我正在尝试使用以下代码从我的服务应用程序运行用户模式进程(作为local system
.)
用户态进程的要求是运行without海拔,但要有UIAccess="true"
在其清单中能够display top-mostWindows 8 下正确运行 Windows http://blogs.microsoft.co.il/pavely/2012/05/16/windows-8-topmost-vs-topmost/.
所以我这样做(从我的服务)来运行我的用户模式进程:
//NOTE: Error checking is omitted for readability
//'dwSessionID' = user session ID to run user-mode process in
//'pUserProcPath' = L"C:\\Program Files (x86)\\Company\\Software\\user_process.exe"
HANDLE hToken = NULL;
WTSQueryUserToken(dwSessionID, &hToken);
HANDLE hToken2;
DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hToken2);
LPVOID pEnvBlock = NULL;
CreateEnvironmentBlock(&pEnvBlock, hToken2, FALSE);
STARTUPINFO si;
ZeroMemory(&si, sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);
si.lpDesktop = L"winsta0\\default";
PROCESS_INFORMATION pi;
ZeroMemory(&pi, sizeof(pi));
//ImpersonateLoggedOnUser(hToken2); //Not necessary as suggested below
PVOID OldRedir;
Wow64DisableWow64FsRedirection(&OldRedir);
BOOL bSuccess = CreateProcessAsUser(
hToken2, // client's access token
pUserProcPath, // file to execute
NULL, // command line
NULL, // pointer to process SECURITY_ATTRIBUTES
NULL, // pointer to thread SECURITY_ATTRIBUTES
FALSE, // handles are not inheritable
NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT, // creation flags
pEnvBlock, // pointer to new environment block
NULL, // name of current directory
&si, // pointer to STARTUPINFO structure
&pi // receives information about new process
);
int nOSError = ::GetLastError();
Wow64RevertWow64FsRedirection(OldRedir);
//RevertToSelf(); //Not necessary as suggested below
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
DestroyEnvironmentBlock(pEnvBlock);
CloseHandle(hToken2);
CloseHandle(hToken);
这运行良好,如果UIAccess="false"
在清单中user_process.exe
.
但如果我执行以下操作:
- Enable
UIAccess="true"
为了user_process.exe
:
我得到的是CreateProcessAsUser
因错误而失败ERROR_ELEVATION_REQUIRED
.
有人可以建议如何让它发挥作用吗?
附言。我尝试调整我的服务的权限以启用SE_DEBUG_NAME
and SE_TCB_NAME
,但都没有帮助。
PS2。如果我只是双击我的user_process.exe
编译过程UIAccess="true"
,代码签名,并放置在C:\Program Files (x86)\Company\Software
文件夹,它启动并运行得很好(没有提升。)。