ImpersonateLoggedOnUser is successful but secondary process is still run in the initial context

Question

I have an installer that tries to (re)start my application in the current user context after the installation is done. The installer runs in the SYSTEM context and before launching the application it attempts (and theoretically succeeds) to impersonate the current user. However, when I look in the task manager, I see that my application is running in the SYSTEM context.

This is (a snippet from) my code:

    TCHAR szUsername[128] = _T("");
    DWORD dwUsernameSize = 128;
    GetUserName(szUsername, &dwUsernameSize);

    // Lets the calling process impersonate the security context of a logged-on user.
    if (!ImpersonateLoggedOnUser(hToken))
    {
        throw Win32Exception(GetLastError(), _T("Failed to impersonate current user"));
    }

    TCHAR szUsername2[128] = _T("");
    DWORD dwUsernameSize2 = 128;
    GetUserName(szUsername2, &dwUsernameSize2);

    MLOGD(_T("ProcessUtils::StartProcessInCurrentUserContext: Successfully impersonated %s"), szUsername2);

    ProcessUtils::StartProcess(sExeName, lstParams, sWorkingDir, bWaitToFinish, errCode);

ProcessUtils::StartProcess is a wrapper around CreateProcess.

szUsername contains SYSTEM and szUsername2 contains the current user. So ImpersonateLoggedOnUser is successful. However, as mentioned above, the process is started in the SYSTEM context, not the current user one.

I'm not sure how helpful this might be, but my installer is written in NSIS and it's calling the function that contains the code from above via a plugin written in C/C++.

Does anyone know why my application doesn't start in the current user context?

Answer 1

If you had read the documentation for CreateProcess, you would have found the answer to your question in the first three sentences:

Creates a new process and its primary thread. The new process runs in the security context of the calling process.

If the calling process is impersonating another user, the new process uses the token for the calling process, not the impersonation token.

There really isn't much else to say; the behaviour you describe is as documented. If you want to create a process as another user, you must use CreateProcessAsUser or one of the related functions.

Answer 2

I had a very similar problem a couple of years ago when I was also working on an installer application. After A LOT of frustration, caused by failed attempts to start an application in the context of the current user using CreateProcessAsUser, I've finally given up. After a thorough search on the web, I've found a briliant implementation that uses IShellDispatch2 interface. Here is an example:

#include <Windows.h>
#include <exdisp.h>
#include <Shobjidl.h>
#include <Shlwapi.h>
#include <comutil.h>
#include <SHLGUID.h>
#include <cstdlib>
#include <iostream>

#pragma comment(lib, "Shlwapi.lib")
#pragma comment(lib, "comsuppw.lib")

bool ShellExecuteAsCurrentUser(const TCHAR *pcOperation, const TCHAR *pcFileName, const TCHAR *pcParameters,
    const TCHAR *pcsDirectory, const DWORD dwShow)
{
    bool bSuccess = false;

    IShellWindows *psw = NULL;
    HRESULT hr = CoCreateInstance(CLSID_ShellWindows, NULL, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&psw));

    if(SUCCEEDED(hr))
    {
        HWND hwnd = 0;
        IDispatch* pdisp = NULL;
        _variant_t vEmpty;
        if(S_OK == psw->FindWindowSW(&vEmpty, &vEmpty, SWC_DESKTOP, reinterpret_cast<long*>(&hwnd), SWFO_NEEDDISPATCH, &pdisp))
        {
            if((hwnd != NULL) && (hwnd != INVALID_HANDLE_VALUE))
            {
                IShellBrowser *psb;
                hr = IUnknown_QueryService(pdisp, SID_STopLevelBrowser, IID_PPV_ARGS(&psb));
                if(SUCCEEDED(hr))
                {
                    IShellView *psv = NULL;
                    hr = psb->QueryActiveShellView(&psv);
                    if(SUCCEEDED(hr))
                    {
                        IDispatch *pdispBackground = NULL;
                        HRESULT hr = psv->GetItemObject(SVGIO_BACKGROUND, IID_PPV_ARGS(&pdispBackground));
                        if(SUCCEEDED(hr))
                        {
                            IShellFolderViewDual *psfvd = NULL;
                            hr = pdispBackground->QueryInterface(IID_PPV_ARGS(&psfvd));
                            if(SUCCEEDED(hr))
                            {
                                IDispatch *pdisp = NULL;
                                hr = psfvd->get_Application(&pdisp);
                                if(SUCCEEDED(hr))
                                {
                                    IShellDispatch2 *psd;
                                    hr = pdisp->QueryInterface(IID_PPV_ARGS(&psd));
                                    if(SUCCEEDED(hr))
                                    {
                                        _variant_t verb(pcOperation);
                                        _variant_t file(pcFileName);
                                        _variant_t para(pcParameters);
                                        _variant_t dir(pcsDirectory);
                                        _variant_t show(dwShow);
                                        if(SUCCEEDED(psd->ShellExecute(file.bstrVal, para, vEmpty, verb, show)))
                                            bSuccess = true;

                                        psd->Release();
                                        psd = NULL;
                                    }
                                    pdisp->Release();
                                    pdisp = NULL;
                                }
                            }
                            pdispBackground->Release();
                            pdispBackground = NULL;
                        }
                        psv->Release();
                        psv = NULL;
                    }
                    psb->Release();
                    psb = NULL;
                }
            }
            pdisp->Release();
            pdisp = NULL;
        }
        psw->Release();
        psw = NULL;
    }

    return bSuccess;
}

int main(int argc, char *argv[])
{
    CoInitialize(NULL);

    if(ShellExecuteAsCurrentUser(L"open", L"notepad", nullptr, nullptr, SW_SHOWNORMAL))
        std::cout << "SUCCESS" << std::endl;

    CoUninitialize();

    return 0;
}

This is just a quick demo, the implementation of ShellExecuteAsCurrentUser can be improved by using smart pointers for COM interfaces and some refactoring. This method worked for me on versions WinXP SP3 - Win 8.1, not sure if it works on Windows 10. For more details, check the authors github page:

https://github.com/lordmulder/stdutils/tree/master/Contrib/StdUtils

Answer 3

Win32 CreateProcess creates a process in the same security context as the caller which is SYSTEM (even though you are impersonating).

Think you need to be calling CreateProcessAsUser.