Question

I have this nifty PAM module that validates each session (like a desktop session) on authentication and, based on some criteria, either allows or prevents it. I would like to do the same on Windows 7.

Now, this may sound silly or trivial to no extent, but I really don’t know my way around Windows systems, and would thus like a few pointers on how to achieve something similar (i.e. a service or a module that is queried when e.g. a user tries to start a session.)

Answer 1

I think what you are looking for is a Subauthentication Package, but you could get some mileage with a Credential Provider.

A Subauthentication Package is a dynamically linked library that the local security authority or the Kerberos Key Distribution center (KDC) will call after authentication has succeeded, but before access is granted to the user.

Windows will authenticate the user locally or through Kerberos, depending on your configuration. You must build a DLL that exports the two functions:

• Msv1_0SubAuthenticationRoutine (not called for interactive logons or Kerberos)
• Msv1_0SubAuthenticationFilter

You put your code in that DLL, and return STATUS_SUCCESS if the user is allowed to log on, or one of the other error codes. You cannot assume that you will have access to the password.

If you log on through Kerberos, you must register your DLL on the KDC. It makes it hard to authentication against some local information, like a hardware or biometric device.

So maybe a Credential Provider could help you, but it is not the most elegant solutions. It was designed to capture credentials and feed them to an authentication package. But Microsoft made shure a credential provider will not lock a user out, so it might not always be called (in safe mode) and the user could install another CP, etc. So I mention it for the sake of completness.