Determining if Current User is Authenticated

Question:

Is there a way to tell if the current user is currently authenticated to a domain? I have tried a few things but keep can't seem to get around local cached credentials.

Answer:

This question comes up a lot and I don't known of a definitive answer. I can think of one untested possibility.

If you are using an Active Directory based Windows network you, could try using the root LDAP object to get the default server DN. If you get that far you could use the DN to query some property of the server. If any of these steps fail, you might be able to assume that the user is not authenticated on the domain.

I have not tried this so I don't know if it works. It certainly could produce false negatives, if the server were temporarily unavailable for some reason.

You could use either WB COM Automation or the ADSI extender to write an experimental script. You would have to turn off and then on error message display at each check or it would error and exit when the user was not authenticated on the network. This can be done with judicious use of the ErrorMode function.

MHR>

Answer 2:

If running on WinNT v4.0 & Win2K :

if local pc name = environment variable LOGONSERVER then you are using cached credentials (otherwise it should be a domain controller)

localpc = StrUpper(ItemExtract(1,WinSysinfo(),@tab))
logonserver = StrUpper(Environment("LOGONSERVER"))
logonserver = StrReplace(logonserver,"\","");remove leading slashes

if localpc == logonserver
	 Message("Notice","You are using cached credentials")
else
	 Message("Notice","You are NOT using cached credentials")
endif
exit

On WinXP & Win2K3, the LOGONSERVER env var always shows the actual DC name even if you logged on locally using cached credentials. That would make the use of LOGONSERVER as a means of detecting cached credentials only a partial solution depending on the version of Windows that you are using.

The discussion that I was having with some Microsoft Windows product development engineers & Windows MVP's revealed that the behavior in WinNT/Win2K was considered to be a result of lax security and was cleaned up in WinXP & newer so that you can't tell if your credentials are cached or not.

We are still searching for something more definitive & reliable, such as a flag bit in the access token or something like that which clearly indicates that the credentials are cached.

Article ID:   W17057

File Created: 2007:07:03:14:28:02

Last Updated: 2007:07:03:14:28:02

Database Search

TechHome