microsoft / microsoft/terminal

Isolated Mode? Logon NetCredentials Only Not Respected In Shell Process

Open
#19,468 2 comments 0 reactions 0 assignees View on GitHub
Area-Remoting Issue-Bug Priority-3 Product-Terminal
Dominant language
C++
Stars
105k
Forks
9.6k
Avg merge
3d 17h
Merged PRs (30d)
29

Description

### Windows Terminal version

1.23.12811.0

### Windows build number

10.0.22631.0

### Other Software

No other software.

#### Notes
The related api is this [link](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw#parameters), namely, the `dwLogonFlags` parameter and `LOGON_NETCREDENTIALS_ONLY`. Switching to `wezterm` for now because I need this workflow and I can't go back to `conhost.exe`.

#### Other Attempts
I use `scoop` too. I used to be able to make it work by calling `WindowsTerminal.exe` directly thereby avoiding the _shim_ and _soft link_. Now even calling `WindowsTerminal.exe` directly stopped working.

### Steps to reproduce
Can use [`ProcessEx`](https://github.com/jborean93/processex) or native binary `runas.exe`.
```pwsh
Install-Module ProcessEx
start-processwith -FilePath wt -Credential (get-credential domain\user) -NetCredentialsOnly
# or
runas /netonly /user:domain\user wt
```

### Expected Behavior

When using `Invoke-Command -ComputerName remote -ScriptBlock { whoami }` or the like should return the net credential user name.

### Actual Behavior

When using `Invoke-Command -ComputerName remote -ScriptBlock { whoami }` or the like the local non network only credential user is returned.

#### Workaround
So it appears this is related to `wt` and `WindowsTerminal` avoiding creating a brand new process when one already exists. So I was inheriting from the previous process so my net only cred was being ignored.

Solution is to open `conhost` first and then launch `wt` making sure that there isn't already a window opened.

It would be nice if there was a way to launch a brand new process though. It appears one is only able to have one `wt` process open at once.

Contributor guide

Open the contributing guide

Research direction

Reproduce the behavior with ProcessEx or `runas /netonly`, comparing an existing Windows Terminal instance with a launch through `conhost`. Start at the `wt`/`WindowsTerminal.exe` process-launch and reuse path. Done means a newly launched terminal preserves the `LOGON_NETCREDENTIALS_ONLY` credentials for remote `Invoke-Command` calls, or the supported limitation is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.