CreateProcessAsUser in Fast User Switching

Discussion:

(too old to reply)

hongyver

2004-01-27 05:48:09 UTC

Hello.
I am attempting to use CreateProcessAsUser from a printer driver
(exactly language monitor)
Because I want that soem application run in second user using Fast
User Switching
AdjustTokenPrivileges is a success. But I'm getting the error(1300) in
GetLastError()
ERROR 1300 - Not all privileges referenced are assigned to the caller.
What's wrong? I'm having a hard time doing this.
Thanks for any..

dwSessionId = WTSGetActiveConsoleSessionId();

if (!OpenThreadToken( GetCurrentThread(),TOKEN_ALL_ACCESS,
TRUE,&hThreadToken))
{
hdbg(TEXT("OpenThreadToken Error %d"),GetLastError());
if (hThreadToken) CloseHandle(hThreadToken);
return FALSE;
}

if (!DuplicateTokenEx( hThreadToken,
TOKEN_ALL_ACCESS,
NULL,
SecurityImpersonation,
TokenPrimary,
&hToken ))
{
hdbg(TEXT("DuplicateTokenEx Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
if (hThreadToken) CloseHandle(hThreadToken);
return FALSE;
}

if (hThreadToken) CloseHandle(hThreadToken);

if (!LookupPrivilegeValue( NULL, SE_TCB_NAME, &tp.Privileges[0].Luid))
{
hdbg(TEXT("LookupPrivilegeValue Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
return FALSE;
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, 0) )
{
hdbg(TEXT("AdjustTokenPrivileges Error %d"),err);
if (hToken) CloseHandle(hToken);
return FALSE;
}

err = GetLastError();
if (err != ERROR_SUCCESS )
{
hdbg(TEXT("AdjustTokenPrivileges Success Error %d"),err);
if (hToken) CloseHandle(hToken);
return FALSE;
}

if (!SetTokenInformation(hToken, TokenSessionId, &dwSessionId,
sizeof(DWORD)))
{
hdbg(TEXT("SetTokenInformation Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
return FALSE;
}

if (!CreateProcessAsUser(hToken,NULL,szCommandLine,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi)
)
{
...

Boris Dynin

2004-01-27 10:14:40 UTC

Permalink

MSDN says:
"Typically, the process that calls the CreateProcessAsUser function must
have the SE_ASSIGNPRIMARYTOKEN_NAME and SE_INCREASE_QUOTA_NAME privileges."
Are you sure that calling process has those privileges?
Btw, you don't have to enable those privileges: call to
'AdjustTokenPrivileges' isn't required. According to MSDN: "If the necessary
privileges are not already enabled, CreateProcessAsUser enables them for the
duration of the call.".

Boris

Post by hongyver
Hello.
I am attempting to use CreateProcessAsUser from a printer driver
(exactly language monitor)
Because I want that soem application run in second user using Fast
User Switching
AdjustTokenPrivileges is a success. But I'm getting the error(1300) in
GetLastError()
ERROR 1300 - Not all privileges referenced are assigned to the caller.
What's wrong? I'm having a hard time doing this.
Thanks for any..
dwSessionId = WTSGetActiveConsoleSessionId();
if (!OpenThreadToken( GetCurrentThread(),TOKEN_ALL_ACCESS,
TRUE,&hThreadToken))
{
hdbg(TEXT("OpenThreadToken Error %d"),GetLastError());
if (hThreadToken) CloseHandle(hThreadToken);
return FALSE;
}
if (!DuplicateTokenEx( hThreadToken,
TOKEN_ALL_ACCESS,
NULL,
SecurityImpersonation,
TokenPrimary,
&hToken ))
{
hdbg(TEXT("DuplicateTokenEx Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
if (hThreadToken) CloseHandle(hThreadToken);
return FALSE;
}
if (hThreadToken) CloseHandle(hThreadToken);
if (!LookupPrivilegeValue( NULL, SE_TCB_NAME, &tp.Privileges[0].Luid))
{
hdbg(TEXT("LookupPrivilegeValue Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, 0) )
{
hdbg(TEXT("AdjustTokenPrivileges Error %d"),err);
if (hToken) CloseHandle(hToken);
return FALSE;
}
err = GetLastError();
if (err != ERROR_SUCCESS )
{
hdbg(TEXT("AdjustTokenPrivileges Success Error %d"),err);
if (hToken) CloseHandle(hToken);
return FALSE;
}
if (!SetTokenInformation(hToken, TokenSessionId, &dwSessionId,
sizeof(DWORD)))
{
hdbg(TEXT("SetTokenInformation Error %d"),GetLastError());
if (hToken) CloseHandle(hToken);
return FALSE;
}
if

(!CreateProcessAsUser(hToken,NULL,szCommandLine,NULL,NULL,FALSE,0,NULL,NULL,
&si,&pi)

Post by hongyver
)
{
...

hongyver

2004-01-28 02:07:53 UTC

Permalink

Thank for your reply.
I understand that call to 'AdjustTokenPrivileges' isn't required.
But I must call 'AdjustTokenPrivileges' function because I have to
change session id.( for second user)

To change session id, Privileges has SE_TCB_NAME.
Therefore, I call 'AdjustTokenPrivileges' and 'SetTokenInformation'.

Thanks in advance.

Hong

Richard Ward

2004-01-28 06:37:34 UTC

Permalink

Assuming that session 1 has user 'A', and session 2 has user 'B',
there is no need to try to reset the session ID in any token unless
you want to start a process running as 'A' in session 2 (the session
belonging to user 'B'). Just follow the simple case:
Impersonate the client
OpenThreadToken()
Revert to self
Duplicate the token to a primary token
CreateProcessAsUser()

It will show up in the right session.

hongyver

2004-01-29 05:09:38 UTC

Permalink

Thanks, Richard.
I succeed in solving a problem.
How simple!
I didn't know impersonantion. :-)
thanks again.

following code is example:

ImpersonateSelf( SecurityIdentification );
if (!OpenThreadToken( GetCurrentThread(),
TOKEN_ALL_ACCESS,
TRUE,
&hThreadToken)) {
if (hToken) CloseHandle(hToken);
RevertToSelf();
return FALSE;
}
RevertToSelf();

if (!DuplicateTokenEx( hThreadToken,
MAXIMUM_ALLOWED,
NULL,
SecurityIdentification, TokenPrimary,
&hToken )){
if (hToken) CloseHandle(hToken);
if (hThreadToken) CloseHandle(hThreadToken);
return FALSE;
}

if (hThreadToken) CloseHandle(hThreadToken);

if (!CreateProcessAsUser(hToken,
NULL,
szCommandLine,
NULL,NULL,
FALSE,
0,
NULL,NULL,
&si,&pi)) {
if (hToken) CloseHandle(hToken);
#ifdef DEBUG
char szMsg[256];
wsprintf( szMsg, "error... CreateProcess()\ncode = %d", GetLastError());
MessageBox( NULL, szMsg, "LanMon", MB_OK );
#endif
return FALSE;
}

Post by Richard Ward
Assuming that session 1 has user 'A', and session 2 has user 'B',
there is no need to try to reset the session ID in any token unless
you want to start a process running as 'A' in session 2 (the session
Impersonate the client
OpenThreadToken()
Revert to self
Duplicate the token to a primary token
CreateProcessAsUser()
It will show up in the right session.