Server 2008 Cannot Set User Rights

Question

I attempted to do some Win32 stuff in C# 3.5 to get elevated User Rights for a console app. I develop on Visual Studio 2008 SP1/GDR and things work fine when run under the debugger. Things also work fine when I run the console app stand-alone. Things also run fine when I package everything into an MSI and install it on a 2003 server and run the console app.

If I take the same MSI and install it on a 2008 server with UAC enabled, then run the console app, I get messages like this:

Unable to set right for the account "DOMAIN\QAUSER": SeCreateGlobalPrivilege
System.UnauthorizedAccessException    Attempted to perform an unauthorized operation.

I cannot expect my deployment/server admins to do anything with my app other than install it, and they are not going to turn off UAC. There must be some programmatic way to properly set user rights that I can add to the console app - anyone know how?

Thanks.

Answer 1

I assume that UAC is enabled on the 2008 machine and I cannot comment yet on your question to find out.

If so, ensure that in your app.manifest file in VS (under properties), change

<requestedExecutionLevel  level="asInvoker" uiAccess="false" />

to

<requestedExecutionLevel  level="requireAdministrator" uiAccess="false" />

Even if the code is running as an administrator, you have to get by the UAC warning.

Answer 2

Probably you use "Global\" prefix to the object name in your application and your application will be started inside a Remote Desktop Session Host (RD Session Host) server session. In the case your program have to enable SE_CREATE_GLOBAL_NAME (SeCreateGlobalPrivilege) privilege. See C# – How to enable SeDebugPrivilege? (but use SE_CREATE_GLOBAL_NAME instead of SE_DEBUG_NAME) or Manipulate Privileges in Managed Code Reliably, Securely, and Efficiently as an example.