WTSEnumerateSessions 挂起并且永不返回

我有一个用 C# 编写的 .Net 服务。我正在调用WTSEnumerateSessions。会话检查由计时器每 15 分钟运行一次，它列出所有会话并将用户名/域组合与预定义的用户集进行比较，以确定他们是否登录到服务器。

问题在于几个服务器的调用WTSEnumerateSessions无限期挂起。它工作正常几次，然后突然停止并导致服务变得无响应。

这是我用来枚举会话的代码。

[DllImport("wtsapi32.dll")]
static extern IntPtr WTSOpenServer([MarshalAs(UnmanagedType.LPStr)] String pServerName);

[DllImport("wtsapi32.dll")]
static extern void WTSCloseServer(IntPtr hServer);

[DllImport("wtsapi32.dll")]
static extern Int32 WTSEnumerateSessions(
       IntPtr hServer,
       [MarshalAs(UnmanagedType.U4)] Int32 Reserved,
       [MarshalAs(UnmanagedType.U4)] Int32 Version,
       ref IntPtr ppSessionInfo,
       [MarshalAs(UnmanagedType.U4)] ref Int32 pCount);

 [DllImport("wtsapi32.dll")]
 static extern void WTSFreeMemory(IntPtr pMemory);

 [DllImport("Wtsapi32.dll")]
 static extern bool WTSQuerySessionInformation(
        System.IntPtr hServer,
        int sessionId, 
        WTS_INFO_CLASS wtsInfoClass, 
        out System.IntPtr ppBuffer, 
        out uint pBytesReturned);

 [StructLayout(LayoutKind.Sequential)]
 private struct WTS_SESSION_INFO
 {
      public Int32 SessionID;

      [MarshalAs(UnmanagedType.LPStr)]
      public String pWinStationName;

      public WTS_CONNECTSTATE_CLASS State;
 }

 public enum WTS_INFO_CLASS
 {
      WTSInitialProgram,
      WTSApplicationName,
      WTSWorkingDirectory,
      WTSOEMId,
      WTSSessionId,
      WTSUserName,
      WTSWinStationName,
      WTSDomainName,
      WTSConnectState,
      WTSClientBuildNumber,
      WTSClientName,
      WTSClientDirectory,
      WTSClientProductId,
      WTSClientHardwareId,
      WTSClientAddress,
      WTSClientDisplay,
      WTSClientProtocolType
 }

 public enum WTS_CONNECTSTATE_CLASS
 {
      WTSActive,
      WTSConnected,
      WTSConnectQuery,
      WTSShadow,
      WTSDisconnected,
      WTSIdle,
      WTSListen,
      WTSReset,
      WTSDown,
      WTSInit
  }

 private void ListUsers_Elapsed()
 {
      IntPtr serverHandle = IntPtr.Zero;
      List<String> resultList = new List<string>();
      serverHandle = WTSOpenServer("");

      try
      {
        IntPtr SessionInfoPtr = IntPtr.Zero;
        IntPtr userPtr = IntPtr.Zero;
        IntPtr domainPtr = IntPtr.Zero;
        Int32 sessionCount = 0;
        Int32 retVal = WTSEnumerateSessions(serverHandle, 0, 1, ref SessionInfoPtr, ref                     sessionCount);
        Int32 dataSize = Marshal.SizeOf(typeof(WTS_SESSION_INFO));
        Int32 currentSession = (int)SessionInfoPtr;
        uint bytes = 0;

        if (retVal != 0)
        {
          for (int i = 0; i < sessionCount; i++)
          {
            WTS_SESSION_INFO si = (WTS_SESSION_INFO)Marshal.PtrToStructure((System.IntPtr)currentSession, typeof(WTS_SESSION_INFO));
            currentSession += dataSize;

            WTSQuerySessionInformation(serverHandle, si.SessionID, WTS_INFO_CLASS.WTSUserName, out userPtr, out bytes);
            WTSQuerySessionInformation(serverHandle, si.SessionID, WTS_INFO_CLASS.WTSDomainName, out domainPtr, out bytes);

            //Then I compare the session information against a list of users to determine if they are still active

            WTSFreeMemory(userPtr); 
            WTSFreeMemory(domainPtr);
          }

          WTSFreeMemory(SessionInfoPtr);
        }
      }
      finally
      {
        CloseServer(serverHandle);
      }

    }

我生成了一个用户转储，似乎有一个永远不会超时的 WaitForSingleObject：

00000000`cd78dd78 000007fe`fd6810dc ntdll!NtWaitForSingleObject+0xa
00000000`cd78dd80 000007fe`fce11442 KERNELBASE!WaitForSingleObjectEx+0x79
00000000`cd78de20 000007fe`fce113fd winsta!WaitForLsmStart+0xa3
00000000`cd78de50 000007fe`fce11336 winsta!OpenLocalLSM+0xe0
00000000`cd78deb0 000007fe`fce12669 winsta!CPublicBinding::GetLSMBinding+0x51
00000000`cd78def0 000007fe`fce12576 winsta!_tsrpcEnumerate+0xd3
00000000`cd78df90 000007fe`fb073500 winsta!WinStationEnumerateW+0x22
00000000`cd78dfc0 000007fe`8de35caf wtsapi32!WTSEnumerateSessionsA+0x60
00000000`cd78e030 000007fe`8de351c0 0x000007fe`8de35caf
00000000`cd78e120 000007fe`8de34b61 0x000007fe`8de351c0
00000000`cd78e260 000007fe`8de3849a 0x000007fe`8de34b61
00000000`cd78e2d0 000007fe`eb922c73 0x000007fe`8de3849a
00000000`cd78e370 000007fe`ec2639a5 System_ni+0x922c73
00000000`cd78e3e0 000007fe`ec263719 mscorlib_ni+0x4a39a5
00000000`cd78e540 000007fe`ec30be92 mscorlib_ni+0x4a3719
00000000`cd78e570 000007fe`ec30bc7e mscorlib_ni+0x54be92
00000000`cd78e600 000007fe`ec2c12e4 mscorlib_ni+0x54bc7e
00000000`cd78e670 000007fe`ed45a7f3 mscorlib_ni+0x5012e4
00000000`cd78e710 000007fe`ed45a6de clr!CallDescrWorkerInternal+0x83
00000000`cd78e750 000007fe`ed45ae76 clr!CallDescrWorkerWithHandler+0x4a
00000000`cd78e790 000007fe`ed519033 clr!MethodDescCallSite::CallTargetWorker+0x251
00000000`cd78e940 000007fe`ed45c121 clr!AppDomainTimerCallback_Worker+0x23
00000000`cd78ea30 000007fe`ed45c0a8 clr!ManagedThreadBase_DispatchInner+0x2d
00000000`cd78ea70 000007fe`ed45c019 clr!ManagedThreadBase_DispatchMiddle+0x6c
00000000`cd78eb70 000007fe`ed45c15f clr!ManagedThreadBase_DispatchOuter+0x75
00000000`cd78ec00 000007fe`ed518fc1 clr!ManagedThreadBase_FullTransitionWithAD+0x2f
00000000`cd78ec60 000007fe`ed518f35 clr!AppDomainTimerCallback+0x66
00000000`cd78ecc0 000007fe`ed518b42 clr!ThreadpoolMgr::AsyncTimerCallbackCompletion+0x36
00000000`cd78ed10 000007fe`ed4df046 clr!UnManagedPerAppDomainTPCount::DispatchWorkItem+0x122
00000000`cd78edb0 000007fe`ed4def3a clr!ThreadpoolMgr::ExecuteWorkRequest+0x46
00000000`cd78ede0 000007fe`ed59fcb6 clr!ThreadpoolMgr::WorkerThreadStart+0xf4
00000000`cd78ee70 00000000`775f59ed clr!Thread::intermediateThreadProc+0x7d
00000000`cd78f930 00000000`7772ba01 kernel32!BaseThreadInitThunk+0xd
00000000`cd78f960 00000000`00000000 ntdll!RtlUserThreadStart+0x1d

有人可以解释一下为什么它挂起，以及是否有更好的方法来做到这一点。我依赖计时器而不是注册的原因OnSessionChange事件是，在过去，我发现后者不可靠，因为它有时会触发虚假事件，或者在发生会话更改时根本不会触发。

正如我所说，除了少数服务器之外，这在大多数服务器上都运行良好。即使对于那些受该问题影响的人，它也会在计时器触发前 4 或 5 次已用事件后起作用，然后它只会挂在下一个引发的已用事件上，之后的每个连续已用事件也是如此。

附：受影响的服务器均安装了 Windows Server 2008 R2

EDIT:

好吧，我发现了一些非常奇怪的东西。我设法让 WTSEnumerateSessions 正常工作而不会挂起。问题是我所做的并没有真正意义，在我的生活中我无法弄清楚它在做什么来阻止绞刑。

这就是我所做的，出于沮丧，我正在寻找其他方法来获取会话列表。其中一种方法是使用LsaEnumerateLogonSessions获取会话列表而不是WTSEnumerateSessions。所以我在调用之前调用了以下函数WTSEnumerateSessions.

public static List<string> PopulateSessionsList()
        {
            var outList = new List<string>();
            System.Security.Principal.WindowsIdentity currentUser = System.Security.Principal.WindowsIdentity.GetCurrent();

            DateTime systime = new DateTime(1601, 1, 1, 0, 0, 0, 0); //win32 systemdate

            UInt64 count;
            IntPtr luidPtr = IntPtr.Zero;
            CommonWin32.LsaEnumerateLogonSessions(out count, out luidPtr);  //gets an array of pointers to LUIDs

            IntPtr iter = luidPtr;      //set the pointer to the start of the array

            for (ulong i = 0; i < count; i++)   //for each pointer in the array
            {
                IntPtr sessionData;

                CommonWin32.LsaGetLogonSessionData(iter, out sessionData);
                CommonWin32.SECURITY_LOGON_SESSION_DATA data = (CommonWin32.SECURITY_LOGON_SESSION_DATA)Marshal.PtrToStructure(sessionData, typeof(CommonWin32.SECURITY_LOGON_SESSION_DATA));

                //if we have a valid logon
                if (data.PSiD != IntPtr.Zero)
                {
                    //get the security identifier for further use
                    System.Security.Principal.SecurityIdentifier sid = new System.Security.Principal.SecurityIdentifier(data.PSiD);

                    //extract some useful information from the session data struct
                    var ptrToStringUni = Marshal.PtrToStringUni(data.Username.buffer);
                    if (ptrToStringUni != null)
                    {
                        string username = ptrToStringUni.Trim();          //get the account username
                        var toStringUni = Marshal.PtrToStringUni(data.LoginDomain.buffer);
                        if (toStringUni != null)
                        {
                            string domain = toStringUni.Trim();        //domain for this account  
                            var stringUni = Marshal.PtrToStringUni(data.AuthenticationPackage.buffer);
                            if (stringUni != null)
                            {
                                string authpackage = stringUni.Trim();    //authentication package
                            }
                            string session = data.Session.ToString();
                            CommonWin32.SECURITY_LOGON_TYPE secType = (CommonWin32.SECURITY_LOGON_TYPE)data.LogonType;
                            DateTime time = systime.AddTicks((long)data.LoginTime);                              //get the datetime the session was logged in

                            outList.Add("Session: " + session + " User: " + username + " *** Domain: " + domain + " *** Login Type: (" + data.LogonType + ") " + secType.ToString() + " *** Login Time: " + time.ToLocalTime().ToString());
                        }
                    }
                }
                iter = (IntPtr)((int)iter + Marshal.SizeOf(typeof(CommonWin32.LUID)));  //move the pointer forward
                CommonWin32.LsaFreeReturnBuffer(sessionData);   //free the SECURITY_LOGON_SESSION_DATA memory in the struct
            }
            CommonWin32.LsaFreeReturnBuffer(luidPtr);   //free the array of LUIDs

            return outList;
        }

这是我的 pInvoke 代码：

[DllImport("secur32.dll", SetLastError = false)]
public static extern uint LsaFreeReturnBuffer(IntPtr buffer);

[DllImport("Secur32.dll", SetLastError = false)]
public static extern uint LsaEnumerateLogonSessions(out UInt64 LogonSessionCount, out IntPtr LogonSessionList);

[DllImport("Secur32.dll", SetLastError = false)]
public static extern uint LsaGetLogonSessionData(IntPtr luid, out IntPtr ppLogonSessionData);

令我惊讶的是，调用此方法解决了悬而未决的问题。我不知道它为什么这样做。不确定它是否调用某些内部/私有方法。

如果不调用新方法，只需连续调用不到 10 次，罪魁祸首就会挂起，我在多台机器上尝试的每次测试都是这种情况。添加代码后，它就可以工作了。如果你打电话没关系WTSEnumerateSessions就像一分钟 1000 次一样，它从未挂起。一次也没有。

有人能告诉我为什么打电话吗LsaEnumerateLogonSessions and LsaGetLogonSessionData神奇地停止悬挂。有关这些函数内部功能的任何信息吗？