Get computer principal name with `GetUserNameEx`

Question

I tried to get computer principal name of a service running as Network Service with the following code.

BOOLEAN bError = GetUserNameEx(NameUserPrincipal, buffer, &buf_len);

Since the domain name of my computer is [email protected], I expect the result in buffer is the same. However, the returned service principal name is [email protected]. I'm sure I've changed my computer and add it into the domain example.com.

I've no idea about the abnormal principal name. What may be the problem? Any hints will be highly appreciated.

UPDATE

---

I'm running the service on domain controller, don't know whether this will interfere the result.

Thank you and best regards!

Answer 1

I would not expect to get the computer name when looking up the user name for the Network Service user account. If you look it up with LookupAccountSid, I'd expect to see NT AUTHORITy\NETWORK SERVICE:

#include <windows.h>
#include <iostream>

int main(){
    SID nss;
    DWORD size = sizeof(nss);

    CreateWellKnownSid(WinNetworkServiceSid, NULL, &nss, &size);

    char name[256];
    DWORD n_size = sizeof(name);
    char domain[256];
    DWORD d_size = sizeof(domain);
    SID_NAME_USE type;

    LookupAccountSid(NULL, &nss, name, &n_size, domain, &d_size, &type);

    std::cout << domain << "\\" << name << "\n";
    return 0;
}

[And that's what I get].

I'd guess the user name you're seeing it some remnant of an automatically created user account. There's apparently some remnant of that original name long after you've changed names to other things. I've also seen them now and again, though never seen a dependable enough pattern to predict when they would or wouldn't show up (and have never found any way to be sure they're entirely gone either).