views:

59

answers:

1

I am attempting to retrieve the log-in accounts that are actually visible when Windows first loads (XP, Vista and 7).

I am able to enumerate all accounts (thanks to this code: freevbcode.com), however this particular function enumerates all system user accounts (Administrator, Guest, HomeGroupUser$, LogMeInRemoteUser, etc.) whether they appear on the log-in screen or not. How do I distinguish between visible and not-visible accounts?

+1  A: 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList has a list, read the DWORD there and bitwise AND it with 1, if that is <> 0 (or there is no entry at all for the username) then the account is visible on the Welcome Screen

(Note: That registry key and the meaning of the dword value is undocumented AFAIK)

Anders
I checked this key on XP and 7 and it doesn't seem to be comprehensive. Win7 for example only had the LogMeInRemoteUser account listed, ignoring other enumerated accounts, such as __vmware_user__ (a hidden account created by VMware).Looking into it further, a solution would appear to exist in one of the many USER_INFO structures. The NetUserGetInfo API (http://msdn.microsoft.com/en-us/library/bb706729.aspx) links to many of them. Not sure yet which one will give a sure-fire answer though.
Joe
@Joe: You might need some extra checks, make sure the account is a member of a "user group" like Admins or Users etc (I thought that was somewhat implied since you need to filter away System and disabled accounts etc)
Anders