Click here to Skip to main content
13,293,950 members (58,700 online)
Click here to Skip to main content
Add your own
alternative version


24 bookmarked
Posted 13 Aug 2007

How to Detect Empty Password Users

, 13 Aug 2007
Rate this:
Please Sign up or sign in to vote.
This article describes how to detect empty password users


This article describes how to detect empty password users in the Windows NT environment using Visual C++ 6. This method may require the Platform SDK.

Requisite Knowledge

Readers should be familiar with the C++ language and Windows API. This article is so simple that you can understand it even if you are not a professional.

Empty Password Users: Why We Detect Them

Empty password users can destroy local computers because a WORM VIRUS is able to use such accounts to spread itself. When you turn your system on without a password, your system infects within a minute. For this reason, if you can detect empty passwords, you can advise the user to set a password. In the past I searched Google for how to deal with this, but I could not get anything about it. So, I decided to write my own program. This is some simple empty password detection code that runs on Windows NT; it does not support Windows 9x.

What is the Problem?

The first idea is using the LogonUser API. This API can log in a given user name and return a result. The first code example is:

BOOL bLoggedOn = ::LogonUser(pszUserName, pszPassword, NULL, 

    printf("Logged On!\n");

However, the first code's problem is that the LogonUser API does not work with an empty password. We cannot call this function with a NULL password or "". In this situation, how can we detect an empty password? The answer is simple: just check the error code. In MSDN, LogonUser returns the error code via GetLastError. So, we can get LogonUser's error by using the GetLastError function. The following code describes how to get the error code of LogonUser.

HANDLE hToken = NULL; 
BOOL bLoggedOn = ::LogonUser(pszUserName, "", NULL, 
DWORD dwError = GetLastError();

dwError has the error code of LogonUser. LogonUser returns error code 1327 when a user has an empty password. I tested the following code from Windows XP on my own system and it works well.

HANDLE hToken = NULL; 
BOOL bLoggedOn = ::LogonUser(pszUserName, "", 
DWORD dwError = GetLastError();

if(bLoggedOn || dwError == 1327)
    printf("Empty Password Logon User: %s\n", pszUserName);


  • 13 August, 2007 -- Original version posted


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Yonghwi Kwon
Software Developer
United States United States
I started to write software since 1999 and have developed various products including security solutions and system utilities.

Microsoft Visual C++ MVP (from 2008 to present)

You may also be interested in...


Comments and Discussions

GeneralError 1327 Pin
DavidCrow21-Aug-07 4:32
mvpDavidCrow21-Aug-07 4:32 
GeneralRe: Error 1327 Pin
Kwon Yong Hwi22-Aug-07 4:20
memberKwon Yong Hwi22-Aug-07 4:20 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.171207.1 | Last Updated 13 Aug 2007
Article Copyright 2007 by Yonghwi Kwon
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid