Win11 24H2中advapi32.dll的LogonUser调用失败（错误1326）求助

我有一段稳定运行10余年的代码，在Win11更新至FeaturePack 24H2后，调用advapi32.dll中的LogonUser方法时持续返回错误1326（用户名或密码不正确）。但相同代码在Win11 23H2、Win10及服务器版本中仍可正常运行，错误仅发生在LogonUser调用环节，相关代码如下：

internal class Program
{
    public const int LOGON32_LOGON_BATCH = 4;
    public const int LOGON32_LOGON_NETWORK = 3;
    public const int LOGON32_LOGON_INTERACTIVE = 2;
    public const int LOGON32_LOGON_NETWORK_CLEARTEXT = 8;
    public const int LOGON32_PROVIDER_DEFAULT = 0;
    public const int LOGON32_PROVIDER_WINNT50 = 3;
    public const int FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000;
    public const int FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200;
    public const int FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x00000100;

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern bool LogonUser(String lpszUsername, String lpszDomain, String lpszPassword,
        int dwLogonType, int dwLogonProvider, ref IntPtr TokenHandle);


    [DllImport("Kernel32.dll", SetLastError = true)]
    static extern uint FormatMessage(uint dwFlags, IntPtr lpSource,
        uint dwMessageId, uint dwLanguageId, ref IntPtr lpBuffer,
        uint nSize, IntPtr pArguments);

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern IntPtr LocalFree(IntPtr hMem);


    private static IntPtr m_tokenHandle = IntPtr.Zero;


    static void Main(string[] args)
    {
        string user = "user";
        string domain = "domain";
        string pwd = "pwd";

        if (!LogonUser(user, domain, pwd,
                LOGON32_LOGON_NETWORK_CLEARTEXT, LOGON32_PROVIDER_DEFAULT,
                ref m_tokenHandle))
            Console.WriteLine("LogonUser " + getWin32ErrMessage());
        else
            Console.WriteLine("LogonUser successful");

        Console.ReadKey();
    }

    private static string getWin32ErrMessage()
    {
        int errCode = -1;
        string errMsg = "?";

        try
        {
            errCode = Marshal.GetLastWin32Error();
            errMsg = FormatMessage(errCode);
        }
        catch (Exception)
        {

        }

        return String.Format("failed with error code {0}, msg: {1}", errCode, errMsg);
    }

    public static string FormatMessage(int winErrCode)
    {
        int nLastError = winErrCode;

        IntPtr lpMsgBuf = IntPtr.Zero;

        uint dwChars = FormatMessage(
            FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
            IntPtr.Zero,
            (uint)nLastError,
            0, // Default language
            ref lpMsgBuf,
            0,
            IntPtr.Zero);
        if (dwChars == 0)
        {
            return null;
        }

        string sRet = Marshal.PtrToStringAnsi(lpMsgBuf);

        // Free the buffer.
        lpMsgBuf = LocalFree(lpMsgBuf);
        return sRet;
    }
}

排查方向 #

• 调整登录类型与提供程序：Win11 24H2可能对LOGON32_LOGON_NETWORK_CLEARTEXT（类型8）的验证逻辑做了变更，尝试替换为LOGON32_LOGON_INTERACTIVE（类型2）或LOGON32_LOGON_BATCH（类型4），搭配LOGON32_PROVIDER_WINNT50（类型3）测试是否能正常获取令牌。
• 检查本地安全策略：打开本地安全策略→本地策略→用户权限分配，确认目标账户拥有允许本地登录等必要权限；同时检查安全选项中是否有禁用明文登录、限制网络身份验证的设置。
• 验证账户有效性：直接在Win11 24H2系统上用该账户登录本地或域，确认密码未过期、账户未锁定，排除账户本身的问题。
• 修正错误信息编码：代码中FormatMessage使用Marshal.PtrToStringAnsi可能导致Unicode错误信息乱码，改为Marshal.PtrToStringUni确保错误信息准确，避免误导排查。
• 区分本地/域账户测试：如果是域账户，改用本地管理员账户测试，排查是否是域控制器与24H2系统的身份验证协议（如NTLM版本）兼容性问题。

内容的提问来源于stack exchange，提问作者Oliver M.