c - NetLocalGroupAddMembers 返回成功，但未按预期工作

Question

LookupAccountName 有问题，wrote a question并发现我必须使用 LookupAccountName 两次才能工作。现在我尝试将 NetLocalGroupAddMembers 与我从 LookupAccountName 获得的 SID 一起使用，它返回成功，但新创建的用户不会添加到用户组。

我从 CreateWellKnownSid 获取用户组，使用 LookupAccountSid 将其转换为字符串，并通过转换带有 LookupAccountName.

的 SID 的第一个参数(新帐户名称)

编辑:

这是一组可测试的代码:

#include <Windows.h>
#include <tchar.h>
#include <wchar.h>
#include <LM.h>
#include <sddl.h>

#pragma comment(lib, "Netapi32.lib")
#define MAX_NAME 256

VOID ShowError(DWORD errorCode)
{
    //FormatMessageW
    DWORD flags = FORMAT_MESSAGE_ALLOCATE_BUFFER |
        FORMAT_MESSAGE_FROM_SYSTEM |
        FORMAT_MESSAGE_IGNORE_INSERTS;
    LPWSTR errorMessage;
    DWORD size = 0;

    if (!FormatMessageW(flags, NULL, errorCode, 0, (LPWSTR)&errorMessage, size, NULL))
    {
        fwprintf(stderr, L"Could not get the format message, error code: %u\n", GetLastError());
        exit(1);
    }

    wprintf(L"\n%s\n", errorMessage);

    LocalFree(errorMessage);
}


int wmain(int argc, WCHAR **argv)
{
    //NetUserAdd function
    NET_API_STATUS addUser;
    DWORD infoLevel = 1;        //USER_INFO_1
    USER_INFO_1 userData;
    DWORD paramError = 0;

    //LocalAlloc
    UINT memAttributes = LMEM_FIXED;
    DWORD sidSize = SECURITY_MAX_SID_SIZE;

    //CreateWellKnownSid
    WELL_KNOWN_SID_TYPE sidType = WinBuiltinUsersSid;
    PSID groupSID;

    //LookupAccountSid
    WCHAR name[MAX_NAME];
    DWORD nameSize = MAX_NAME;
    WCHAR domainName[MAX_NAME];
    DWORD domainNameSize = MAX_NAME;
    SID_NAME_USE accountType;

    //LookupAccountName
    LPCWSTR machine = NULL;
    BYTE accountSIDBuf[SECURITY_MAX_SID_SIZE];
    PSID accountSID = (PSID)accountSIDBuf;
    DWORD cbSid = 0;
    SID_NAME_USE typeOfAccount;
    /*WCHAR refDomain[MAX_NAME];*/
    DWORD cchRefDomain = 0;

    //NetLocalGroupAddMembers
    NET_API_STATUS localGroupAdd;
    DWORD levelOfData = 0;  //LOCALGROUP_MEMBERS_INFO_0
    LOCALGROUP_MEMBERS_INFO_0 localMembers;
    DWORD totalEntries = 0;


    if (argc != 2)
    {
        fwprintf(stderr, L"\nUsage: %s [UserName]\n", *argv);
        return 1;

    }

    //Set up USER_INFO_1 structure
    userData.usri1_name = argv[1];
    userData.usri1_password = NULL;
    userData.usri1_priv = USER_PRIV_USER;
    userData.usri1_home_dir = NULL;
    userData.usri1_comment = NULL;
    userData.usri1_flags = UF_SCRIPT;
    userData.usri1_script_path = NULL;

    addUser = NetUserAdd(NULL, infoLevel, (LPBYTE)&userData, &paramError);

    if (addUser != NERR_Success)
    {
        fwprintf(stderr, L"\nA system error has ocurred: %d\n", addUser);

        return 1;
    }
    else
    {

        //Let's allocate memory for the SID
        if (!(groupSID = LocalAlloc(memAttributes, sidSize)))   //if fails
        {
            ShowError(GetLastError());
            exit(1);

        }

        //Let's create a SID for Users group
        if (!CreateWellKnownSid(sidType, NULL, groupSID, &sidSize))
        {
            ShowError(GetLastError());
            exit(1);
        }
        else
        {

            if (!LookupAccountSidW(NULL, groupSID, name, &nameSize,
                domainName, &domainNameSize, &accountType))
            {
                ShowError(GetLastError());
                return 1;

            }

            if (!LookupAccountNameW(NULL, argv[1], NULL, &cbSid, NULL, &cchRefDomain, &typeOfAccount))
            {
                ShowError(GetLastError());
                /*exit(1);*/

            }

            PSID theSID;
            LPWSTR refDomainName = (LPWSTR)malloc(cchRefDomain * sizeof(WCHAR));

            if (!(theSID = LocalAlloc(memAttributes, cbSid)))
            {
                ShowError(GetLastError());
                exit(1);
            }

            if (refDomainName == NULL)
            {
                fwprintf(stderr, L"Error allocating memory for RefDomainName \n");
                exit(1);
            }

            //Here we go again! 
            if (!LookupAccountNameW(NULL, argv[1], theSID, &cbSid,
                refDomainName, &cchRefDomain, &typeOfAccount))
            {
                ShowError(GetLastError());
                exit(1);

            }

            //Here I should be able to use NetLocalGroupAddMembers
            //to add the user passed as argument to the Users group. 
            localMembers.lgrmi0_sid = theSID;

            localGroupAdd = NetLocalGroupAddMembers(NULL, name, levelOfData, (LPBYTE)&localMembers, totalEntries);

            if (localGroupAdd != NERR_Success)
            {
                ShowError(localGroupAdd);
                return 1;
            }
            else
            {

                ShowError(localGroupAdd);

            }

            LocalFree(theSID);
            free(refDomainName);

        }

        LocalFree(groupSID);
    }
    return 0;
}

这是我得到的结果，符合预期:

The data area passed to a system call is too small.

The operation completed successfully.

但是当我用 Net User 查询新创建的用户时，它说:

Local Group Memberships

Global Group Membership *None

它应该说本地组成员中的用户。

有什么帮助吗？

谢谢!

Answer 1

您正在使用 totalentries=0 调用 NetLocalGroupAddMembers，但您应该使用 1 调用它。

旁注:

有什么好的理由将所有变量放在顶部而不在需要的地方声明它们吗？位置可能已帮助您找到错误。

usri1_password 未记录为允许 NULL。

您确定要将 NULL 作为机器/系统名称传递到任何地方吗？有时这与“.”不同，参见示例 LookupAccountSidW。