CODEWITHSUNDEEP
windowswinapiimpersonationprivileges
ARF
ARF

Reputation: 7694

Impersonating a user as LocalSystem on Windows

I have a process that runs as LocalSystem on Windows XP and following. I am trying to find a way to have it start another process impersonating another user without having to provide the user password.

In principle this should be possible as LocalSystem has the privilege "Act as part of the operating system". But I am unable to find the correct API.

Can somebody tell me how to do this either:

Upvotes: 2

Views: 2471

Answers (1)

JosephH
JosephH

Reputation: 8825

You can do it by first getting the token of the user via WTSQueryUserToken, then calling CreateProcessAsUser to start the process. Note that you can only do this for a user who is currently logged-in in the system.

Upvotes: 2

Related Questions