[RESOLVED] readting the User Account password on xp and later

I am trying to write a program to control access to a number of computers. Pre xp screensaver could be used. However after Win me this changed.
I need to be able to read the User Account password (including de-ecryption) and write the password (including encryption)
I do not know what the key is called, and whether there is an existing routine to correctly (de)encrypt the password.
Any aid would be appreciated.
Thanks in advance
John Crawford

No, there is no mechanism provided to let a program discover a user's Windows password.

When a screen saver is chosen the user gets the option of requiring re-entry of the password. This can also be forced on via Group Policy to take the choice away from individual users in a managed PC setting.

Password "cracking" topics aren't permitted here.

Thank you for your reply. I thought that this would be the case.
Let me explain what I am trying to do and see if anything can be done.
I am a vulunteer in a seniors centre. We have 14 pcs Until now, anyone could access any machine. This was causing some issues. In the future we want only computer club members or "guests" use the computers.
My brilliant idea was to have a program running that prevented CTRL-ALT-DEL and ALT-TAB sequences. On another forum I saw that this could be done using SETSCREENSAVERRUNNING, that would trick the system into thinking that the screensaver was on. The only way to exit this program was to enter the correct password.
Nightly, the password for this program would change, and an email sent to the person who would give out the passwords. This would prevent everyone from eventually knowing the passwords.
OK. pre xp that would work. However after that SETSCREENSAVERRUNNING does nothing, because it appears that screensaver is just an application, and exiting it just brings you to the logon screen. CTRL-ALT-DEL and ALT-TAB cannot be disabled.
With xp and later I thought that I could still change the password, and still email it to the person who would give out the passwords. I had hoped there would be a way, but obviously for security reasons there is not.
I had hoped to automate this because the person receiving the password updates daily, may not be computer literate.
If anyone can understand this explanation, and has any ideas as to how this could be accomplished please let me know. If I could disable CAD and Alt-Tab, I could still use the solution, but I have not found a method of doing this.
If not the only solution I can see is to have someone with the knowledge to daily, go to each machine and change the password.
I will keep this thread unresolved for a few days to see if anyone can suggest anything. If not I wil close it.
John
John

I do not understand what you are trying to do. Try explaining WHAT you are trying to do not HOW you are trying to do it. The how approach you are taking sounds wrong and mixing the how in with the what makes understanding your issue difficult. The only what I can see is

Quote:

---

Originally Posted by johncraw

In the future we want only computer club members or "guests" use the computers.

---

If you only want certain users to use the computers then only give them the password. If the groups of users change then change the password. Solved.

Thank you for your response. I will try to clarify.
Members pay a flat fee every year to use the computers. Guests (That is other members of the centre, but not members of the computer club) pay a fee ($1) each time they use the computers in the centre.
In the case of members. There SHOULD not be a problem. If I give them a password then they can access the computers. There is, however the possibility of them giving the password to others. That is why I said that eventually everyone has the password.
If there is only one password, and I give it to a guest. Then there is nothing stopping that person from going in day after day and using the computer for free, or giving the password to others. That is why I want to be able to change the password.
I do have a solution that works if I can disable some key sequences.
I hope that this has given some clarification
John

Quote:

---

Originally Posted by johncraw

That is why I want to be able to change the password.

---

An administrator can change the password. They can change the password every day. You probably know how to do that. So I do not still see what the issue is.

Your problem is user education and serious security flaws.

Quote:

---

Originally Posted by johncraw

I do have a solution that works if I can disable some key sequences.

---

Your above unmentioned solution is most likely a problem waiting to happen. Why you have not explained what you really want to do I can not fathom. The only thing you said was you need to change the password. Is that what you are having trouble with?

I was able to follow along... why couldn't you? ;)

Situation - Senior Center has a computer lab with 14 computers. You can be a "club" member, pay a fee and have access to the computers. This requires knowing the password. You can also be a guest, and pay a daily or per-use fee. This also requires knowing the password.
Problem - Club member can give non-member the password. Said non-member can then use computers for free.
Additional problem - lab monitor isn't exactly computer literate. Also, having to go around changing the passwords on 14 computers everyday is something of a hassle. So there's an automated process to update the password daily. The OP then had an app that would discover the password, and email it to the admin person... again... remember, they're not necessarily computer literate... problem is that the password discovery & email app no longer works.

I'm not sure what the solution is... except for maybe the app be responsible for changing the password and email it out... rather than trying to discover it.

-tg

Quote:

---

Originally Posted by techgnome

I was able to follow along... why couldn't you? ;)

---

That's an easy one. That type of situation is right up your alley, not mine.

I do not do admin nor security work. The poor fellow had no one to help him so even though his situation is unlike one I've dealt with (or will deal with, I pass stuff like that away from me) I thought I could try to help and maybe learn something.

Since techgnome has the situation understood AND has a possible solution I can defer the matter to him.

Woah there... ;) I simply mentioned I understand the situation... not that I had a solution... I have an idea... I'm reasonably sure it's possible to set the password via code... now if the computers were all part of a network running ActiveDirectory (AD) then I know it's possible... I just don't know the nuts and bolts of how to do it. Just that it's possible. But if he's isn't running AD, then it's less easy, but should still be possible...

Now that we have the WHAT... next is the HOW... as in HOW are the new passwords being set each night in the first place?

-tg

I appreciate all the cycles that have been put into getting clarification and giving comments.
Now that the what is known. This is the how that I have come up with.
I have written a program, actually modified one that I found. This displays on the full screen. In the middle of this screen is a password field. Entering the correct password closes the window and returns to the desktop. This works great.
Now, at or about midnight each computer will automatically create a new password, for that computer. This password will be encrypted using another routine that I found. The password will be stored in the registry. Although this has not been coded yet, the pieces that I have tried work great.
After the password is created it will be emailed to someone. In the morning this person will print out the emails. During the day this person will "sign in" people and give them the password for one of the machines. The person will use that password. I know that after each use a new password should be generated. However the person handing out the passwords has other responsibilities as well, and I do not want to add too much work. The mechanism for sending the emails work as well.
So, from the above, it seems that I have a complete solution. So what's my problem? Simply this. I cannot disable CAD, or Alt-esc, Alt-Tab or Ctrl-esc. Or can I? I would be quite happy to use my solution if I could disable these. Since I may not be able to disable these, I will have to determine whether that is a great concern.
If anyone can tell me how to disable some or all of these, I would be a very happy camper.
Thanks for the time spent
John

Aince there has been no activity recently, I am flagging this issue resolved.
Still cannot block CAD, but hopefully the users will ot think of trying it.
Thanks for your comments.
John

John, I'm not understanding why you want to disable CAD et. al. However, it sounds like what you have is a "cyber cafe". I do have some experience in this field, and there are some EXCELLENT programs that will handle everything you want, and more.

It has been several years since I have worked in this field, but a quick search on Google using the term "cyber cafe software" yields some interesting results. I personally have experience using SmartLaunch. It appears there is a "free" software called CybercafePro. There are a few other applications which show up in the search as well, but my only experience is using SmartLaunch.

I'll try to give a brief rundown of my experience, from Memory. SmartLaunch effectively locks down the computer so that users/customers can only do what you allow them to do. You can even restrict applications. It is a license manager - if you have 5 licenses of MS Office, you can install it on all computers, but the software will only allow 5 users to use the program at one time.

It has a cash register component - it will process money and sales, even allows for discounts, coupon codes, etc.

You can restrict users by time. So, you can sell usage in blocks of say, 1 hour. The user will always have that hour. So, if they use half an hour today, they can come back in a week and use their other half hour. When their time is almost up, the system will display a reminder to the user 5 minutes before being disconnected. The user can buy more time directly from their computer, or they can go up to the administrator/register.

The system is extremely easy to use. It allows a cafe owner complete control over the setup of the system, but is dead simple for the customers and for any cashiers you might have who run the system on a daily basis. Think of a cyber cafe where you can hire a high school kid who may/may not know anything about computers to run the register. Likewise, your customer may be fairly proficient at hacking/system administration - so the system is hardened against those "power users".

It's geared towards a full scale cyber cafes/game centers and designed by a European company (apparently, game centers/cyber cafes are pretty popular overseas).

As for cost, there is obviously a cost associated. I think I paid $1,000 or $1,500 for the software (it's sold per seat, not per server). But, since it was a one stop complete management software for my cyber cafe (including cashier management for my coffee shop side of the business), I found it to be an extraordinary value for what it did.

Final disclaimer - I am not in any way affiliated with SmartLaunch, I only used it for a short time in my business. What you describe is a cyber cafe. What you need is cyber cafe software to do what you want.

However, if your current system works, run with it.

Thank you for your response.
You are right. I am basically trying to create a cyber cafe. I just didn't know how to look for it.
I wanted to disable CAD since that gives the task manager and that allows me to stop the program running.
As to the cost. The reason for me trying to "roll my own" was to make it cheap. This application will be used in a Seniors centre. We do not have the kind of money that SmartLaunch would cost. I will, however look into Cybercafepro
John