微软例子：NetUserEnum函数提供有关服务器上所有用户帐户的信息。

NetUserEnum函数提供有关服务器上所有用户帐户的信息。
The NetUserEnum function provides information about all user accounts on a server.
要快速枚举用户，计算机或全局组帐户信息，请调用NetQueryDisplayInformation函数。

To quickly enumerate user, computer, or global group account information, call the NetQueryDisplayInformation function.

The following code sample demonstrates how to retrieve information about the user accounts on a server with a call to the NetUserEnum function. The sample calls NetUserEnum, specifying information level 0 (USER_INFO_0) to enumerate only global user accounts. If the call succeeds, the code loops through the entries and prints the name of each user account. Finally, the code sample frees the memory allocated for the information buffer and prints a total of the users enumerated.
以下代码示例演示如何在调用NetUserEnum函数的服务器上检索有关用户帐户的信息。示例调用NetUserEnum，指定信息级别0（USER_INFO_0）仅枚举全局用户帐户。如果呼叫成功，则代码循环遍历条目并打印每个用户帐户的名称。最后，代码示例释放了为信息缓冲区分配的内存，并打印了枚举的用户总数。

#ifndef UNICODE
#define UNICODE
#endif

#include 
#include 
#include  
#include 
#pragma comment(lib, "Netapi32.lib")

int wmain(int argc, wchar_t *argv[])
{
	LPUSER_INFO_0 pBuf = NULL;
	LPUSER_INFO_0 pTmpBuf;
	DWORD dwLevel = 0;
	DWORD dwPrefMaxLen = MAX_PREFERRED_LENGTH;
	DWORD dwEntriesRead = 0;
	DWORD dwTotalEntries = 0;
	DWORD dwResumeHandle = 0;
	DWORD i;
	DWORD dwTotalCount = 0;
	NET_API_STATUS nStatus;
	LPTSTR pszServerName = NULL;

	if (argc > 2)
	{
		fwprintf(stderr, L"Usage: %s [\\\\ServerName]\n", argv[0]);
		exit(1);
	}
	// The server is not the default local computer.
	if (argc == 2)
		pszServerName = argv[1];
	wprintf(L"\nUser account on %s: \n", pszServerName);
	// Call the NetUserEnum function, specifying level 0; 
	//   enumerate global user account types only.
	do // begin do
	{
		nStatus = NetUserEnum(pszServerName,
			dwLevel,
			FILTER_NORMAL_ACCOUNT, // global users
			(LPBYTE*)&pBuf,
			dwPrefMaxLen,
			&dwEntriesRead,
			&dwTotalEntries,
			&dwResumeHandle);
		// If the call succeeds,
		if ((nStatus == NERR_Success) || (nStatus == ERROR_MORE_DATA))
		{
			if ((pTmpBuf = pBuf) != NULL)
			{
				// Loop through the entries.
				for (i = 0; (i < dwEntriesRead); i++)
				{
					assert(pTmpBuf != NULL);
					if (pTmpBuf == NULL)
					{
						fprintf(stderr, "An access violation has occurred\n");
						break;
					}
					//  Print the name of the user account.
					wprintf(L"\t-- %s\n", pTmpBuf->usri0_name);
					pTmpBuf++;
					dwTotalCount++;
				}
			}
		}
		// Otherwise, print the system error.
		else
			fprintf(stderr, "A system error has occurred: %d\n", nStatus);
		// Free the allocated buffer.
		if (pBuf != NULL)
		{
			NetApiBufferFree(pBuf);
			pBuf = NULL;
		}
	}
	// Continue to call NetUserEnum while there are more entries.
	while (nStatus == ERROR_MORE_DATA); // end do
	// Check again for allocated memory.
	if (pBuf != NULL)
		NetApiBufferFree(pBuf);
	// Print the final count of users enumerated.
	fprintf(stderr, "\nTotal of %d entries enumerated\n", dwTotalCount);
	return 0;
}

仔细研读代码定有收获。