在windows下有没方法检测到用户修改了密码
在windows下有没有方法检测到用户修改了密码？
这里我需要检测到用户修改密码，例如我运行着一个进程A，当用户修改密码后进程A可以知道，有什么方法？
------解决方案--------------------
组策略里面似乎可以设置修改密码时写事件，用事件查看器可以看。
------解决方案--------------------
hook
------解决方案--------------------
Event Logging Functions
The following functions are used with event logging.
Function Description
BackupEventLog Saves the specified event log to a backup file.
ClearEventLog Clears the specified event log, and optionally saves the current copy of the log to a backup file.
CloseEventLog Closes a read handle to the specified event log.
DeregisterEventSource Closes a write handle to the specified event log.
GetEventLogInformation Retrieves information about the specified event log.
GetNumberOfEventLogRecords Retrieves the number of records in the specified event log.
GetOldestEventLogRecord Retrieves the absolute record number of the oldest record in the specified event log.
NotifyChangeEventLog Enables an application to receive notification when an event is written to the specified event log.
OpenBackupEventLog Opens a handle to a backup event log.
OpenEventLog Opens a handle to the specified event log.
ReadEventLog Reads a whole number of entries from the specified event log.
RegisterEventSource Retrieves a registered handle to the specified event log.
ReportEvent Writes an entry at the end of the specified event log.
Send comments about this topic to Microsoft
Build date: 8/15/2007
------解决方案--------------------
刚运行gpedit.msc组策略编辑器，在里面没找到“修改密码时写事件”相关设置，看来修改密码时必然要写事件。
------解决方案--------------------
设置EventLog 事件通知， 当检测到特定的事件ID时 再判断是否有用户密码修改
------解决方案--------------------
ms-help://MS.VSCC.v90/MS.MSDNQTR.v90.chs/mmsdev/mms/creating_password_extensions.htm
Creating Password Extensions
MIIS allows you to programmatically manage passwords with a component that you create called a password extension. The password extension works in conjunction with the Microsoft Password Change Notification Service (PCNS) to capture password changes from Active Directory and propagate these changes to other connected data sources. For more information, see Password management in the Microsoft Identity Integration Server 2003 SP1 Help.
A password extension is a Microsoft .NET Framework class library, which is a dynamic link library (DLL) that implements one or more classes and the IMAPasswordManagement interface.
Microsoft Identity Integration Server 2003 SP1 performs the following steps when running a password extension:
Opens the class library DLL specified in the Extension name text box of the Password Management group in the Configure Extensions dialog box of the management agent properties.
Loads the extension object by finding a class that implements the IMAPasswordManagement interface.
Initializes the extension.
Calls the appropriate class methods.
Terminates the extension when the IMAPasswordManagement.EndConnectionToServer() method unloads the extension object and closes the class library DLL.
This topic has the following sections:
Implementing the Interfaces
Exceptions
Implementing the Interfaces
A password extension must implement the IMAPasswordManagement interface and the following methods from the Microsoft.MetadirectoryServices namespace:
BeginConnectionToServer
ChangePassword
EndConnectionToServer
GetConnectionSecurityLevel
RequireChangePasswordOnNextLogin
Note Although this method is not used in Microsoft Identity Integration Server 2003 SP1, you must still implement this method. You can implement this method by throwing the EntryPointNotImplementedException exception in this method.
这里我需要检测到用户修改密码，例如我运行着一个进程A，当用户修改密码后进程A可以知道，有什么方法？
------解决方案--------------------
组策略里面似乎可以设置修改密码时写事件，用事件查看器可以看。
------解决方案--------------------
hook
------解决方案--------------------
Event Logging Functions
The following functions are used with event logging.
Function Description
BackupEventLog Saves the specified event log to a backup file.
ClearEventLog Clears the specified event log, and optionally saves the current copy of the log to a backup file.
CloseEventLog Closes a read handle to the specified event log.
DeregisterEventSource Closes a write handle to the specified event log.
GetEventLogInformation Retrieves information about the specified event log.
GetNumberOfEventLogRecords Retrieves the number of records in the specified event log.
GetOldestEventLogRecord Retrieves the absolute record number of the oldest record in the specified event log.
NotifyChangeEventLog Enables an application to receive notification when an event is written to the specified event log.
OpenBackupEventLog Opens a handle to a backup event log.
OpenEventLog Opens a handle to the specified event log.
ReadEventLog Reads a whole number of entries from the specified event log.
RegisterEventSource Retrieves a registered handle to the specified event log.
ReportEvent Writes an entry at the end of the specified event log.
Send comments about this topic to Microsoft
Build date: 8/15/2007
------解决方案--------------------
刚运行gpedit.msc组策略编辑器，在里面没找到“修改密码时写事件”相关设置，看来修改密码时必然要写事件。
------解决方案--------------------
设置EventLog 事件通知， 当检测到特定的事件ID时 再判断是否有用户密码修改
------解决方案--------------------
ms-help://MS.VSCC.v90/MS.MSDNQTR.v90.chs/mmsdev/mms/creating_password_extensions.htm
Creating Password Extensions
MIIS allows you to programmatically manage passwords with a component that you create called a password extension. The password extension works in conjunction with the Microsoft Password Change Notification Service (PCNS) to capture password changes from Active Directory and propagate these changes to other connected data sources. For more information, see Password management in the Microsoft Identity Integration Server 2003 SP1 Help.
A password extension is a Microsoft .NET Framework class library, which is a dynamic link library (DLL) that implements one or more classes and the IMAPasswordManagement interface.
Microsoft Identity Integration Server 2003 SP1 performs the following steps when running a password extension:
Opens the class library DLL specified in the Extension name text box of the Password Management group in the Configure Extensions dialog box of the management agent properties.
Loads the extension object by finding a class that implements the IMAPasswordManagement interface.
Initializes the extension.
Calls the appropriate class methods.
Terminates the extension when the IMAPasswordManagement.EndConnectionToServer() method unloads the extension object and closes the class library DLL.
This topic has the following sections:
Implementing the Interfaces
Exceptions
Implementing the Interfaces
A password extension must implement the IMAPasswordManagement interface and the following methods from the Microsoft.MetadirectoryServices namespace:
BeginConnectionToServer
ChangePassword
EndConnectionToServer
GetConnectionSecurityLevel
RequireChangePasswordOnNextLogin
Note Although this method is not used in Microsoft Identity Integration Server 2003 SP1, you must still implement this method. You can implement this method by throwing the EntryPointNotImplementedException exception in this method.