From eb239501bc67d03336e724fde62aafd583762c84 Mon Sep 17 00:00:00 2001
From: Amirhosein Akhlaghpoor <m9.akhlaghpoor@gmail.com>
Date: Tue, 24 Feb 2026 13:14:18 +0000
Subject: [PATCH] Fix logon-screen password with click approval (#14335)

---
 src/platform/windows.cc  | 25 +++++++++++++++++++++++++
 src/platform/windows.rs  |  5 +++++
 src/server/connection.rs |  7 ++++---
 3 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/src/platform/windows.cc b/src/platform/windows.cc
index d83a1b0c4..74c20c80d 100644
--- a/src/platform/windows.cc
+++ b/src/platform/windows.cc
@@ -580,6 +580,31 @@ extern "C"
         return rdp_or_console;
     }
 
+    BOOL is_session_locked(BOOL include_rdp)
+    {
+        DWORD session_id = get_current_session(include_rdp);
+        if (session_id == 0xFFFFFFFF) {
+            return FALSE;
+        }
+        PWTSINFOEXW pInfo = NULL;
+        DWORD bytes = 0;
+        BOOL locked = FALSE;
+        if (WTSQuerySessionInformationW(
+                WTS_CURRENT_SERVER_HANDLE,
+                session_id,
+                WTSSessionInfoEx,
+                (LPWSTR *)&pInfo,
+                &bytes)) {
+            if (pInfo && pInfo->Level == 1) {
+                locked = (pInfo->Data.WTSInfoExLevel1.SessionFlags == WTS_SESSIONSTATE_LOCK);
+            }
+            if (pInfo) {
+                WTSFreeMemory(pInfo);
+            }
+        }
+        return locked;
+    }
+
     uint32_t get_active_user(PWSTR bufin, uint32_t nin, BOOL rdp)
     {
         uint32_t nout = 0;
diff --git a/src/platform/windows.rs b/src/platform/windows.rs
index 582451240..a45220eb4 100644
--- a/src/platform/windows.rs
+++ b/src/platform/windows.rs
@@ -527,6 +527,7 @@ const SERVICE_TYPE: ServiceType = ServiceType::OWN_PROCESS;
 
 extern "C" {
     fn get_current_session(rdp: BOOL) -> DWORD;
+    fn is_session_locked(include_rdp: BOOL) -> BOOL;
     fn LaunchProcessWin(
         cmd: *const u16,
         session_id: DWORD,
@@ -1129,6 +1130,10 @@ pub fn is_prelogin() -> bool {
     username.is_empty() || username == "SYSTEM"
 }
 
+pub fn is_locked() -> bool {
+    unsafe { is_session_locked(share_rdp()) == TRUE }
+}
+
 // `is_logon_ui()` is regardless of multiple sessions now.
 // It only check if "LogonUI.exe" exists.
 //
diff --git a/src/server/connection.rs b/src/server/connection.rs
index 10b578042..1259054cd 100644
--- a/src/server/connection.rs
+++ b/src/server/connection.rs
@@ -2232,11 +2232,12 @@ impl Connection {
 
             // https://github.com/rustdesk/rustdesk-server-pro/discussions/646
             // `is_logon` is used to check login with `OPTION_ALLOW_LOGON_SCREEN_PASSWORD` == "Y".
-            // `is_logon_ui()` is used on Windows, because there's no good way to detect `is_locked()`.
-            // Detecting `is_logon_ui()` (if `LogonUI.exe` running) is a workaround.
+            // `is_logon_ui()` is a fallback for logon UI detection on Windows.
             #[cfg(target_os = "windows")]
             let is_logon = || {
-                crate::platform::is_prelogin() || {
+                crate::platform::is_prelogin()
+                    || crate::platform::is_locked()
+                    || {
                     match crate::platform::is_logon_ui() {
                         Ok(result) => result,
                         Err(e) => {