Home/ Questions/Q 8429723
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-10T05:24:55+00:00

I’m trying to hook local account creation and block it if needed (I’m building

  • 0

I’m trying to hook local account creation and block it if needed (I’m building a small security tool which will even block administrators from messing around with configurations).

I’ve figured out that I must inject to LSASS, But I’m not really sure what is the exact function I need to detour.
Currently I’m testing on XP SP3, But I’m looking for a solution that will work on every windows from XP to 8 .

I’ve tried to detour SAM’s functions SamrCreateUserInDomain but it hasn’t been called when I’ve created a local user using lusrmgr.msc.
I’ve also tried LsarCreateAccount. But it hasn’t been called as well.

I figured that I probably need to hook some Active Directory function but I’m not sure which one is it.

Any help?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’ve solved my problem.
    I hooked the wrong function.

    I should have hooked SAM’s SamrCreateUser2InDomain, not SamrCreateUserInDomain.

    Fixing that, and everything is working perfectly.

    • 0