Impersonation and Registry Manipulation in Vista\Win7

Question

I need to create a program that has access to HKLM when running in a non-admin session. I have access to the admin credentials so impersonation seems to be an option.The sequence of Win32 calls is:

1. LogonUser
2. ImpersonateLoggedOnUser
3. RegOpenKeyEx
4. RegCreateKeyEx

The key is successfully created on XP/2003 and fails with 'Access Denied' on Vista/Win7. I am running as the same default domain user and impersonating the same domain admin in each of the scenarios. The 'Access Denied' is being generated by RegCreateKeyEx and obviously the key isn't being created.

Anyone have a clue to why this is happening?

Answer 1

In Vista/Win7 the security has changed. See this article on registry virtualization.

Answer 2

AFAIK to access to HKLM in Vista/Windows7 you must have administrator privilages. Try to compile program with option - require administrator privilage, or just run program as administrator.

Answer 3

If you have the username/password for a admin user, you could start a helper process with CreateProcessWithLogonW() and communicate with it using some kind of IPC (Pipes,shared memory+events etc)

As to why it fails on NT6, maybe your impersonation is not giving you a high IL

Answer 4

An administrator on Windows Vista/7 doesn't have write access to HKLM by default either, they must elevate first. See Vista UAC: The Definitive Guide for details on launching a new process elevated since you cannot elevate an existing process.

Answer 5

The way to accomplish this is through multiple processes as Murray and Anders suggested. First you launch a process to launches another process with the CreateProcessAsLoggedOnUser with Admin credentials. Then you have to launch ANOTHER process using the ShellExecute function with "runas" specified as the verb. This allows for impersonation and elevation without a UAC dialog.