CreateProcessAsUser from c++ service creates process but no console

Question

I am developing C++ service which uses CreateProcessAsUser function. I have tested this on Windows 7 and it was working excellent. But i am testing now my code for windows 10 and it doesnt want to work but process is created and visible in task manager, just no windows/console created. I am trying now code snippet with cmd only without any parameters I will really appreciate any kind of help

I can see this with task manager, so my process is created. task manager

    PROCESS_INFORMATION pi;
   STARTUPINFO si;
   BOOL bResult = FALSE;
   DWORD dwSessionId;
   HANDLE hUserToken;
    // Log the client on to the local computer.
   dwSessionId = WTSGetActiveConsoleSessionId();    
   WTSQueryUserToken(dwSessionId,&hUserToken);
   ZeroMemory(&si, sizeof(STARTUPINFO));
   si.cb= sizeof(STARTUPINFO);
   si.lpDesktop = L"winsta0\\default";
   ZeroMemory(&pi, sizeof(pi));    
   LPVOID pEnv =NULL;    
   if(CreateEnvironmentBlock(&pEnv,hUserToken,TRUE)){
   }
   else
      pEnv=NULL;    
   bResult = CreateProcessAsUser(
      hUserToken,                     // client's access token
      L"C:\\Windows\\System32\\cmd.exe",    // file to execute
      L"",                 // command line
      NULL,            // pointer to process SECURITY_ATTRIBUTES
      NULL,               // pointer to thread SECURITY_ATTRIBUTES
      FALSE,              // handles are not inheritable
      CREATE_UNICODE_ENVIRONMENT|HIGH_PRIORITY_CLASS,     // creation flags
      pEnv,               // pointer to new environment block
      NULL,               // name of current directory
      &si,               // pointer to STARTUPINFO structure
      &pi                // receives information about new process
   );    
   //Perform All the Close Handles tasks  
   DestroyEnvironmentBlock(pEnv);
   CloseHandle(pi.hThread);
   CloseHandle(pi.hProcess);
   CloseHandle(hUserToken);

Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackoverflow.com/rooms/139037/discussion-on-question-by-szymon-mackowiak-createprocessasuser-from-c-service). — Bhargav Rao, Mar 25 '17 at 17:20

score 3 · Accepted Answer · answered Mar 23 '17 at 15:33

3

#define LAA(se) {{se},SE_PRIVILEGE_ENABLED|SE_PRIVILEGE_ENABLED_BY_DEFAULT}

#define BEGIN_PRIVILEGES(tp, n) static const struct {ULONG PrivilegeCount;LUID_AND_ATTRIBUTES Privileges[n];} tp = {n,{
#define END_PRIVILEGES }};

ULONG adjustPrivileges()
{
    HANDLE hToken;

    ULONG err;
    if (OpenProcessToken(NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
    {
        BEGIN_PRIVILEGES(tp, 2)
            LAA(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE),
            LAA(SE_INCREASE_QUOTA_PRIVILEGE),
        END_PRIVILEGES  

        AdjustTokenPrivileges(hToken, FALSE, (::PTOKEN_PRIVILEGES)&tp, 0, 0, 0);

        err = GetLastError();

        CloseHandle(hToken);
    }
    else
    {
        err = GetLastError();
    }

    return err;
}

ULONG cup()
{
    HANDLE hUserToken;

    DWORD dwSessionId = WTSGetActiveConsoleSessionId();

    if (dwSessionId == MAXDWORD)
    {
        return ERROR_GEN_FAILURE;
    }

    ULONG err = adjustPrivileges();

    if (err)
    {
        return err;
    }

    if (WTSQueryUserToken(dwSessionId,&hUserToken))
    {
        PVOID pEnv;

        if (CreateEnvironmentBlock(&pEnv,hUserToken,TRUE))
        {
            PROCESS_INFORMATION pi;
            STARTUPINFO si = { sizeof(STARTUPINFO) };
            si.lpDesktop = L"winsta0\\default";

            if (CreateProcessAsUser(
                hUserToken,                     // client's access token
                L"C:\\Windows\\System32\\cmd.exe",    // file to execute
                NULL,                 // command line
                NULL,            // pointer to process SECURITY_ATTRIBUTES
                NULL,               // pointer to thread SECURITY_ATTRIBUTES
                FALSE,              // handles are not inheritable
                CREATE_UNICODE_ENVIRONMENT|HIGH_PRIORITY_CLASS,  // creation flags
                pEnv,               // pointer to new environment block
                NULL,               // name of current directory
                &si,               // pointer to STARTUPINFO structure
                &pi                // receives information about new process
                ))
            {
                CloseHandle(pi.hThread);
                CloseHandle(pi.hProcess);
            }
            else
            {
                err = GetLastError();
            }

            DestroyEnvironmentBlock(pEnv);

        }
        else
        {
            err = GetLastError();
        }
        CloseHandle(hUserToken);
    }
    else
    {
        err = GetLastError();
    }
    return err;
}

answered Mar 23 '17 at 15:33

RbMm

31,280
3
35
56

1

NtCurrentProcess() ? – Szymon Mackowiak Mar 23 '17 at 15:35
yes, this is macro `#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )` – RbMm Mar 23 '17 at 15:36
SE_ASSIGNPRIMARYTOKEN_PRIVILEGE and SE_INCREASE_QUOTA_PRIVILEGE undeclarated, trying found in msdn but i found only this: https://msdn.microsoft.com/en-us/library/windows/desktop/bb530716(v=vs.85).aspx ==>TEXT("SeAssignPrimaryTokenPrivilege") got it but still doesnt work – Szymon Mackowiak Mar 23 '17 at 15:45
SE_ASSIGNPRIMARYTOKEN_PRIVILEGE undeclarated still ;/ – Szymon Mackowiak Mar 23 '17 at 15:51
I have used LUID objects between BEGIN and END PIRVILIGES but still doesnt work... – Szymon Mackowiak Mar 23 '17 at 16:16
@SzymonMackowiak `SE_ASSIGNPRIMARYTOKEN_PRIVILEGE` this is well known constants declared in wdm.h – RbMm Mar 23 '17 at 16:52
`#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)` `#define SE_INCREASE_QUOTA_PRIVILEGE (5L)` – RbMm Mar 23 '17 at 16:53
adjustPriviliges return 1300 error: 1300 (0x514) Not all privileges or groups referenced are assigned to the caller. ;/;/ – Szymon Mackowiak Mar 23 '17 at 17:48
above not important, WTSQueryUserToken(dwSessionId,&hUserToken) returns false – Szymon Mackowiak Mar 23 '17 at 17:51
under which account you run in service ? localsystem have both this – RbMm Mar 23 '17 at 17:51
@SzymonMackowiak are you in service ? – RbMm Mar 23 '17 at 17:52
WTSQueryUserToken(dwSessionId,&hUserToken) returns false , i have only one account on W10 – Szymon Mackowiak Mar 23 '17 at 17:52
@SzymonMackowiak - you not understand - are you run as *LocalSystem* ? – RbMm Mar 23 '17 at 17:53
WORKS!!, btw. what is LocaLSystem it is SYSTEM not user in task manager? – Szymon Mackowiak Mar 23 '17 at 18:00
COULD YOU PLEASE PROPOSE ME GOOD WIN32 BOOK, PLEASE DONT SAY MSDN IS BEST BOO K:d ? – Szymon Mackowiak Mar 23 '17 at 18:01
please any book will be great for me, btw. const_cast(parameters.c_str()) is good idea for command line parameter.... ;/ ? – Szymon Mackowiak Mar 23 '17 at 18:05
YOU ARE BEST MAN, THAN YOU I REALLY APPRECIATE YOUR HELP ! – Szymon Mackowiak Mar 23 '17 at 18:05

CreateProcessAsUser from c++ service creates process but no console

1 Answers1

Linked