c++windowsadmincreateprocessasuser

How can an admin process open an application in the logged in user?

Overview

The Process

exe/dll compiled in C++ to be run

Scenario

  1. Log in (win 7) to a standard user account (no admin)
  2. run The Process as admin
  3. The Process opens some app (exe) using ShellExecute

Problem

The app is opened in the scope of the admin user

Expecting

The app is opened in the scope of the standard user

Solutions

1. CreateProcessAsUser

Use CreateProcessAsUser (Assuming I managed to get hToken right that should have solved the issue).

However, I get the call failed with error code 1314 - ERROR_PRIVILEGE_NOT_HELD. Going back to the documentation tells me:

If this function fails with ERROR_PRIVILEGE_NOT_HELD (1314), use the CreateProcessWithLogonW function instead

So I digged in and found this CreateProcessAsUser Error 1314 which wasn't very helpful.

2. ImpersonateLoggedOnUser

using ImpersonateLoggedOnUser generated the same error code: 1314 - ERROR_PRIVILEGE_NOT_HELD.

3. CreateProcessWithLogonW

CreateProcessWithLogonW requires lpPassword which naturally I don't have

The Question

How can an admin process open an application in the logged in user?

Solution

  • Have you tried using CreateProcessWithTokenW which is mentioned in the CreateProcessWithLogonW documentation? It seems to require a much weaker privilege than CreateProcessAsUser, one you should posses (SE_IMPERSONATE_NAME rather than SE_ASSIGNPRIMARYTOKEN_NAME).

    You said you already have a token for the interactive user so I won't go into it.

    (Note: Strange bugs have been reported with all of this, including CreateProcessWithTokenW. Don't give up on the first attempt. A bug and a fix for example: why is CreateProcessWithTokenW failing with ERROR_ACCESS_DENIED )

    hToken is not a "right". It's a token. What the error says is that you lack a privilege.

    Holding a privilege is not a fundamental right! Some privileges are given to certain users by default. Others need to be given through the Local Security Policy (in the "User Right Assignment" node in the MMC snap-in or with LsaAddAccountRights - all of which is documented in the page Assigning Privileges to an Account).

    Besides that you sometimes have to enable privileges using AdjustTokenPrivileges. This is documented in the sibling page Changing Privileges in a Token.

    Some APIs enable them if you hold them. Others don't and require you to do so yourself. The obvious way to go is to enable a privilege before calling and API that's documented to require it.

    The MS Forum link may not have been but the error message is quite clear. MSDN says about the function:

    Typically, the process that calls the CreateProcessAsUser function must have the SE_INCREASE_QUOTA_NAME privilege and may require the SE_ASSIGNPRIMARYTOKEN_NAME privilege if the token is not assignable.

    and the error is (from the page you linked to!):

    ERROR_PRIVILEGE_NOT_HELD
      1314 (0x522)
      A required privilege is not held by the client.