title: LogonUser returns true for a disabled account
body: <p>i am calling <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa378184%28v=vs.85%29.aspx" rel="nofollow noreferrer">LogonUser</a> to try to validate a set of credentials:</p>
  
  <pre><code>LogonUser("forest", "avatopia.com" "stapler", 
           LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_WINNT50, out token);
  </code></pre>
  
  <p>And it returns <strong>true</strong>, even though the account is disabled:</p>
  
  <p><img src="https://i.stack.imgur.com/AuVSp.png" alt="enter image description here"></p>
  
  <hr>
  
  <blockquote>
    <p>i also tried using <a href="http://support.microsoft.com/kb/180548" rel="nofollow noreferrer">SSPI directly to validate credentials</a>, which
    involves calling: </p>
    
    <ul>
    <li><code>AcquireCredentialsHandle(..., "Negotiate", SECPKG_CRED_OUTBOUND, ..., ["forest", "stapler", "avatopia.com"], ...)</code></li>
    <li><code>InitializeSecurityContext(...)</code></li>
    <li><code>AcquireCredentialsHandle(..., "Negotiate", SECPKG_CRED_INBOUND, ...)</code></li>
    <li><code>AcceptSecurityContext(...)</code></li>
    <li><code>InitializeSecurityContext(...)</code></li>
    <li><code>AcceptSecurityContext(...)</code></li>
    </ul>
    
    <p>On most machines the initial call to <code>AcquireCredentialsHandle</code> fails
    if the user account is disabled. But on this particular machine i'm
    testing it completes the entire cycle and works.</p>
  </blockquote>
  
  <hr>
  
  <p>If i try with <em>invalid</em> password then <code>LogonUser</code> does (correctly) <strong>fail</strong>:</p>
  
  <pre><code>LogonUser("forest", "avatopia.com" "adf342sdf3", 
           LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_WINNT50, out token);
  </code></pre>
  
  <p>returns <strong>false</strong>, and <code>GetLastError</code> returns <code>1326</code> (Logon failure: unknown user name or password)</p>
  
  <blockquote>
    <p>Trying SSPI with an invalid password also (correctly) fails:</p>
    
    <ul>
    <li><code>AcquireCredentialsHandle(..., "Negotiate", SECPKG_CRED_OUTBOUND, ..., ["forest", "adf342sdf3", "avatopia.com"], ...)</code></li>
    <li><code>InitializeSecurityContext(...)</code></li>
    <li><code>AcquireCredentialsHandle(..., "Negotiate", SECPKG_CRED_INBOUND, ...)</code></li>
    <li><code>AcceptSecurityContext(...)</code>  <strong>fails</strong> with <code>8009030C</code> (<em>The logon attempt failed</em>)</li>
    </ul>
  </blockquote>
  
  <p>What is aggrevating is that this behavior is only happening on <strong>one</strong> machine.</p>
  
  <p>Why would <code>LogonUser</code>, and the entire Security Support Provider Interface, indicate that credentails of a disabled account on a particular domain-joined machine: are valid?</p>
  
  <ul>
  <li>domain joined machine where <code>LogonUser</code> (incorrectly) succeeds: Windows XP SP2</li>
  <li>domain joined machine where <code>LogonUser</code> (correctly) fails: Windows XP SP2</li>
  </ul>
  
  <hr>
  
  <p><strong>Update:</strong></p>
  
  <p>There is no local user called <code>Forest</code>:</p>
  
  <p><a href="https://i.stack.imgur.com/d3ulq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/d3ulq.png" alt="enter image description here"></a></p>
  
  <p>nor is there any local user called <code>Forest</code>:</p>
  
  <p><a href="https://i.stack.imgur.com/LjrCv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LjrCv.png" alt="enter image description here"></a></p>
  
  <p>which is irrelevant because i'm asking for <code>avatopia.com\Forest</code>, and not <code>speeder\Forest</code>.</p>
  
  <p><em>oi vay</em> People get their panties in a bunch just because a disabled user was allowed to access something they should have not have been allowed to access.</p>