open process as different user

Question

hi all

I want to get the privileges of a selected user on a local machine. I know how to get them from the current user, so my problem is how to open a process as as a different user.

I'm currently looking for more info about CreateProcessAsUser()

thanks

Answer 1

You shouldnt create a process as a different user just to get his priviledges. To get an user priviledges you need an iudentity token. To start a process as an user you need an impersonate token. Idenity tokens are very low security risk, impersonation tokens on the other hand are very serious business. At the very least, you need to know the password of the user in order to impersonate (or have an impesonation capable context, like an SSPI exchange security context).

Use LookupAccountName to get the SID, LsaOpenPolicy and LsaEnumerateAccountRights.

Answer 2

Check this link for how to do this from a service within Delphi: Launch your application in Vista under the local system account without the UAC popup

To launch a process under the local system account I perform the following steps (from a service application):

1. Get the Active Console SessionId using WTSGetActiveConsoleSessionId
2. Since I need to launch the application under a system account, I use the token from Winlogon, since Winlogon runs under the system account. So I obtain the process ID of Winlogon and Duplicate the token.
3. Then I make sure I sent the startupinfo parameter lpDesktop to winsta0\Default since I need to launch my process there.
4. Then I use CreateProcessAsUser with Winlogon's duplicate token to launch my process into session 1.
5. That's all. I am done.