Network logon from an impersonation token

Question

In a service impersonating a client (using ImpersonateNamedPipeClient), I try to call CreateProcessAsUser. The executable filename is a UNC path located on a third computer (neither the server, nor the client connected to the pipe).

The call fail with the error code 5 (ACCES DENIED). I tried to use WNetAddConnection2 to authenticate the client from the client (in the context of the token which will be impersonated) before the server calls ImpersonateNamedPipeClient but I still get the same error.

How may I authenticate the account impersonated (given the fact that the server only got the impersonation token) in order to gain access to the executable ?

Answer 1

My Win32 is rather rusty so this may be a shot in the dark, but have you tried using the CreateProcessAsUser function instead of CreateProcess? According to the MSDN Documentation it will operate on a restricted token. If I recall correctly, an impersonation token should suffice.

Hope that helps.

Answer 2

CreateProcessAsUser() needs a primary token, not an impersonated token. You can use DuplicateTokenEx() to get a primary token from an impersonated token. The documentation for CreateProcessAsUser() even says as much.