GetActiveUserInfo

Retrieves information about the currently active user account.
On Windows, when running in service mode, the active user is typically the one logged into the system, with priority given to the user actively using the GUI. When the SDK is running under a specific user account, the active user is the one who owns the SDK process.

Syntax

Method ID

#define WAAPI_MID_GET_ACTIVE_USER_INFO 6

JSON Input Structure

{
  "input": {
    "method": 6,
    "check_password_protection": boolean,
    "get_user_principal_name": boolean
  }
}

Input Properties

Parameter	Type	Description
check_password_protection	boolean	(optional) If true, will check if current user is password protected. OESIS Framework will try to change the password with an empty one or (if not possible) to login with an empty password. Performing one of the two operations will increase the bad password count for the current user. OESIS Framework will perform only one of the two operations per each 'Lockout observation window (minutes)'. More info about Account Lockout/Threshold and BadPasswordCount can be found here https://social.technet.microsoft.com/wiki/contents/articles/32490.active-directory-bad-passwords-and-account-lockout.aspx . If OESIS Framework needs another attempt and 'Lockout observation window (minutes)' is not passed, OESIS Framework will return the following: WAAPI_CACHE_DATA_STALE (if we have value in our cache for password protection state) or WAAPI_FAILED_TO_GET_PASSWORD_PROTECTION if we have no cached value for password protection state. If this flag is set to false, OESIS Framework will return WAAPI_FAILED_TO_GET_PASSWORD_PROTECTION and 'protected' field will be false (default value) but it should not be taken into consideration. Default value is 'true'.
get_user_principal_name	boolean	(optional) (Windows only) (Windows only) If true, the function will attempt to retrieve the user principal name (UPN) of the current user. The UPN is a unique identifier in Active Directory, typically formatted as 'username@domain'. If set to false, UPN retrieval will be skipped. Default value is 'false'. If the UPN is not available, the method returns WAAPI_OK_USER_PRINCIPAL_NAME_NOT_AVAILABLE.If an error occurs while retrieving the UPN, the method returns WAAPI_FAILED_TO_GET_USER_PRINCIPAL_NAME. Note: In case SDK fails to retrieve both the UPN and the password protection state, the SDK will return WAAPI_FAILED_TO_GET_PASSWORD_PROTECTION.

JSON Output Structure

{
  "result": {
    "method": 6,
    "code": number,
    "timing": number,
    "timestamp": string,
    "username": string,
    "domain": string,
    "user_principal_name": string,
    "protected": boolean,
    "protected_info": string,
    "multi_factor_unlock": {
      "pin_enabled": boolean,
      "face_enabled": boolean,
      "fingerprint_enabled": boolean
    }
  }
}

Output Properties

Property	Type	Description
result.method	number	The method ID that generated this result.
result.code	number	The result code. See Result Codes.
result.timing	number	The measured time for the method call in milliseconds.
result.timestamp	string	The timestamp in seconds of when the call was made.
result.username	string	The name of the logged-on user with an active session.
result.domain	string	The domain which the user account belongs to.
result.user_principal_name	string	(optional) (Windows only) The User Principal Name (UPN) of the current user.
result.protected	boolean	The password protection state of the current user.
result.protected_info	string	The mechanism used for determining password protection state of the current user.
result.multi_factor_unlock	object	(Windows only) Credentials (PIN and biometrics) for unlocking a device.
result.multi_factor_unlock.pin_enabled	boolean	(optional) (Windows only) True if the PIN for Windows Hello is enabled.
result.multi_factor_unlock.face_enabled	boolean	(optional) (Windows only) True if the facial recognition for Windows Hello is enabled.
result.multi_factor_unlock.fingerprint_enabled	boolean	(optional) (Windows only) True if the fingerprint recognition for Windows Hello is enabled.

Result Codes

Code	Name	Description
0	WAAPI_OK	The operation completed successfully.

note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks

Error Handling

The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.

Knowledge Base

The return code of GetActiveUserInfo is affected by the check_password_protection input parameter.

When check_password_protection is set to false, the password protection check is skipped entirely. The protected and protected_info fields are not evaluated. A return code of 0 (WAAPI_OK) defines a successful call.

(Linux only) A return code of 1 (WAAPI_OK_TRUE) may also be returned when the active user is resolved through a systemd session.

When check_password_protection is set to true or is omitted (defaults to true), the return code is determined by the password protection retrieval result, which overwrites the active user detection return code. A return code of 0 (WAAPI_OK) defines a successful call where the password protection status was retrieved successfully.

(macOS and Linux only) A return code of 9 (WAAPI_FAILED_TO_GET_PASSWORD_PROTECTION) defines a successful call where the active user was detected but the password protection state could not be retrieved — for example, when the account is locked or the process lacks the privileges required to query it.

(Windows only) When get_user_principal_name is also set to true, a return code of 20 (WAAPI_OK_USER_PRINCIPAL_NAME_NOT_AVAILABLE) or 19 (WAAPI_FAILED_TO_GET_USER_PRINCIPAL_NAME) may be returned if the UPN lookup fails.

Examples

Examples will be added here demonstrating the usage of this method.

See Also

• Getting Started Guide

---

Last updated: 2026-10-01