{
	"id": "9689855c-495b-4393-b830-51e3753db9a0",
	"created_at": "2026-04-06T00:08:20.475058Z",
	"updated_at": "2026-04-10T03:20:37.88069Z",
	"deleted_at": null,
	"sha1_hash": "02abb4bd1cc7fc36ba42e43d7d3db905e32a2c34",
	"title": "NPLogonNotify function (npapi.h) - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 64916,
	"plain_text": "NPLogonNotify function (npapi.h) - Win32 apps\r\nBy GrantMeStrength\r\nArchived: 2026-04-05 23:22:08 UTC\r\nNote\r\nThis API has been deprecated and will be removed in a future release.\r\nMPR calls this function to notify the credential manager that a logon event has occurred, allowing the credential\r\nmanager to return a logon script. The NPLogonNotify function is implemented by a credential manager DLL (see\r\nRemarks).\r\nDWORD NPLogonNotify(\r\n [in] PLUID lpLogonId,\r\n [in] LPCWSTR lpAuthentInfoType,\r\n [in] LPVOID lpAuthentInfo,\r\n [in] LPCWSTR lpPreviousAuthentInfoType,\r\n [in] LPVOID lpPreviousAuthentInfo,\r\n [in] LPWSTR lpStationName,\r\n [in] LPVOID StationHandle,\r\n [out] LPWSTR *lpLogonScript\r\n);\r\n[in] lpLogonId\r\nPointer to the identifier of the session that just logged on.\r\n[in] lpAuthentInfoType\r\nPointer to a string that identifies the type of structure pointed to by lpAuthentInfo.\r\nWhen Microsoft is the primary authenticator, one of the following strings is specified for interactive and service\r\ncontroller logons.\r\nMSV1_0:Interactive\r\nKerberos:Interactive\r\n[in] lpAuthentInfo\r\nPointer to a structure that contains the credentials used to successfully log the user on through the primary\r\nauthenticator.\r\nhttps://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\r\nPage 1 of 4\n\nWhen Microsoft is the primary authenticator (that is, when lpAuthentifoType is \"MSV1_0:Interactive\" or\r\n\"Kerberos:Interactive\"), the structure used is MSV1_0_INTERACTIVE_LOGON or\r\nKERB_INTERACTIVE_LOGON.\r\n[in] lpPreviousAuthentInfoType\r\nPointer to a string that identifies the type of structure pointed to by lpPreviousAuthentInfo. If the pointer is NULL,\r\nthere was no previous information. The values that are expected here are the same as those in lpAuthentInfoType.\r\nWhen Microsoft is the primary authenticator, the following string is specified for interactive and service controller\r\nlogons.\r\nMSV1_0:Interactive\r\n[in] lpPreviousAuthentInfo\r\nPointer to a structure that contains the credentials used before the authentication information change. Prior\r\ninformation is provided if the user was forced to change the password (or other authentication information) before\r\nlogging on. If the user was not forced to change authentication information, this pointer is NULL. The values that\r\nare expected here are the same as those in lpAuthentInfo.\r\nWhen Microsoft is the primary authenticator, the structure used is MSV1_0_INTERACTIVE_LOGON or\r\nKERB_INTERACTIVE_LOGON.\r\n[in] lpStationName\r\nPointer to a string that specifies the name of the station that the user has logged on to. The station name may be\r\nused to determine whether additional (provider-specific) information can be obtained.\r\nWhen Microsoft is the primary authenticator, one of the following strings will be specified.\r\nValue Meaning\r\nWinSta_0\r\nIndicates that this is an interactive logon through the window station. In this case,\r\nStationHandle is an HWND to the parent dialog box.\r\nSvcCtl\r\nIndicates that this is a logon initiated by the Service controller. StationHandle is not used in this\r\ncase.\r\n[in] StationHandle\r\nA 32-bit value whose meaning is dependent upon the name (and consequently, the type) of the station specified in\r\nlpStationName.\r\nValue Meaning\r\nhttps://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\r\nPage 2 of 4\n\nWinSta_0 A handle to the owner dialog box (hwndOwner) currently displayed on the screen.\r\nSvcCtl Random data. Do not use.\r\n[out] lpLogonScript\r\nPointer to a location where a pointer to a null-terminated string may be returned.\r\nAfter the function completes, this value may point to a null-terminated string that contains the name of a program\r\nto execute plus any parameters the program requires. LocalAlloc should be used to allocate the memory for the\r\nreturned string. This memory will be freed by MPR when it is no longer needed.\r\nIf the function succeeds, the function returns WN_SUCCESS.\r\nIf the function fails, it returns an error code, which can be one of the following.\r\nReturn code Description\r\nWN_NOT_SUPPORTED NPLogonNotify is not supported by the credential manager.\r\nWN_NO_NETWORK The network is not present.\r\nWN_FUNCTION_BUSY The credential manager is still initializing and is not ready to be called.\r\nThe NPLogonNotify function is implemented by credential managers to receive notifications when authentication\r\ninformation changes.\r\nEach credential manager is allowed to return a single command-line string that can be used to execute a logon\r\nscript (the implementation should not call LogonUser or load a user profile directly). The buffer of this string is\r\nallocated by the credential manager. MPR is responsible for freeing it. The string returned in lpLogonScript should\r\ncontain all the information necessary to run the script as a command line passed to CreateProcess.\r\nIf the string requires the command processor to process the string, as in the case of commands or batch files, then\r\nthe string should be prefixed with cmd /C.\r\nLogon scripts will be run in the user context when the user profile is available. However, environment variables\r\nthat are set will not be global and will not be available to the initial shell (for example, Program Manager) or any\r\nother program run on behalf of the user.\r\nhttps://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\r\nPage 3 of 4\n\nRequirement Value\r\nMinimum supported client Windows XP [desktop apps only]\r\nMinimum supported server Windows Server 2003 [desktop apps only]\r\nTarget Platform Windows\r\nHeader npapi.h\r\nCreateProcess\r\nLocalAlloc\r\nMSV1_0_INTERACTIVE_LOGON\r\nNPGetCaps\r\nNPPasswordChangeNotify\r\nSource: https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\r\nhttps://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify"
	],
	"report_names": [
		"nf-npapi-nplogonnotify"
	],
	"threat_actors": [],
	"ts_created_at": 1775434100,
	"ts_updated_at": 1775791237,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/02abb4bd1cc7fc36ba42e43d7d3db905e32a2c34.pdf",
		"text": "https://archive.orkl.eu/02abb4bd1cc7fc36ba42e43d7d3db905e32a2c34.txt",
		"img": "https://archive.orkl.eu/02abb4bd1cc7fc36ba42e43d7d3db905e32a2c34.jpg"
	}
}