# Server login accounts (IRPCLoginsAdmin)

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/

Manages the server's login accounts: list, add, modify and remove logins, force logouts, look up
Windows accounts and groups, and handle password resets.

Use this interface to add, modify and delete logins.

- **gRPC service:** `MFiles.IRPCLoginsAdmin`
- **Book and level:** [Administration API](https://developer.m-files.com/APIs/gRPC-API/admin/index.md), specialized
- **Methods:** 19
- **Proto file:** [`mfiles/IRPCLoginsAdmin.proto`](https://developer.m-files.com/APIs/gRPC-API/downloads/proto/mfiles/IRPCLoginsAdmin.proto)

<a id="overview"></a>

## Overview

A login account is the server-level identity (M-Files or Windows authentication, server roles,
license type) that user accounts in vaults are linked to. This is the service behind the
"Login Accounts" node of M-Files Admin. Applications rarely need it; provisioning and audit
scripts can use it.

**Sessions and rights.** A server-level session is enough (log in with `login_data.vault_guid` =
`{00000000-0000-0000-0000-000000000000}`); a vault session works too. Most methods require the
**system administrator** server role (server right `manage_logins` in
[ServerAccess](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.ServerAccess/index.md)); a vault administrator does not have it, and the call
fails with "Access denied. You do not have the server-level access rights required by this
operation." (0x800400A8, 0x800407E4). Exceptions:

- [GetLogins](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogins/index.md) and
  [GetLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogin/index.md) also serve callers without server rights,
  with a narrower result (see their remarks). This is why a vault administrator can list logins.
- [CreatePasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequest/index.md) and
  [ResetPassword](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/index.md) need no session at all: they are
  the "forgot password" flow of M-Files Web.

Methods by task:

- **Read logins**: [GetLogins](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogins/index.md),
  [GetLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogin/index.md),
  [GetLoginsWithSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLoginsWithSessions/index.md).
- **Change logins**: [AddLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/AddLogin/index.md),
  [ModifyLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ModifyLogin/index.md),
  [RemoveLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/RemoveLogin/index.md),
  [ForceLogout](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ForceLogout/index.md).
- **Passwords**: [GetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetPasswordHash/index.md),
  [SetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/SetPasswordHash/index.md) (copy a password between
  servers),
  [CreatePasswordResetRequestAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequestAdmin/index.md),
  [CreatePasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequest/index.md),
  [ResetPassword](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/index.md).
- **Windows and Active Directory lookups** (for picking Windows accounts and groups):
  [GetDomainName](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetDomainName/index.md),
  [GetComputerName](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetComputerName/index.md),
  [GetAllDomains](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetAllDomains/index.md),
  [GetOrganizationalUnitsForDomain](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetOrganizationalUnitsForDomain/index.md),
  [GetWindowsGroups](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetWindowsGroups/index.md),
  [GetWindowsGroupMembers](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetWindowsGroupMembers/index.md),
  [GetFullNameAndEmail](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetFullNameAndEmail/index.md).

A login is identified by its account name: the user name for M-Files logins, the down-level logon
name (domain and user name separated by a backslash) for Windows logins. Server roles and the enabled state are in [SRVROLES](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.SRVROLES/index.md):
a login without `can_log_in` is disabled.

<a id="methods"></a>

## Methods

| Method | Summary | Facts |
|---|---|---|
| [AddLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/AddLogin/index.md) | Adds a login account to the server. | `admin` `session` |
| [CreatePasswordResetRequest](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequest/index.md) | Starts the "forgot password" flow for an M-Files login: sends the user an e-mail with a password reset link. | `admin` `no session` |
| [CreatePasswordResetRequestAdmin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/CreatePasswordResetRequestAdmin/index.md) | Creates a password reset link for an M-Files login, returns it, and optionally e-mails it to the user. | `admin` `session` |
| [ForceLogout](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ForceLogout/index.md) | Ends all sessions of the given login accounts in every vault on the server. | `admin` `session` |
| [GetAllDomains](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetAllDomains/index.md) | Lists the Windows domains that the server computer can reach, including its own. | `admin` `session` `idempotent` |
| [GetComputerName](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetComputerName/index.md) | Gets the name of the server computer. | `admin` `session` |
| [GetDomainName](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetDomainName/index.md) | Gets the Windows domain of the server computer, or the computer name if it is not in a domain. | `admin` `session` `idempotent` |
| [GetFullNameAndEmail](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetFullNameAndEmail/index.md) | Looks up the full name and e-mail address of a Windows account in its directory. | `admin` `session` `idempotent` |
| [GetLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogin/index.md) | Gets one login account by account name. | `admin` `session` |
| [GetLogins](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLogins/index.md) | Gets the login accounts the caller is allowed to see: all of them for system administrators, otherwise those linked to vaults the caller administers. | `admin` `session` `idempotent` |
| [GetLoginsWithSessions](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetLoginsWithSessions/index.md) | Gets the login accounts that currently have open sessions on the server. | `admin` `session` `idempotent` |
| [GetOrganizationalUnitsForDomain](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetOrganizationalUnitsForDomain/index.md) | Lists the organizational units of a Windows domain. | `admin` `session` `idempotent` |
| [GetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetPasswordHash/index.md) | Gets the encrypted password hash of an M-Files login, for copying the password to another server with [SetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/SetPasswordHash/index.md). | `admin` `session` `idempotent` |
| [GetWindowsGroupMembers](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetWindowsGroupMembers/index.md) | Lists the users and groups that are members of a Windows group. | `admin` `session` `idempotent` |
| [GetWindowsGroups](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetWindowsGroups/index.md) | Lists Windows groups that the server can see: local groups and domain groups. | `admin` `session` `idempotent` |
| [ModifyLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ModifyLogin/index.md) | Changes a login account: its server roles and enabled state, and optionally its password, full name, e-mail address and license type. | `admin` `session` `idempotent` |
| [RemoveLogin](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/RemoveLogin/index.md) | Removes a login account from the server. | `admin` `session` |
| [ResetPassword](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/ResetPassword/index.md) | Completes the "forgot password" flow: sets a new password for a login with the values from the password reset link. | `admin` `no session` |
| [SetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/SetPasswordHash/index.md) | Sets the password of an M-Files login from a password hash, for example one read with [GetPasswordHash](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLoginsAdmin/GetPasswordHash/index.md) on another server. | `admin` `session` `idempotent` |