Overview
Create a new hidden logon session using the LOGON32_LOGON_NEW_CREDENTIALS logon type. This technique establishes a logon session that only affects network authentication while maintaining the current interactive session, enabling credential switching for network operations.Syntax
Required Parameters
string
required
Program to execute in the new logon session
Credential Parameters
string
Username for the new logon session
string
Domain for the new logon session
string
Password for the new logon session
Optional Parameters
boolean
Show the created process window
Examples
Technical Background
LOGON32_LOGON_NEW_CREDENTIALS
LOGON32_LOGON_NEW_CREDENTIALS
Logon Type Characteristics:
- Creates new logon session for network authentication only
- Maintains current interactive session unchanged
- Network operations use new credentials
- Local operations use original identity
- Cross-domain network access
- Service account impersonation
- Credential switching for network operations
- Stealth authentication context changes
Use Cases
Credential Context Switching
Credential Context Switching
Network Authentication:
- Access resources with different credentials
- Impersonate service accounts for network operations
- Cross-domain resource access
- Bypass current user’s network limitations
- Maintain original interactive session
- Reduce credential exposure
- Enable targeted credential use
- Support compartmentalized operations
Integration Workflows
Credential Reuse
Credential Reuse
Complete Workflow:
Related Commands
asktgt- Request TGT with credentialsptt- Alternative credential injection methodlogonsession- Enumerate logon sessions