Named channel over the network without a login and password

Here is a working example of named pipes. There is no need to subtilize with the registry; only, on the client in the source code you need to replace (to work on two different PCs on the network, and not on the same machine) #define SERVER_NAME L"YOUR_REAL_SERVER_NAME" (that is, the real windows name of the computer where the server will be running), You can leave #define SERVER_NAME L"." on the server #define SERVER_NAME L"."

[UPDATE] According to the answer found by @Im ieee, in the GitHub example, you need to replace lines 199-201 with:

 L"(A;OICI;GA;;;AN)" // allow full control to anonymous L"(A;OICI;GRGW;;;AU)" // allow read/write to authenticated users L"(A;OICI;GA;;;BA)" // allow full control to administrators ; 

and on the client add such lines before attempting to open an anonymous named pipe:

 NETRESOURCE nr; ZeroMemory( &nr, sizeof(nr) ); nr.dwType = RESOURCETYPE_ANY; nr.lpRemoteName = FULL_SERVER_NAME; dwError = WNetAddConnection2( &nr, L"", L"", 0); if( dwError != ERROR_SUCCESS ) { wprintf_s(L"WNetAddConnection2 fails"); goto Cleanup; } 

after which this solution will work (taking into account that the name of the test named pipe, SamplePipe, has been added to the registry variable SYSTEM \ CurrentControlSet \ Services \ lanmanserver \ parameters \ NullSessionPipes

Here is the complete solution code: client.cpp

 #pragma region Includes #include <stdio.h> #include <Windows.h> #pragma endregion #define SERVER_NAME L"VIRTUAL-XP" // change to your server name! #define FULL_SERVER_NAME L"\\\\" SERVER_NAME #define PIPE_NAME L"SamplePipe" #define FULL_PIPE_NAME FULL_SERVER_NAME L"\\pipe\\" PIPE_NAME #define BUFFER_SIZE 1024 #define REQUEST_MESSAGE L"Default request from client" int wmain(int argc, wchar_t * argv[]) { HANDLE hPipe = INVALID_HANDLE_VALUE; DWORD dwError = ERROR_SUCCESS; NETRESOURCE nr; ZeroMemory( &nr, sizeof(nr) ); nr.dwType = RESOURCETYPE_ANY; nr.lpRemoteName = FULL_SERVER_NAME; // These lines make client work with any server (including XP) // even if you not in domain or logged to the server // But don't forget to ass named pipe name to the registry on server! dwError = WNetAddConnection2( &nr, L"", L"", 0); if( dwError != ERROR_SUCCESS ) { wprintf_s(L"WNetAddConnection2 fails"); goto Cleanup; } while (TRUE) { hPipe = CreateFile( FULL_PIPE_NAME, GENERIC_READ | GENERIC_WRITE, 0, // no sharing nullptr, //default security attributes OPEN_EXISTING, //open existing pipe SECURITY_ANONYMOUS, //default attributes nullptr // no template file ); if (hPipe != INVALID_HANDLE_VALUE) { wprintf_s(L"The named pipe %s is now connected. \n", FULL_PIPE_NAME); break; } dwError = GetLastError(); if( dwError == ERROR_PIPE_BUSY ) { //all pipe instances are busy so wait for 5 secs if (!WaitNamedPipe(FULL_PIPE_NAME, 5000)) { dwError = GetLastError(); wprintf_s(L"Could not open named pipe. 5 sec timeout expired \n"); goto Cleanup; } } else { wprintf_s(L"Unable to open named pipe with error %08lx \n", dwError); goto Cleanup; } } // Set the read mode and blocking mode of the named pipe. Here , we set data to be read from the pipe as a stream of messages. DWORD dwMode = PIPE_READMODE_MESSAGE; if (!SetNamedPipeHandleState(hPipe, &dwMode, nullptr, nullptr)) { dwError = GetLastError(); wprintf_s(L"SetNamedPipeHandleState failed with error %08lx \n", dwError); goto Cleanup; } //Send request from client to server wchar_t chRequest[] = REQUEST_MESSAGE; DWORD cbRequest, cbWritten; cbRequest = sizeof(chRequest); if (!WriteFile(hPipe, chRequest, cbRequest, &cbWritten, nullptr)) { dwError = GetLastError(); wprintf_s(L"WriteFile failed with error message %08lx \n", dwError); goto Cleanup; } wprintf_s(L"Sent %ld bytes to server: %s \n", cbWritten, chRequest); // Receive a response from the server BOOL fFinishRead = TRUE; do { wchar_t chResponse[BUFFER_SIZE]; DWORD cbResponse, cbRead; cbResponse = sizeof(chResponse); fFinishRead = ReadFile(hPipe, chResponse, cbResponse, &cbRead, nullptr); dwError = GetLastError(); if (!fFinishRead && ERROR_MORE_DATA != dwError) { wprintf_s(L"Readfile from pipe %s failed with error %08lx \n", FULL_PIPE_NAME, dwError); break; } wprintf(L"Receive %ld bytes fom server : %s \n", cbRead, chResponse); } while (!fFinishRead); Cleanup: if (hPipe != INVALID_HANDLE_VALUE) { CloseHandle(hPipe); hPipe = INVALID_HANDLE_VALUE; } return dwError; } 

server.cpp

 /*************************************** PIPE_ACCESS_IMBOUND: Client (Generic_Write) -> Server( Generic_Read) PIPE_ACCESS_OUTBOUND: Server (Generic_Write) -> Client (Generic_Read) PIPE_ACCESS_DUPLEX: Client (Generic_Read or Generic_Write or Both) <--> Server (Generic_Read and Generic_Write) *******************************************/ #pragma region Includes #include <stdio.h> #include <windows.h> #include <sddl.h> //security descriptor description language #pragma endregion #define SERVER_NAME L"." #define PIPE_NAME L"SamplePipe" #define FULL_PIPE_NAME L"\\\\" SERVER_NAME L"\\pipe\\" PIPE_NAME //concatenation done by compiler #define BUFFER_SIZE 1024 #define RESPONSE_MESSAGE L"Default response from server" //Forward declarations of methods so that they can be used in main method. These will be defined later. BOOL CreatePipeSecurity(PSECURITY_ATTRIBUTES *); void FreePipeSecurity(PSECURITY_ATTRIBUTES ); int wmain(int argc, wchar_t * argv[]) { DWORD dwError = ERROR_SUCCESS; //error code definitions in winerr.h for windows apis PSECURITY_ATTRIBUTES pSA = nullptr; HANDLE hNamedPipe = INVALID_HANDLE_VALUE; //handleapi.h // Prepare the security attributes (the lpSecurityAttributes parameter in // CreateNamedPipe) for the pipe. This is optional. If the // lpSecurityAttributes parameter of CreateNamedPipe is NULL, the named // pipe gets a default security descriptor and the handle cannot be // inherited. The ACLs in the default security descriptor of a pipe grant // full control to the LocalSystem account, (elevated) administrators, // and the creator owner. They also give only read access to members of // the Everyone group and the anonymous account. However, if you want to // customize the security permission of the pipe, (eg to allow // Authenticated Users to read from and write to the pipe), you need to // create a SECURITY_ATTRIBUTES structure. if (!CreatePipeSecurity(&pSA)) //passing by ref so that the actual pointer value is updated. { dwError = GetLastError(); //errohandlingapi.h wprintf_s(L"CreatePipeSecurity failed with error 0x%08lx\n", dwError); // printf format %[parameter][flags][width][.precision][length]type goto Cleanup; } //Create Named pipe hNamedPipe = CreateNamedPipe( FULL_PIPE_NAME, PIPE_ACCESS_DUPLEX, //open mode PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT, PIPE_UNLIMITED_INSTANCES, //max intances BUFFER_SIZE, //output buffer size BUFFER_SIZE, // input buffer size NMPWAIT_USE_DEFAULT_WAIT, //time out interval pSA ); if (hNamedPipe == INVALID_HANDLE_VALUE) { dwError = GetLastError(); wprintf_s(L"CreateNamedPipe failed with error %08lx\n", dwError); goto Cleanup; } wprintf_s(L"The named pipe (%s) has been successfully created. \n", FULL_PIPE_NAME); //wait for the client to connect. wprintf_s(L"Waiting for the client to connect. \n"); // Blocking call on server. //ConnectNamedPipe Enables a named pipe server process to wait for a client process to connect to an instance of a named pipe. A client process connects by calling either the CreateFile or CallNamedPipe function. if (!ConnectNamedPipe(hNamedPipe, nullptr)) //namedpipeapi.h { dwError = GetLastError(); if (dwError != ERROR_PIPE_CONNECTED) { wprintf_s(L"ConnectNamedPipe failed with error %08lx \n", dwError); goto Cleanup; } } wprintf(L"Client is connected.\n"); //Receive request from client. BOOL fFinishedRead = FALSE; do { wchar_t chRequest[BUFFER_SIZE]; DWORD cbRequest, cbRead; cbRequest = sizeof(chRequest); //another blocking call. fFinishedRead = ReadFile( //fileapi.h hNamedPipe, //file handle which is the named pipe handle chRequest, //buffer cbRequest, // no. of bytes to read &cbRead, // no. of bytes read , pass by ref so that the callee can update the value. nullptr ); dwError = GetLastError(); if (!fFinishedRead && dwError != ERROR_MORE_DATA) { wprintf_s(L"ReadFile failed with error %08lx \n", dwError); goto Cleanup; } wprintf_s(L"Received %ld bytes from client: %s \n", cbRead, chRequest); } while (!fFinishedRead); //repeat loop if ERROR_MORE_DATA. //send a response from server to client. wchar_t chResponse[] = RESPONSE_MESSAGE; DWORD cbResponse, cbWritten; cbResponse = sizeof(chResponse); //another blocking call. if (!WriteFile( hNamedPipe, chResponse, cbResponse, &cbWritten, nullptr )) { dwError = GetLastError(); wprintf_s(L"WriteFile failed with error %08lx \n", dwError); goto Cleanup; } wprintf_s(L"Sent %ld bytes to client: %s \n", cbWritten, chResponse); //Flush the pipe to allow the client to read the pipe's contents before disconnecting. FlushFileBuffers(hNamedPipe); DisconnectNamedPipe(hNamedPipe); Cleanup: if (!pSA) { FreePipeSecurity(pSA); pSA = nullptr; //always null after releasing. } if (hNamedPipe != INVALID_HANDLE_VALUE) { CloseHandle(hNamedPipe); hNamedPipe = INVALID_HANDLE_VALUE; } return dwError; } // // FUNCTION: CreatePipeSecurity(PSECURITY_ATTRIBUTES *) // // PURPOSE: The CreatePipeSecurity function creates and initializes a new // SECURITY_ATTRIBUTES structure to allow Authenticated Users read and // write access to a pipe, and to allow the Administrators group full // access to the pipe. // // PARAMETERS: // * ppSa - output a pointer to a SECURITY_ATTRIBUTES structure that allows // Authenticated Users read and write access to a pipe, and allows the // Administrators group full access to the pipe. The structure must be // freed by calling FreePipeSecurity. BOOL CreatePipeSecurity(PSECURITY_ATTRIBUTES *ppSA) { BOOL fSucceeded = TRUE; DWORD dwError = ERROR_SUCCESS; PSECURITY_DESCRIPTOR pSD = nullptr; PSECURITY_ATTRIBUTES pSA = nullptr; //Define SDDL for the security descriptor PCWSTR szSDDL = L"D:" //Discretionary ACL L"(A;OICI;GA;;;AN)" //allow full control to anonymous L"(A;OICI;GRGW;;;AU)" //allow read/write to authenticated users L"(A;OICI;GA;;;BA)" //allow full control to administrators ; if (!ConvertStringSecurityDescriptorToSecurityDescriptor(szSDDL, SDDL_REVISION_1, &pSD, nullptr)) { fSucceeded = FALSE; dwError = GetLastError(); goto Cleanup; } //allocate memory for security attributes pSA = (PSECURITY_ATTRIBUTES)LocalAlloc(LPTR, sizeof(*pSA)); //minwinbase.h for LPTR if (pSA == nullptr) { fSucceeded = FALSE; dwError = GetLastError(); goto Cleanup; } pSA->nLength = sizeof(*pSA); //sizeof(SECURITY_ATTRIBUTES) pSA->lpSecurityDescriptor = pSD; pSA->bInheritHandle = FALSE; *ppSA = pSA; Cleanup: if (!fSucceeded) { if (pSD) { LocalFree(pSD); //winbase.h pSD = nullptr; } if (pSA) { LocalFree(pSA); pSA = nullptr; } SetLastError(dwError); } return fSucceeded; } void FreePipeSecurity(PSECURITY_ATTRIBUTES pSA) { if (pSA) { if (pSA->lpSecurityDescriptor) { LocalFree(pSA->lpSecurityDescriptor); //clear its contents first. } LocalFree(pSA); //then clear itself. } } 

PS If you are going to build configurations in Release , do not forget to specify the _UNICODE; UNICODE; preprocessor options;