3

I use LogonUser to verify credentials. On Windows 7 PCs, if it fails, the user might have to wait 30 seconds for the function to return. This does not happen on XP - the function returns very quickly. Here is my code:

HANDLE hToken;

bool bSuccess = LogonUser(StringUserName, "MyDomain", StringPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken);
0

1 Answer 1

1

I have no idea how Windows' particular API handles this, but it is generally considered a good idea not to return immediately when logon credentials are bad, to avoid brute force attacks. I could imagine Windows added this feature since WinXP.

2
  • It also may take the Domain Controller a while to determine the credential is bad.
    – user7116
    Jul 11, 2012 at 14:33
  • 1
    @sixlettervariables: 30 seconds? I expect some serious SQL querying to run faster than that, let alone a comparatively simple credential lookup.
    – DevSolar
    Jul 11, 2012 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.