace. For Windows 2000, use Ntrights.exe in the Windows 2000 Resource Kit. It is also included in Windows Server 2003 Resource Kit as well. Ntrights is a command-line tool that enables you to assign or revoke a right for a user or group of users on a local or remote computer. You can also place an entry that notes the change in the event log of the computer. Ntrights is useful in unattended or automated installations during which you might want to change the default rights. You can also use the tool in situations where you need to change a right in an existing installation, but you cannot access and log on to all computers.
int main (int argc, char * argv[])
{
if ( 2 != argc )
    {
        return( EXIT_FAILURE );
    }

    if ( FALSE == LocateNtdllEntry() )
    {
        return( EXIT_FAILURE );
    }

// 需要重新启动后才能生效

if ( 0 == strcmp(argv[1],"-a") )
{
AddUserPrivilege(L"SeDenyNetworkLogonRight");

}

return( EXIT_SUCCESS );
}
static BOOL AddUserPrivilege ( LPWSTR PrivilegeName )
{
    NTSTATUS              status;
    BOOL                  ret                 = FALSE;
    LSA_HANDLE            PolicyHandle        = NULL;
    LSA_OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE                CurrentProcessToken = NULL;
PTOKEN_GROUPS         token_user          = NULL; ////////////////////////////////////////////// BYTE                  sidBuffer[MAXSIZE_SID_BUFFER] = {0};
    PSID                  pUserSID=(PSID) &sidBuffer;              //声明一个SID，长度是1024
    DWORD                 sidBufferSize = MAXSIZE_SID_BUFFER;
    WCHAR                 domainBuffer[MAXSIZE_DOMAIN_BUFFER];
    DWORD                 domainBufferSize = MAXSIZE_DOMAIN_BUFFER;
    SID_NAME_USE          snu; LPUSER_INFO_0       pBuf = NULL;
LPUSER_INFO_0   pTmpBuf;
DWORD   dwLevel = 0;
DWORD   dwPrefMaxLen = MAX_PREFERRED_LENGTH;
DWORD   dwEntriesRead = 0;
DWORD   dwTotalEntries = 0;
DWORD   dwResumeHandle = 0;
DWORD   j;
NET_API_STATUS   nStatus;

//////////////////////////////////////////////////

    ZeroMemory( &ObjectAttributes, sizeof( ObjectAttributes ) );

status = LsaOpenPolicy( NULL, &ObjectAttributes, POLICY_ALL_ACCESS, &PolicyHandle );

if ( status != STATUS_SUCCESS )
    {
        PrintWin32Error( "LsaOpenPolicy() failed", LsaNtStatusToWinError( status ) );
        goto AddUserPrivilege_exit;
    } if ( FALSE == OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY, &CurrentProcessToken ) )
    {
        PrintWin32Error( "OpenProcessToken() failed", GetLastError() );
        goto AddUserPrivilege_exit;
    }

if ( NULL == ( token_user = ( PTOKEN_GROUPS )GetFromToken( CurrentProcessToken, TokenGroups ) ) )
    {
        goto AddUserPrivilege_exit;
    }

/////////////////////////2005-11-18/////////////////////////////////////

do // begin do
{
nStatus = NetUserEnum(NULL,
  dwLevel,
                  FILTER_NORMAL_ACCOUNT, // global users
                  (LPBYTE*)&pBuf,
                  dwPrefMaxLen,
                  &dwEntriesRead,
                  &dwTotalEntries,
                  &dwResumeHandle);

if ((nStatus == NERR_Success) || (nStatus == ERROR_MORE_DATA))
{
if ((pTmpBuf = pBuf) != NULL)
{
for (j = 0; (j < dwEntriesRead); j++)
{
BOOL bResult = FALSE;
assert(pTmpBuf != NULL);

if (pTmpBuf == NULL)
{
break;
}

wprintf(L"\t-- %s\n", pTmpBuf->usri0_name); sidBufferSize    = MAXSIZE_SID_BUFFER;
domainBufferSize = MAXSIZE_DOMAIN_BUFFER;

bResult = LookupAccountName(NULL, pTmpBuf->usri0_name, pUserSID,
  &sidBufferSize,
  domainBuffer,
  &domainBufferSize,
  &snu);

if(bResult)
{
if(!sidBufferSize)
{
PrintWin32Error( "LookupAccountName() failed", GetLastError() );
goto AddUserPrivilege_exit;
}

if ( FALSE == AddPrivilege( PolicyHandle,
                        pUserSID,
                        PrivilegeName ) )
{
goto AddUserPrivilege_exit;
}
}

pTmpBuf++;
}
}
}
else
{
goto AddUserPrivilege_exit;
}
}
while (nStatus == ERROR_MORE_DATA); // end do
    ret    = TRUE;

AddUserPrivilege_exit:

    if ( NULL != token_user )
    {
        free( token_user );
        token_user = NULL;
    }

if ( NULL != CurrentProcessToken )
    {
        CloseHandle( CurrentProcessToken );
        CurrentProcessToken = NULL;
    }

if ( NULL != PolicyHandle )
    {
        LsaClose( PolicyHandle );
        PolicyHandle = NULL;
    } if (pBuf != NULL)
{
NetApiBufferFree(pBuf);
pBuf = NULL;
}

return( ret );
}
static BOOL AddPrivilege ( LSA_HANDLE PolicyHandle, PSID AccountSid, LPWSTR PrivilegeName )
{
    LSA_UNICODE_STRING      UserRights;
    USHORT                  StringLength;
    NTSTATUS                status;

    if ( PrivilegeName == NULL )
    {
        return FALSE;
    }

StringLength             = wcslen( PrivilegeName );
    UserRights.Buffer        = PrivilegeName;
    UserRights.Length        = StringLength * sizeof( WCHAR );
    UserRights.MaximumLength = ( StringLength + 1 ) * sizeof( WCHAR );

    // LsaAddAccountRights function assigns one or more privileges to an account

status = LsaAddAccountRights( PolicyHandle, AccountSid, &UserRights, 1 );

if ( status != STATUS_SUCCESS )
    {
        PrintWin32Error( "LsaAddAccountRights() failed", LsaNtStatusToWinError( status ) );
        return FALSE;
    }

    return TRUE;
}
static PVOID GetFromToken ( HANDLE TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass )
{
    DWORD needed  = 0;
    PVOID buf     = NULL;
    DWORD error;
    BOOL  errflag = FALSE;

    //
if ( FALSE == GetTokenInformation( TokenHandle, TokenGroups, NULL, 0, &needed ) )
    {
        error = GetLastError();
        if ( error != ERROR_INSUFFICIENT_BUFFER )
        {
            PrintWin32Error( "GetTokenInformation() failed", error );
            errflag = TRUE;
            goto GetFromToken_exit;
        }
    }

if ( NULL == ( buf = calloc( needed, 1 ) ) )
    {
        fprintf( stderr, "calloc( %u, 1 ) failed\n", needed );
        goto GetFromToken_exit;
    }

if ( FALSE == GetTokenInformation( TokenHandle, TokenGroups, buf, needed, &needed ) )
    {
        PrintWin32Error( "GetTokenInformation() failed", GetLastError() );
        errflag = TRUE;
        goto GetFromToken_exit;
    }

GetFromToken_exit:

    if ( errflag == TRUE )
    {
        if ( buf != NULL )
        {
            free( buf );
            buf = NULL;
        }
    }

return( buf );
}// ntdll.dll输出了所有的Native API static BOOL LocateNtdllEntry ( void )
{
    BOOLEAN    bool_ret    = FALSE;
    LPCTSTR    NTDLL_DLL   = TEXT("ntdll.dll";)
    HMODULE    ntdll_dll   = NULL;

if ( ( ntdll_dll = GetModuleHandle( NTDLL_DLL ) ) == NULL )
    {
        PrintWin32Error( "GetModuleHandle() failed", GetLastError() );
        return( FALSE );
    }

if ( !( RtlNtStatusToDosError = ( RTLNTSTATUSTODOSERROR )GetProcAddress( ntdll_dll, "RtlNtStatusToDosError" ) ) )
    {
        goto LocateNtdllEntry_return;
    }

if ( !( ZwCreateToken = ( ZWCREATETOKEN )GetProcAddress( ntdll_dll, "ZwCreateToken" ) ) )
    {
        goto LocateNtdllEntry_return;
    }

bool_ret = TRUE;

LocateNtdllEntry_return:

    if ( FALSE == bool_ret )
    {
        PrintWin32Error( "GetProcAddress() failed", GetLastError() );
    }

ntdll_dll = NULL;

return( bool_ret );
}

调试易

如何编程实现"让Administrator只能本机登陆,而远程无法用administrator登陆"

解决方案 »