怎样通过程序修改Windows的登陆密码？up有分

[shicheng521]

知道用户名和当前的密码，怎样才能通过程序来修改密码？
都用到那些函数，
有代码的最好，贴出来或者发到
[e-mail]
都行。
up有分

[xuzheng318]

不清楚，帮楼主顶！

[shicheng521]

谢谢楼上的了，
自己再顶一下

[shicheng521]

#ifndef UNICODE
#define UNICODE
#endif

#include <stdio.h>
#include <windows.h>
#include <lm.h>

int wmain(int argc, wchar_t *argv[])
{
DWORD dwLevel = 1008;
USER_INFO_1008 ui;
NET_API_STATUS nStatus;

if (argc != 3)
{
fwprintf(stderr, L"Usage: %s \\\\ServerName UserName\n", argv[0]);
exit(1);
}
// Fill in the USER_INFO_1008 structure member.
// UF_SCRIPT: required for LAN Manager 2.0 and
// Windows NT/Windows 2000.
//
ui.usri1008_flags = UF_SCRIPT | UF_ACCOUNTDISABLE;
//
// Call the NetUserSetInfo function
// to disable the account, specifying level 1008.
//
nStatus = NetUserSetInfo(argv[1],
argv[2],
dwLevel,
(LPBYTE)&ui,
NULL);
//
// Display the result of the call.
//
if (nStatus == NERR_Success)
fwprintf(stderr, L"User account %s has been disabled\n", argv[2]);
else
fprintf(stderr, "A system error has occurred: %d\n", nStatus);

return 0;
}

vc知识库杨老师给我的答复

[galaxy_fxstar]

楼上的代码是禁用一个用户的,
ui.usri1008_flags = UF_SCRIPT | UF_ACCOUNTDISABLE
定义了所想要进行的操作,但我查了一下msdn,没有修改密码的选项,不过有密码无效化的选项.
以下是msdn中对这个标志量的描述:



The USER_INFO_1008 structure contains user information for network accounts.

typedef struct _USER_INFO_1008 {
DWORD usri1008_flags;
} USER_INFO_1008, *PUSER_INFO_1008, *LPUSER_INFO_1008;

Members
usri1008_flags
Contains values that determine several features. This member can be any of the following values: Value Meaning
UF_SCRIPT The logon script executed. This value must be set for LAN Manager 2.0 or Windows NT.
UF_ACCOUNTDISABLE The user's account is disabled.
UF_HOMEDIR_REQUIRED The home directory is required. This value is ignored in Windows NT.
UF_PASSWD_NOTREQD No password is required.
UF_PASSWD_CANT_CHANGE The user cannot change the password.
UF_LOCKOUT The account is currently locked out. For NetUserSetInfo, this value can be cleared to unlock a previously locked account. This value cannot be used to lock a previously unlocked account.
UF_DONT_EXPIRE_PASSWD Windows NT: Represents the password, which should never expire on the account.

[shicheng521]

现在我的问题改了：知道用户名和密码，怎样通过远程来修改本地的注册表？
大家顶呀，只要顶就有分。

[flyelf]

gz

[shicheng521]

是不是通过代理这上面的网叶就打不开了？
一个上午没有打开一次，在不是代理的上面可以正常打开。

[shicheng521]

下面是在msdn上找的源代码，在本地上运行正常，远程出现最后提示的错误。谁能解释十怎么回事吗？Romote Registry Service服务已经打开。

/* Save HKEY_LOCAL_MACHINE registry key, each subkey saved to a file of
* name subkey
*
* this allows us to get around security restrictions which prevent
* the use of RegSaveKey() on the root key
*
* the optional target machine name is specified in argv[1]
*
* v1.21
* Scott Field (sfield) 01-Apr-1995
*/

#define RTN_OK 0
#define RTN_USAGE 1
#define RTN_ERROR 13

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

LONG SaveRegistrySubKey(HKEY hKey, LPTSTR szSubKey, LPTSTR szSaveFileName);
void PERR(LPTSTR szAPI, DWORD dwLastError);

int main(int argc, char *argv[])
{
TOKEN_PRIVILEGES tp;
HANDLE hToken;
LUID luid;
LONG rc; // contains error value returned by Regxxx()
HKEY hKey; // handle to key we are interested in
LPTSTR MachineName=NULL; // pointer to machine name
DWORD dwSubKeyIndex=0; // index into key
char szSubKey[_MAX_FNAME]; // this should be dynamic.
// _MAX_FNAME is good because this
// is what we happen to save the
// subkey as
DWORD dwSubKeyLength=_MAX_FNAME; // length of SubKey buffer

/*
if (argc != 2) // usage
{
fprintf(stderr,"Usage: %s [<MachineName>]\n", argv[0]);
return RTN_USAGE;
}
*/

// set MachineName == argv[1], if appropriate
if (argc == 2) MachineName=argv[1];

//
// enable backup privilege
//
if(!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES,
&hToken ))
{
PERR("OpenProcessToken", GetLastError() );
return RTN_ERROR;
}

if(!LookupPrivilegeValue(MachineName, SE_BACKUP_NAME, &luid))

{
PERR("LookupPrivilegeValue", GetLastError() );
return RTN_ERROR;
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES),
NULL, NULL );

if (GetLastError() != ERROR_SUCCESS)
{
PERR("AdjustTokenPrivileges", GetLastError() );
return RTN_ERROR;
}

// only connect if a machine name specified
if (MachineName != NULL)
{
if((rc=RegConnectRegistry(MachineName,
HKEY_LOCAL_MACHINE,
&hKey)) != ERROR_SUCCESS)
{
PERR("RegConnectRegistry", rc);
return RTN_ERROR;
}
}
else hKey=HKEY_LOCAL_MACHINE;

while((rc=RegEnumKeyEx(
hKey,
dwSubKeyIndex,
szSubKey,
&dwSubKeyLength,
NULL,
NULL,
NULL,
NULL)
) != ERROR_NO_MORE_ITEMS) { // are we done?

if(rc == ERROR_SUCCESS)
{
LONG lRetVal; // return value from SaveRegistrySubKey

#ifdef DEBUG
fprintf(stdout,"Saving %s\n", szSubKey);
#endif

// save registry subkey szSubKey to filename szSubKey
if( (lRetVal=SaveRegistrySubKey(hKey, szSubKey, szSubKey)
) != ERROR_SUCCESS)
{
PERR("SaveRegistrySubKey", lRetVal);
}

// increment index into the key
dwSubKeyIndex++;

// reset buffer size
dwSubKeyLength=_MAX_FNAME;

// Continue the festivities
continue;
}
else
{
//
// note: we need to watch for ERROR_MORE_DATA
// this indicates we need a bigger szSubKey buffer
//
PERR("RegEnumKeyEx", rc);
return RTN_ERROR;
}

} // RegEnumKeyEx

// close registry key we have been working with
RegCloseKey(hKey);

// Revoke all privileges this process holds (including backup)
AdjustTokenPrivileges( hToken, TRUE, NULL, 0, NULL, NULL);

// close handle to process token
CloseHandle(hToken);

return RTN_OK;
}

LONG SaveRegistrySubKey(
HKEY hKey, // handle of key to save
LPTSTR szSubKey, // pointer to subkey name to save
LPTSTR szSaveFileName // pointer to save path/filename
)
{
HKEY hKeyToSave; // Handle of subkey to save
LONG rc; // result code from RegXxx
DWORD dwDisposition;

if((rc=RegCreateKeyEx(hKey,
szSubKey, // Name of subkey to open
0,
NULL,
REG_OPTION_BACKUP_RESTORE, // in winnt.h
KEY_QUERY_VALUE, // minimal access
NULL,
&hKeyToSave,
&dwDisposition)
) == ERROR_SUCCESS)
{
// Save registry subkey. If the registry is remote, files will
// be saved on the remote machine
rc=RegSaveKey(hKeyToSave, szSaveFileName, NULL);

// close registry key we just tried to save
RegCloseKey(hKeyToSave);
}

// return the last registry result code
return rc;
}

void PERR(
LPTSTR szAPI, // pointer to failed API name
DWORD dwLastError // last error value associated with API
)
{
LPTSTR MessageBuffer;
DWORD dwBufferLength;

//
// TODO get this fprintf out of here!
//
fprintf(stderr,"%s error! (rc=%lu)\n", szAPI, dwLastError);

if(dwBufferLength=FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM,
NULL,
dwLastError,
LANG_NEUTRAL,
(LPTSTR) &MessageBuffer,
0,
NULL))
{


DWORD dwBytesWritten;

//
// Output message string on stderr
//
WriteFile(GetStdHandle(STD_ERROR_HANDLE),
MessageBuffer,
dwBufferLength,
&dwBytesWritten,
NULL);

//
// free the buffer allocated by the system
//
LocalFree(MessageBuffer);
}
}


下面是出现的错误：
SaveRegistrySubKey error! (rc=5)
拒绝访问。
SaveRegistrySubKey error! (rc=5)
拒绝访问。
SaveRegistrySubKey error! (rc=5)
拒绝访问。
SaveRegistrySubKey error! (rc=5)
拒绝访问。
SaveRegistrySubKey error! (rc=5)
拒绝访问。

[真糨糊]

up

[shicheng521]

自己up

[lpschenshengxue]

pu

[taianmonkey]

使用USER_INFO_1003和USER_INFO_1008结构来进行NetUserSetInfo设置！
必要时使用提升权限！

[taianmonkey]

通过远程来修改本地的注册表：
首先确定当前系统中的Remote Registry服务已经启动！
然后就可以操作了！

[taianmonkey]

from msdn
/*++

Module Name:

chngpass.c

Abstract:

This sample changes the password for an arbitrary user on an arbitrary
target machine.

When targeting a domain controller for account update operations,
be sure to target the primary domain controller for the domain.
The account settings are replicated by the primary domain controller
to each backup domain controller as appropriate. The NetGetDCName()
function call can be used to get the primary domain controller
computer name from a domain name.

Username is argv[1]
new password is argv[2]
optional target machine (or domain name) is argv[3]
optional old password is argv[4]. This allows non-admin password
changes.

Note that admin or account operator privilege is required on the
target machine unless argv[4] is present and represents the correct
current password.

NetUserSetInfo() at info-level 1003 is appropriate for administrative
override of an existing password.

NetUserChangePassword() allows for an arbitrary user to override
an existing password providing that the current password is confirmed.

Link with netapi32.lib

--*/

#include <windows.h>
#include <stdio.h>

#include <lm.h>

#define RTN_OK 0
#define RTN_USAGE 1
#define RTN_ERROR 13

void
DisplayErrorText(
DWORD dwLastError
);

//
// Unicode entry point and argv
//

int
__cdecl
wmain(
int argc,
wchar_t *argv[]
)
{
LPWSTR wUserName;
LPWSTR wComputerName = NULL; // default to local machine
LPWSTR wOldPassword;
LPWSTR wNewPassword;
USER_INFO_1003 pi1003;
NET_API_STATUS nas;

if( argc < 3 ) {
fprintf(stderr, "Usage: %ls <user> <new_password> "
"[\\\\machine | domain] [old_password]\n",
argv[0]);
return RTN_USAGE;
}

//
// process command line arguments
//

wUserName = argv[1];
wNewPassword = argv[2];

if( argc >= 4 && *argv[3] != L'\0' ) {

//
// obtain target machine name, if appropriate,
// always in Unicode, as that is what the API takes.
//

if(argv[3][0] == L'\\' && argv[3][1] == L'\\') {

//
// target specified machine name
//

wComputerName = argv[3];
}
else {

//
// the user specified a domain name. Look up the PDC.
// This is done in both password change cases to ensure the
// same computer is targeted for the update operation.
//

nas = NetGetDCName(
NULL,
argv[3],
(LPBYTE *)&wComputerName
);

if(nas != NERR_Success) {
DisplayErrorText( nas );
return RTN_ERROR;
}
}
}

if(argc == 5) {
wOldPassword = argv[4];
} else {
wOldPassword = NULL;
}

if(wOldPassword == NULL) {

//
// administrative over-ride of existing password
//

pi1003.usri1003_password = wNewPassword;

nas = NetUserSetInfo(
wComputerName, // computer name
wUserName, // username
1003, // info level
(LPBYTE)&pi1003, // new info
NULL
);
} else {

//
// allows user to change their own password
//

nas = NetUserChangePassword(
wComputerName,
wUserName,
wOldPassword,
wNewPassword
);
}

if(wComputerName != NULL && wComputerName != argv[3]) {

//
// a buffer was allocated for the PDC name. Free it.
//

NetApiBufferFree(wComputerName);
}

if(nas != NERR_Success) {
DisplayErrorText( nas );
return RTN_ERROR;
}

return RTN_OK;
}

void
DisplayErrorText(
DWORD dwLastError
)
{
HMODULE hModule = NULL; // default to system source
LPSTR MessageBuffer;
DWORD dwBufferLength;
DWORD dwFormatFlags;

dwFormatFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM ;

//
// if dwLastError is in the network range, load the message source
//
if(dwLastError >= NERR_BASE && dwLastError <= MAX_NERR) {
hModule = LoadLibraryEx(
TEXT("netmsg.dll"),
NULL,
LOAD_LIBRARY_AS_DATAFILE
);

if(hModule != NULL)
dwFormatFlags |= FORMAT_MESSAGE_FROM_HMODULE;
}

//
// call FormatMessage() to allow for message text to be acquired
// from the system or the supplied module handle.
//
if(dwBufferLength = FormatMessageA(
dwFormatFlags,
hModule, // module to get message from (NULL == system)
dwLastError,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // default language
(LPSTR) &MessageBuffer,
0,
NULL
))
{
DWORD dwBytesWritten;

//
// Output message string on stderr
//
WriteFile(
GetStdHandle(STD_ERROR_HANDLE),
MessageBuffer,
dwBufferLength,
&dwBytesWritten,
NULL
);

//
// free the buffer allocated by the system
//
LocalFree(MessageBuffer);
}

//
// if you loaded a message source, unload it.
//
if(hModule != NULL)
FreeLibrary(hModule);
}

[shicheng521]

Remote Registry服务已经启动,但有的电脑可以用RegConnectRegistry连接，但是不能来修改，是怎么回事？是不是要提升权限呀，提升那个权限？