0

Anyone understand why the simple Powershell script below works fine under Windows XP but not under Windows 7?

Get-WmiObject -Class win32_logonsession | %{ get-wmiobject -Query "Associators of {Win32_logonSession.LogonID=$($_.LogonId)} where AssocClass = Win32_LoggedOnUser Role=Dependent" }

Under Windows 7 it doesn't list any interactive accounts, only sessions for the local system account, network service etc. However under XP it returns information for all accounts.

Have been looking on MSDN and Google however haven't found an answer as yet.

ServerMonkey
  • 1,042
  • 3
  • 19
  • 42

1 Answers1

1

Seems the problem is that behind the scenes a double hop is occurring and WMI under Windows 7 is trying to find the user account details with an anonymous bind against AD. We only accept authenticated queries so this silently fails.

Going to give WMI a skip and try to pinvoke with LSA functions to get this to work.

ServerMonkey
  • 1,042
  • 3
  • 19
  • 42