microsoft / microsoft/terminal
Isolated Mode? Logon NetCredentials Only Not Respected In Shell Process
- Dominant language
- C++
- Stars
- 105k
- Forks
- 9.6k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 29
Description
### Windows Terminal version
1.23.12811.0
### Windows build number
10.0.22631.0
### Other Software
No other software.
#### Notes
The related api is this [link](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw#parameters), namely, the `dwLogonFlags` parameter and `LOGON_NETCREDENTIALS_ONLY`. Switching to `wezterm` for now because I need this workflow and I can't go back to `conhost.exe`.
#### Other Attempts
I use `scoop` too. I used to be able to make it work by calling `WindowsTerminal.exe` directly thereby avoiding the _shim_ and _soft link_. Now even calling `WindowsTerminal.exe` directly stopped working.
### Steps to reproduce
Can use [`ProcessEx`](https://github.com/jborean93/processex) or native binary `runas.exe`.
```pwsh
Install-Module ProcessEx
start-processwith -FilePath wt -Credential (get-credential domain\user) -NetCredentialsOnly
# or
runas /netonly /user:domain\user wt
```
### Expected Behavior
When using `Invoke-Command -ComputerName remote -ScriptBlock { whoami }` or the like should return the net credential user name.
### Actual Behavior
When using `Invoke-Command -ComputerName remote -ScriptBlock { whoami }` or the like the local non network only credential user is returned.
#### Workaround
So it appears this is related to `wt` and `WindowsTerminal` avoiding creating a brand new process when one already exists. So I was inheriting from the previous process so my net only cred was being ignored.
Solution is to open `conhost` first and then launch `wt` making sure that there isn't already a window opened.
It would be nice if there was a way to launch a brand new process though. It appears one is only able to have one `wt` process open at once.
Contributor guide
Research direction
Reproduce the behavior with ProcessEx or `runas /netonly`, comparing an existing Windows Terminal instance with a launch through `conhost`. Start at the `wt`/`WindowsTerminal.exe` process-launch and reuse path. Done means a newly launched terminal preserves the `LOGON_NETCREDENTIALS_ONLY` credentials for remote `Invoke-Command` calls, or the supported limitation is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100