Navigating registry files - c#

I am trying to read data from the registry files of other machines. Basically I have the hard drives of other systems, from which I can copy out, or directly read, for example, the SYSTEM file (Windows/system32/config/SYSTEM), so I can read data from the USBStor keys (and other stuff).
Please note I'm NOT trying to read .REG files that are exported from the registry, and NOT trying to read the the hives from the local machine. ;-)
I have been trying to find any type of library or native .Net way to do this, preferably for free! There is lots of references to reading .REG files but not the "flat" files taken from other systems.
Anyone come across this before?

Check out RegLoadKey() (MSDN here), you should be able to do something like this:
using System.Runtime.InteropServices;
using Microsoft.Win32;
namespace ConsoleApplication1
{
class Program
{
[DllImport("advapi32.dll")]
public static extern int RegLoadKey(uint hKey, string lpSubKey, string lpFile);
[DllImport("advapi32.dll")]
public static extern int RegUnLoadKey(uint hKey, string lpSubKey);
[DllImport("advapi32.dll")]
public static extern int OpenProcessToken(int ProcessHandle, int DesiredAccess, ref int tokenhandle);
[DllImport("kernel32.dll")]
public static extern int GetCurrentProcess();
[DllImport("advapi32.dll")]
public static extern int AdjustTokenPrivileges(int tokenhandle, int disableprivs, [MarshalAs(UnmanagedType.Struct)]ref TOKEN_PRIVILEGES Newstate, int bufferlength, int PreivousState, int Returnlength);
[DllImport("advapi32.dll")]
public static extern int LookupPrivilegeValue(string lpsystemname, string lpname, [MarshalAs(UnmanagedType.Struct)] ref LUID lpLuid);
[StructLayout(LayoutKind.Sequential)]
public struct LUID
{
public int LowPart;
public int HighPart;
}
[StructLayout(LayoutKind.Sequential)]
public struct TOKEN_PRIVILEGES
{
public LUID Luid;
public int Attributes;
public int PrivilegeCount;
}
static void Main(string[] args)
{
int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
int SE_PRIVILEGE_ENABLED = 0x00000002;
int TOKEN_QUERY = 0x00000008;
int token = 0;
int retval = 0;
uint HKU = 0x80000003;
string SE_BACKUP_NAME = "SeBackupPrivilege";
string SE_RESTORE_NAME = "SeRestorePrivilege";
string tmpHive = "offlineSystemHive";
string offlineHive = "E:\\Windows\\system32\\config\\SYSTEM";
LUID RestoreLuid = new LUID();
LUID BackupLuid = new LUID();
TOKEN_PRIVILEGES TP = new TOKEN_PRIVILEGES();
TOKEN_PRIVILEGES TP2 = new TOKEN_PRIVILEGES();
retval = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref token);
retval = LookupPrivilegeValue(null, SE_RESTORE_NAME, ref RestoreLuid);
retval = LookupPrivilegeValue(null, SE_BACKUP_NAME, ref BackupLuid);
TP.PrivilegeCount = 1;
TP.Attributes = SE_PRIVILEGE_ENABLED;
TP.Luid = RestoreLuid;
TP2.PrivilegeCount = 1;
TP2.Attributes = SE_PRIVILEGE_ENABLED;
TP2.Luid = BackupLuid;
retval = AdjustTokenPrivileges(token, 0, ref TP, 1024, 0, 0);
retval = AdjustTokenPrivileges(token, 0, ref TP2, 1024, 0, 0);
int rtnVal = RegLoadKey(HKU, tmpHive, offlineHive);
Console.WriteLine(rtnVal); //should be 0
RegistryKey baseKey = Registry.Users.OpenSubKey("offlineSystemHive\\ControlSet001\\Control\\ComputerName\\ComputerName");
Console.WriteLine(baseKey.GetValue("ComputerName"));
baseKey.Close();
rtnVal = RegUnLoadKey(HKU, tmpHive);
Console.WriteLine(rtnVal); //should be 0
}
}
}

You need to use the RegistryKey.OpenRemoteBaseKey method explained here. Note that according to the linked msdn documentation:
In order for a key to be opened remotely, both the server and client
machines must be running the remote registry service, and have remote
administration enabled.
To enable the remote registry service, use the link Blorgbeard mentioned in the comment: http://technet.microsoft.com/en-us/library/cc754820.aspx
Here is a sample:
RegistryKey FetchedRemoteMachineKey;
FetchedRemoteMachineKey = RegistryKey.OpenRemoteBaseKey(
RegistryHive.CurrentUser, RemoteMachineName).OpenSubKey(
"Machine");

Related

QueryDisplayConfig() does not initialize pathArray and modeArray correctly

I'm trying to set-up an easy 1-click change of the mode of my screens (extended <--> disconnected)
but my screens are assigned no ID by the QueryDisplayConfig method.
(I'm using the User32 PInvoke lib from https://github.com/AArnott/pinvoke, in addition to what you can find in the code below)
I tried:
stepping through the code with breakpoints, making sure EVERY value is the default value.
elevating VS to run with administrator privileges.
making extra sure that the flags and errors are functioning correctly.
[DllImport("User32.dll")]
public static extern int GetDisplayConfigBufferSizes(uint flags, ref uint numPathArrayElements, ref uint numModeInfoArrayElements);
[DllImport("User32.dll")]
public static extern int QueryDisplayConfig(
uint flags,
ref uint numPathArrayElements, DISPLAYCONFIG_PATH_INFO[] pathArray,
ref uint numModeInfoArrayElements, DISPLAYCONFIG_MODE_INFO[] modeInfoArray,
DISPLAYCONFIG_TOPOLOGY_ID[] currentTopologyId
);
const int QDC_ALL_PATHS = 1;
const int QDC_ONLY_ACTIVE_PATHS = 2;
const int QDC_DATABASE_CURRENT = 4;
public static void CheckDisplays() {
uint numPathArrayElements = 0;
uint numModeInfoArrayElements = 0;
uint filter = QDC_ONLY_ACTIVE_PATHS;
int bufferError = GetDisplayConfigBufferSizes(filter, ref numPathArrayElements, ref numModeInfoArrayElements);
DISPLAYCONFIG_PATH_INFO[] pathArray = new DISPLAYCONFIG_PATH_INFO[numPathArrayElements];
DISPLAYCONFIG_MODE_INFO[] modeArray = new DISPLAYCONFIG_MODE_INFO[numModeInfoArrayElements];
int queryError = QueryDisplayConfig(filter, ref numPathArrayElements, pathArray, ref numModeInfoArrayElements, modeArray, null);
Console.WriteLine();
Console.WriteLine("Elements: " + numPathArrayElements); // Prints the correct amount of connected screens.
Console.WriteLine("BUFFER ERROR: " + bufferError); // Prints 0 -- as in Success.
Console.WriteLine("PATH ERROR: " + queryError); // Prints 0 -- as in Success.
for (int i = 0; i < pathArray.Length; i++) {
if (pathArray[i].sourceInfo.id != 0) { Console.WriteLine($"Path{i} has been initialized correctly!!"); }
// Every object in the array has default values and IDs of 0.
// Nothing prints here.
}
}
Each screen should be assigned an ID and a proper mode.
Instead, everything has the default value and I seem to be stuck.
Your declaration for QueryDisplayConfig is wrong : arrays must be [Out]
This works for me :
(I have only 1 monitor but the values received in arrays are the same as in C++ (I translated structures from SDK headers))
(IntPtr.Zero for currentTopologyId with QDC_ONLY_ACTIVE_PATHS)
[DllImport("User32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
public static extern int QueryDisplayConfig(uint flags, ref uint numPathArrayElements, [Out] DISPLAYCONFIG_PATH_INFO[] pathArray,
ref uint modeInfoArrayElements, [Out] DISPLAYCONFIG_MODE_INFO[] modeInfoArray, IntPtr currentTopologyId);

How to write 64 bit value as DWORD to Windows registry

I'm trying to write 64 bit value as a DWORD to Windows registry. I'm trying to do this, because that's what UnityEngine.PlayerPrefs does and I'm trying to edit those values. Funnily enough, PlayerPrefs only supports floats, but still for some reason writes them as doubles to the registry.
using (RegistryKey rk = Registry.CurrentUser.OpenSubKey("some\\valid\\path", true))
{
rk.SetValue("VALUE", double.MaxValue, RegistryValueKind.DWord);
}
Results in this error:
System.ArgumentException: 'The type of the value object did not match the specified RegistryValueKind or the object could not be properly converted.'
What would be the easiest way to do this in C#?
Found a way to do it:
[DllImport("advapi32.dll")]
static extern uint RegSetValueEx(
UIntPtr hKey,
[MarshalAs(UnmanagedType.LPStr)] string lpValueName,
int Reserved,
RegistryValueKind dwType,
IntPtr lpData,
int cbData);
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
public static extern uint RegOpenKeyEx(
IntPtr hKey,
string subKey,
int ulOptions,
int samDesired,
out UIntPtr hkResult);
[DllImport("advapi32.dll")]
public static extern int RegCloseKey(UIntPtr hKey);
static public readonly IntPtr HKEY_CURRENT_USER = new IntPtr(-2147483647);
public bool SetNamedValue(string path, string valName, double value)
{
UIntPtr hKey = UIntPtr.Zero;
try
{
if (RegOpenKeyEx(HKEY_CURRENT_USER, path, 0, 0x20006, out hKey) != 0)
return false;
int size = 8;
IntPtr pData = Marshal.AllocHGlobal(size);
Marshal.WriteInt64(pData, BitConverter.DoubleToInt64Bits(value));
if (RegSetValueEx(hKey, valName, 0, RegistryValueKind.DWord, pData, size) != 0)
return false;
}
finally
{
if (hKey != UIntPtr.Zero)
RegCloseKey(hKey);
}
return true;
}

How to remove a file lock

I have an service to move files from a working folder to backup folder. The folders are on a network share, so at times we will open a file, using something like notepad, to look at it. People are not (well, shouldn't) be editing, just looking.
When we try to move the file, I get permission denied. I'm looking for a way in C# to force remove a file lock, so the service can move the file to the backup folder.
You have to use P/Invoke. These are the functions you care about:
[DllImport("netapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
static extern int NetFileEnum(string servername, string basepath, string username, int level, ref IntPtr bufptr, int prefmaxlen, out int entriesread, out int totalentries, IntPtr resume_handle);
[DllImport("netapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
static extern int NetFileClose(string servername, int id);
[DllImport("Netapi32.dll", SetLastError = true)]
static extern int NetApiBufferFree(IntPtr buffer);
Here's some code similar to what I've used with success:
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
struct FILE_INFO_3
{
public int fi3_id;
public int fi3_permission;
public int fi3_num_locks;
[MarshalAs(UnmanagedType.LPWStr)]
public string fi3_pathname;
[MarshalAs(UnmanagedType.LPWStr)]
public string fi3_username;
}
private static FILE_INFO_3[] GetLockedFiles(string server, string path)
{
const int MAX_PREFERRED_LENGTH = -1;
int dwReadEntries;
int dwTotalEntries;
IntPtr pBuffer = IntPtr.Zero;
FILE_INFO_3 pCurrent = new FILE_INFO_3();
List<FILE_INFO_3> files = new List<FILE_INFO_3>();
int dwStatus = NetFileEnum(server, path, null, 3, ref pBuffer, MAX_PREFERRED_LENGTH, out dwReadEntries, out dwTotalEntries, IntPtr.Zero);
if (dwStatus == 0)
{
for (int dwIndex = 0; dwIndex < dwReadEntries; dwIndex++)
{
IntPtr iPtr = new IntPtr(pBuffer.ToInt32() + (dwIndex * Marshal.SizeOf(pCurrent)));
pCurrent = (FILE_INFO_3)Marshal.PtrToStructure(iPtr, typeof(FILE_INFO_3));
files.Add(pCurrent);
}
}
NetApiBufferFree(pBuffer);
return files.ToArray();
}
static void Main(string[] args)
{
FILE_INFO_3[] lockedFiles = GetLockedFiles("someservername", #"C:\somepath");
foreach (FILE_INFO_3 lockedFile in lockedFiles)
{
int dwStatus = NetFileClose(_serverName, lockedFile.fi3_id);
// Check dwStatus for success here
}
}
EDIT: As noted by the OP in the comments below, when compiling as 64-bit, you need to use ToInt64 instead of ToInt32. More information can be found here.

Force Shutdown/Reboot [duplicate]

What's the best way to shut down the computer from a C# program?
I've found a few methods that work - I'll post them below - but none of them are very elegant. I'm looking for something that's simpler and natively .net.
Works starting with windows XP, not available in win 2000 or lower:
This is the quickest way to do it:
Process.Start("shutdown","/s /t 0");
Otherwise use P/Invoke or WMI like others have said.
Edit: how to avoid creating a window
var psi = new ProcessStartInfo("shutdown","/s /t 0");
psi.CreateNoWindow = true;
psi.UseShellExecute = false;
Process.Start(psi);
Taken from: a Geekpedia post
This method uses WMI to shutdown windows.
You'll need to add a reference to System.Management to your project to use this.
using System.Management;
void Shutdown()
{
ManagementBaseObject mboShutdown = null;
ManagementClass mcWin32 = new ManagementClass("Win32_OperatingSystem");
mcWin32.Get();
// You can't shutdown without security privileges
mcWin32.Scope.Options.EnablePrivileges = true;
ManagementBaseObject mboShutdownParams =
mcWin32.GetMethodParameters("Win32Shutdown");
// Flag 1 means we want to shut down the system. Use "2" to reboot.
mboShutdownParams["Flags"] = "1";
mboShutdownParams["Reserved"] = "0";
foreach (ManagementObject manObj in mcWin32.GetInstances())
{
mboShutdown = manObj.InvokeMethod("Win32Shutdown",
mboShutdownParams, null);
}
}
This thread provides the code necessary: http://bytes.com/forum/thread251367.html
but here's the relevant code:
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, Pack=1)]
internal struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}
[DllImport("kernel32.dll", ExactSpelling=true) ]
internal static extern IntPtr GetCurrentProcess();
[DllImport("advapi32.dll", ExactSpelling=true, SetLastError=true) ]
internal static extern bool OpenProcessToken( IntPtr h, int acc, ref IntPtr
phtok );
[DllImport("advapi32.dll", SetLastError=true) ]
internal static extern bool LookupPrivilegeValue( string host, string name,
ref long pluid );
[DllImport("advapi32.dll", ExactSpelling=true, SetLastError=true) ]
internal static extern bool AdjustTokenPrivileges( IntPtr htok, bool disall,
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen );
[DllImport("user32.dll", ExactSpelling=true, SetLastError=true) ]
internal static extern bool ExitWindowsEx( int flg, int rea );
internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
internal const int TOKEN_QUERY = 0x00000008;
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
internal const string SE_SHUTDOWN_NAME = "SeShutdownPrivilege";
internal const int EWX_LOGOFF = 0x00000000;
internal const int EWX_SHUTDOWN = 0x00000001;
internal const int EWX_REBOOT = 0x00000002;
internal const int EWX_FORCE = 0x00000004;
internal const int EWX_POWEROFF = 0x00000008;
internal const int EWX_FORCEIFHUNG = 0x00000010;
private void DoExitWin( int flg )
{
bool ok;
TokPriv1Luid tp;
IntPtr hproc = GetCurrentProcess();
IntPtr htok = IntPtr.Zero;
ok = OpenProcessToken( hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok );
tp.Count = 1;
tp.Luid = 0;
tp.Attr = SE_PRIVILEGE_ENABLED;
ok = LookupPrivilegeValue( null, SE_SHUTDOWN_NAME, ref tp.Luid );
ok = AdjustTokenPrivileges( htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero );
ok = ExitWindowsEx( flg, 0 );
}
Usage:
DoExitWin( EWX_SHUTDOWN );
or
DoExitWin( EWX_REBOOT );
Different methods:
A. System.Diagnostics.Process.Start("Shutdown", "-s -t 10");
B. Windows Management Instrumentation (WMI)
http://www.csharpfriends.com/Forums/ShowPost.aspx?PostID=36953
http://www.dreamincode.net/forums/showtopic33948.htm
C. System.Runtime.InteropServices Pinvoke
http://bytes.com/groups/net-c/251367-shutdown-my-computer-using-c
D. System Management
http://www.geekpedia.com/code36_Shut-down-system-using-Csharp.html
After I submit, I have seen so many others also have posted...
Short and sweet. Call an external program:
using System.Diagnostics;
void Shutdown()
{
Process.Start("shutdown.exe", "-s -t 00");
}
Note: This calls Windows' Shutdown.exe program, so it'll only work if that program is available.
You might have problems on Windows 2000 (where shutdown.exe is only available in the resource kit) or XP Embedded.
The old-school ugly method. Use the ExitWindowsEx function from the Win32 API.
using System.Runtime.InteropServices;
void Shutdown2()
{
const string SE_SHUTDOWN_NAME = "SeShutdownPrivilege";
const short SE_PRIVILEGE_ENABLED = 2;
const uint EWX_SHUTDOWN = 1;
const short TOKEN_ADJUST_PRIVILEGES = 32;
const short TOKEN_QUERY = 8;
IntPtr hToken;
TOKEN_PRIVILEGES tkp;
// Get shutdown privileges...
OpenProcessToken(Process.GetCurrentProcess().Handle,
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hToken);
tkp.PrivilegeCount = 1;
tkp.Privileges.Attributes = SE_PRIVILEGE_ENABLED;
LookupPrivilegeValue("", SE_SHUTDOWN_NAME, out tkp.Privileges.pLuid);
AdjustTokenPrivileges(hToken, false, ref tkp, 0U, IntPtr.Zero,
IntPtr.Zero);
// Now we have the privileges, shutdown Windows
ExitWindowsEx(EWX_SHUTDOWN, 0);
}
// Structures needed for the API calls
private struct LUID
{
public int LowPart;
public int HighPart;
}
private struct LUID_AND_ATTRIBUTES
{
public LUID pLuid;
public int Attributes;
}
private struct TOKEN_PRIVILEGES
{
public int PrivilegeCount;
public LUID_AND_ATTRIBUTES Privileges;
}
[DllImport("advapi32.dll")]
static extern int OpenProcessToken(IntPtr ProcessHandle,
int DesiredAccess, out IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
static extern bool AdjustTokenPrivileges(IntPtr TokenHandle,
[MarshalAs(UnmanagedType.Bool)]bool DisableAllPrivileges,
ref TOKEN_PRIVILEGES NewState,
UInt32 BufferLength,
IntPtr PreviousState,
IntPtr ReturnLength);
[DllImport("advapi32.dll")]
static extern int LookupPrivilegeValue(string lpSystemName,
string lpName, out LUID lpLuid);
[DllImport("user32.dll", SetLastError = true)]
static extern int ExitWindowsEx(uint uFlags, uint dwReason);
In production code you should be checking the return values of the API calls, but I left that out to make the example clearer.
Just to add to Pop Catalin's answer, here's a one liner which shuts down the computer without displaying any windows:
Process.Start(new ProcessStartInfo("shutdown", "/s /t 0") {
CreateNoWindow = true, UseShellExecute = false
});
System.Diagnostics.Process.Start("shutdown", "/s /t 0")
Should work.
For restart, it's /r
This will restart the PC box directly and cleanly, with NO dialogs.
Note that shutdown.exe is just a wrapper around InitiateSystemShutdownEx, which provides some niceties missing in ExitWindowsEx
You can launch the shutdown process:
shutdown -s -t 0 - Shutdown
shutdown -r -t 0 - Restart
I had trouble trying to use the WMI method accepted above because i always got privilige not held exceptions despite running the program as an administrator.
The solution was for the process to request the privilege for itself. I found the answer at http://www.dotnet247.com/247reference/msgs/58/292150.aspx written by a guy called Richard Hill.
I've pasted my basic use of his solution below in case that link gets old.
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Management;
using System.Runtime.InteropServices;
using System.Security;
using System.Diagnostics;
namespace PowerControl
{
public class PowerControl_Main
{
public void Shutdown()
{
ManagementBaseObject mboShutdown = null;
ManagementClass mcWin32 = new ManagementClass("Win32_OperatingSystem");
mcWin32.Get();
if (!TokenAdjuster.EnablePrivilege("SeShutdownPrivilege", true))
{
Console.WriteLine("Could not enable SeShutdownPrivilege");
}
else
{
Console.WriteLine("Enabled SeShutdownPrivilege");
}
// You can't shutdown without security privileges
mcWin32.Scope.Options.EnablePrivileges = true;
ManagementBaseObject mboShutdownParams = mcWin32.GetMethodParameters("Win32Shutdown");
// Flag 1 means we want to shut down the system
mboShutdownParams["Flags"] = "1";
mboShutdownParams["Reserved"] = "0";
foreach (ManagementObject manObj in mcWin32.GetInstances())
{
try
{
mboShutdown = manObj.InvokeMethod("Win32Shutdown",
mboShutdownParams, null);
}
catch (ManagementException mex)
{
Console.WriteLine(mex.ToString());
Console.ReadKey();
}
}
}
}
public sealed class TokenAdjuster
{
// PInvoke stuff required to set/enable security privileges
[DllImport("advapi32", SetLastError = true),
SuppressUnmanagedCodeSecurityAttribute]
static extern int OpenProcessToken(
System.IntPtr ProcessHandle, // handle to process
int DesiredAccess, // desired access to process
ref IntPtr TokenHandle // handle to open access token
);
[DllImport("kernel32", SetLastError = true),
SuppressUnmanagedCodeSecurityAttribute]
static extern bool CloseHandle(IntPtr handle);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
static extern int AdjustTokenPrivileges(
IntPtr TokenHandle,
int DisableAllPrivileges,
IntPtr NewState,
int BufferLength,
IntPtr PreviousState,
ref int ReturnLength);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
static extern bool LookupPrivilegeValue(
string lpSystemName,
string lpName,
ref LUID lpLuid);
[StructLayout(LayoutKind.Sequential)]
internal struct LUID
{
internal int LowPart;
internal int HighPart;
}
[StructLayout(LayoutKind.Sequential)]
struct LUID_AND_ATTRIBUTES
{
LUID Luid;
int Attributes;
}
[StructLayout(LayoutKind.Sequential)]
struct _PRIVILEGE_SET
{
int PrivilegeCount;
int Control;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] // ANYSIZE_ARRAY = 1
LUID_AND_ATTRIBUTES[] Privileges;
}
[StructLayout(LayoutKind.Sequential)]
internal struct TOKEN_PRIVILEGES
{
internal int PrivilegeCount;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
internal int[] Privileges;
}
const int SE_PRIVILEGE_ENABLED = 0x00000002;
const int TOKEN_ADJUST_PRIVILEGES = 0X00000020;
const int TOKEN_QUERY = 0X00000008;
const int TOKEN_ALL_ACCESS = 0X001f01ff;
const int PROCESS_QUERY_INFORMATION = 0X00000400;
public static bool EnablePrivilege(string lpszPrivilege, bool
bEnablePrivilege)
{
bool retval = false;
int ltkpOld = 0;
IntPtr hToken = IntPtr.Zero;
TOKEN_PRIVILEGES tkp = new TOKEN_PRIVILEGES();
tkp.Privileges = new int[3];
TOKEN_PRIVILEGES tkpOld = new TOKEN_PRIVILEGES();
tkpOld.Privileges = new int[3];
LUID tLUID = new LUID();
tkp.PrivilegeCount = 1;
if (bEnablePrivilege)
tkp.Privileges[2] = SE_PRIVILEGE_ENABLED;
else
tkp.Privileges[2] = 0;
if (LookupPrivilegeValue(null, lpszPrivilege, ref tLUID))
{
Process proc = Process.GetCurrentProcess();
if (proc.Handle != IntPtr.Zero)
{
if (OpenProcessToken(proc.Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
ref hToken) != 0)
{
tkp.PrivilegeCount = 1;
tkp.Privileges[2] = SE_PRIVILEGE_ENABLED;
tkp.Privileges[1] = tLUID.HighPart;
tkp.Privileges[0] = tLUID.LowPart;
const int bufLength = 256;
IntPtr tu = Marshal.AllocHGlobal(bufLength);
Marshal.StructureToPtr(tkp, tu, true);
if (AdjustTokenPrivileges(hToken, 0, tu, bufLength, IntPtr.Zero, ref ltkpOld) != 0)
{
// successful AdjustTokenPrivileges doesn't mean privilege could be changed
if (Marshal.GetLastWin32Error() == 0)
{
retval = true; // Token changed
}
}
TOKEN_PRIVILEGES tokp = (TOKEN_PRIVILEGES)Marshal.PtrToStructure(tu,
typeof(TOKEN_PRIVILEGES));
Marshal.FreeHGlobal(tu);
}
}
}
if (hToken != IntPtr.Zero)
{
CloseHandle(hToken);
}
return retval;
}
}
}
I tried roomaroo's WMI method to shutdown Windows 2003 Server, but it would not work until I added `[STAThread]' (i.e. "Single Threaded Apartment" threading model) to the Main() declaration:
[STAThread]
public static void Main(string[] args) {
Shutdown();
}
I then tried to shutdown from a thread, and to get that to work I had to set the "Apartment State" of the thread to STA as well:
using System.Management;
using System.Threading;
public static class Program {
[STAThread]
public static void Main(string[] args) {
Thread t = new Thread(new ThreadStart(Program.Shutdown));
t.SetApartmentState(ApartmentState.STA);
t.Start();
...
}
public static void Shutdown() {
// roomaroo's code
}
}
I'm a C# noob, so I'm not entirely sure of the significance of STA threads in terms of shutting down the system (even after reading the link I posted above). Perhaps someone else can elaborate...?
**Elaborated Answer...
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
// Remember to add a reference to the System.Management assembly
using System.Management;
using System.Diagnostics;
namespace ShutDown
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}
private void btnShutDown_Click(object sender, EventArgs e)
{
ManagementBaseObject mboShutdown = null;
ManagementClass mcWin32 = new ManagementClass("Win32_OperatingSystem");
mcWin32.Get();
// You can't shutdown without security privileges
mcWin32.Scope.Options.EnablePrivileges = true;
ManagementBaseObject mboShutdownParams = mcWin32.GetMethodParameters("Win32Shutdown");
// Flag 1 means we want to shut down the system
mboShutdownParams["Flags"] = "1";
mboShutdownParams["Reserved"] = "0";
foreach (ManagementObject manObj in mcWin32.GetInstances())
{
mboShutdown = manObj.InvokeMethod("Win32Shutdown", mboShutdownParams, null);
}
}
}
}
Use shutdown.exe. To avoid problem with passing args, complex execution, execution from WindowForms use PowerShell execute script:
using System.Management.Automation;
...
using (PowerShell PowerShellInstance = PowerShell.Create())
{
PowerShellInstance.AddScript("shutdown -a; shutdown -r -t 100;");
// invoke execution on the pipeline (collecting output)
Collection<PSObject> PSOutput = PowerShellInstance.Invoke();
}
System.Management.Automation.dll should be installed on OS and available in GAC.
Sorry for My english.
For Windows 10, I needed to add /f option in order to shutdown the pc without any question and wait time.
//This did not work for me
Process.Start("shutdown", "/s /t 0");
//But this worked
Process.Start("shutdown", "/s /f /t 0");
There is no .net native method for shutting off the computer. You need to P/Invoke the ExitWindows or ExitWindowsEx API call.
If you want to shut down computer remotely then you can use
Using System.Diagnostics;
on any button click
{
Process.Start("Shutdown","-i");
}

System.Management.ManagementException: "Privilege not held." When trying to Shutdown Windows 7 in C# 4.0 using WMI

I have a program with some legacy code that does the following to shutdown windows:
ManagementClass mc = new ManagementClass( "Win32_OperatingSystem" );
mc.Get();
mc.Scope.Options.EnablePrivileges = true;
ManagementBaseObject mboShutdown = mc.GetMethodParameters( "Win32Shutdown" );
mboShutdown["Flags"] = "5"; // shutdown + force
mboShutdown["Reserved"] = "0";
foreach( ManagementObject mbo in mc.GetInstances() )
{
mbo.InvokeMethod( "Win32Shutdown", mboShutdown, null );
}
It was a .NET 3.5 application, and it was working without a problem. Recently, a dependency upgrade required bumping the target framework to 4.0 client profile. Now, whenever the code runs, I am getting the following exception:
System.Management.ManagementException: "Privilege not held."
The application is running under an Admin account on Windows 7, and nothing has changed other than updating this software.
The only information I have been able to find while searching for a solution was some very old bug reports about .NET 1.1, and the following thread on msdn that was never answered:
http://social.msdn.microsoft.com/Forums/vstudio/en-US/fa0bcae5-6f30-42b6-bb5f-b8a6edb88ac4/encountered-privillege-not-held-exception-when-rebooting-the-server-in-net40-framewrk
Does anyone know what the cause of this issue is? Do I need to stop using WMI and just PInvoke InitiateSystemShutdownEx or something similar?
Ok, so it probably has to do with SE_SHUTDOWN_NAME privilege. I'm not sure why it was working under .NET 3.5 and not .NET 4.0, but the following workaround works:
[StructLayout( LayoutKind.Sequential, Pack = 1 )]
internal struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}
[DllImport( "kernel32.dll", ExactSpelling = true )]
internal static extern IntPtr GetCurrentProcess();
[DllImport( "advapi32.dll", ExactSpelling = true, SetLastError = true )]
internal static extern bool OpenProcessToken( IntPtr h, int acc, ref IntPtr phtok );
[DllImport( "advapi32.dll", SetLastError = true )]
internal static extern bool LookupPrivilegeValue( string host, string name, ref long pluid );
[DllImport( "advapi32.dll", ExactSpelling = true, SetLastError = true )]
internal static extern bool AdjustTokenPrivileges( IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen );
[DllImport( "user32.dll", ExactSpelling = true, SetLastError = true )]
internal static extern bool ExitWindowsEx( int flg, int rea );
public const int SE_PRIVILEGE_ENABLED = 0x00000002;
public const int TOKEN_QUERY = 0x00000008;
public const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
public const string SE_SHUTDOWN_NAME = "SeShutdownPrivilege";
public const int EWX_LOGOFF = 0x00000000;
public const int EWX_SHUTDOWN = 0x00000001;
public const int EWX_REBOOT = 0x00000002;
public const int EWX_FORCE = 0x00000004;
public const int EWX_POWEROFF = 0x00000008;
public const int EWX_FORCEIFHUNG = 0x00000010;
public static bool DoExitWin( int flg )
{
TokPriv1Luid tp;
var hproc = GetCurrentProcess();
var htok = IntPtr.Zero;
OpenProcessToken( hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok );
tp.Count = 1;
tp.Luid = 0;
tp.Attr = SE_PRIVILEGE_ENABLED;
LookupPrivilegeValue( null, SE_SHUTDOWN_NAME, ref tp.Luid );
AdjustTokenPrivileges( htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero );
return ExitWindowsEx( flg, 0 );
}
I haven't tried, but my guess is that the WMI call might work after using the AdjustTokenPrivileges call as well.
After you apply the April 2017 security updates described in Microsoft security update guidance CVE-2017-0160, the PowerShell v3.0+ stop-computer command fails. Additionally, if applications use power management methods, such as shutdown or reboot, from the Win32_OperatingSystem class and set the EnablePrivileges attribute to true, they may observe the same failure. A "Privilege not held" error message is returned.
Customer applications using power management methods, such as shutdown or reboot, from the Win32_OperatingSystem class and set the EnablePrivileges attribute to true, may observe the same “Privilege not held” error.
Example 2 (C# code) returns “Privilege not held” error:
[STAThread]
static void Main(string[] args)
{
ManagementClass mgmtObject = new ManagementClass("Win32_OperatingSystem");
foreach (ManagementObject iterMgmtObject in mgmtObject.GetInstances())
{
iterMgmtObject.Scope.Options.EnablePrivileges = true;
iterMgmtObject.InvokeMethod("Reboot", null, null);
}
}
To resolve this problem, install the update your system. More in the article.

Categories

Resources