Listen to this Post
The Windows interfaces `IConnectedUser` (GUID: 9D5F2149-DE8C-45F2-B313-6587A04F771D) and `IConnectedUserStore` (GUID: 9EC044BC-B01D-4C18-8634-59BD3FF5DCC1) are undocumented Microsoft APIs that allow managing internet-linked user accounts. These interfaces enable:
– Creating a new local account linked to an internet identity.
– Connecting an internet identity to an existing local account.
– Retrieving user properties (SID, email, name, etc.).
– Deleting internet-linked users.
GitHub Repository: IConnectedUser/cu.cpp
You Should Know:
1. Initializing COM and Querying Interface
CoInitializeEx(NULL, COINIT_MULTITHREADED);
IConnectedUserStore pStore = NULL;
HRESULT hr = CoCreateInstance(
CLSID_ConnectedUserStore,
NULL,
CLSCTX_INPROC_SERVER,
IID_IConnectedUserStore,
(void)&pStore
);
if (SUCCEEDED(hr)) {
// Interface successfully obtained
}
2. Creating a New Internet-Linked User
IConnectedUser pUser = NULL; hr = pStore->CreateConnectedUser( L"[email protected]", L"LocalAccountName", L"Password123", &pUser );
3. Retrieving User Properties
BSTR email, name, sid; pUser->get_Email(&email); pUser->get_Name(&name); pUser->get_Sid(&sid); wprintf(L"Email: %s\nName: %s\nSID: %s\n", email, name, sid); SysFreeString(email); SysFreeString(name); SysFreeString(sid);
4. Deleting an Internet User
hr = pStore->DeleteConnectedUser(L"[email protected]");
5. Enumerating Connected Users
IEnumConnectedUsers pEnum = NULL;
hr = pStore->EnumConnectedUsers(&pEnum);
if (SUCCEEDED(hr)) {
IConnectedUser pUsers[bash];
ULONG fetched = 0;
while (pEnum->Next(10, pUsers, &fetched) == S_OK) {
for (ULONG i = 0; i < fetched; i++) {
// Process each user
pUsers[bash]->Release();
}
}
pEnum->Release();
}
6. PowerShell Alternative (Limited)
Get-LocalUser | Where-Object { $_.PrincipalSource -eq "MicrosoftAccount" }
7. Registry Inspection (Manual Verification)
reg query "HKLM\SOFTWARE\Microsoft\IdentityStore\ConnectedUsers"
What Undercode Say:
These interfaces are likely remnants of Microsoft’s efforts to integrate online identities (Microsoft Accounts) with local Windows accounts. While undocumented, they provide deep control over user management, useful for forensic analysis or custom authentication systems. However, misuse could lead to security risks, including unauthorized account linking.
Expected Output:
- Developers can experiment with these APIs for advanced Windows account automation.
- Security researchers should monitor for abuse in privilege escalation attacks.
- Future Windows updates may deprecate or expose these interfaces officially.
Prediction:
Microsoft may eventually document or restrict these interfaces as part of hardening Windows against identity-based attacks. Meanwhile, reverse engineers will continue uncovering hidden functionalities.
Would you like an expanded deep dive into Windows COM exploitation using these APIs?
References:
Reported By: Alex S – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
