Is it possible to lower the privilege level when calling CoCreateInstance on Vista?

Question

Okay, I have a plugin for IE that when installed needs to (with the user's permission) restart IE.

To do this I have a DLL that is invoked by the installer. And it works, but the problem is that when IE is restarted on Vista, it is restarted with the administrator privileges of the installer, which is a problem for a number of reasons.

I'm using CoCreateInstance to start IE, so that I get an instance of the IWebBrowser2 interface in order to perform some actions on it.

So my question is, is it possible to call CoCreateInstance from an application that is running with Administrator privileges, in such a way that the resulting COM object instance inherits the base user privileges rather than the administrator privileges of the calling application?

Answer 1

Okay, I found the solution from here:

http://social.msdn.microsoft.com/Forums/cs-CZ/ieextensiondevelopment/thread/78a2bc18-1920-4e58-af7e-48dbcebe7643

From my installer DLL I need to launch a new thread, and impersonate the current user on that thread, and then set a low integrity level, and create the COM instance with the CLSCTX_ENABLE_CLOAKING context.