OleClipboard and IDataObject under local SYSTEM account

Question

There is an implementation of remote file transfer via dragging virtual files using IStream/IDataObject (based on Raymond Chen's blog topic: What a drag: Dragging a virtual file (IStream edition)).

Basically, it works good. But if the application is run under the SYSTEM account, the IDataObject::GetData() is called only once - requests a FILEDESCRIPTOR, but doesn't return with a requests for FILECONTENTS.

How I use IDataObject:

if (SUCCEEDED(OleInitialize(NULL))) {
    IDataObject* dtob = new MyDataObject(/*some files info here*/);
    if (dtob) {
        OleSetClipboard(dtob);
        dtob->Release();
    }
    
    //simulate Ctrl-V
    ...
    
    MSG msg;
    while (GetMessage(&msg, NULL, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }
    OleUninitialize();
}

See this https://stackoverflow.com/questions/40122964/cross-process-postmessage-uipi-restrictions-and-uiaccess-true and this https://stackoverflow.com/questions/64485600/wm-dropfiles-not-called-on-x64/ that may be related — Simon Mourier, Feb 03 '23 at 12:59
Why is your app running as `SYSTEM` to begin with? It really shouldn't be. — Remy Lebeau, Feb 03 '23 at 18:24
@RemyLebeau, there are some functionality which works only under system, e.g it should work on the lock screen. So, @SimonMourier assumed above that the problem is that higher privileged applications can't receive messages from the lower privileged. But I tried `ChangeWindowMessageFilter` - it doesn't work. — lfk, Feb 04 '23 at 05:50
Here is a similar thread, I suggest you could refer to:https://learn.microsoft.com/en-us/answers/questions/1168537/oleclipboard-and-idataobject-under-local-system-ac It is the result of some kind of windows security mechanism. — Jeaninez - MSFT, Feb 10 '23 at 08:11

score 0 · Accepted Answer · answered Feb 15 '23 at 14:21

The solution is to set security for the process using CoInitializeSecurity:

HRESULT res = CoInitialize(NULL);
if (SUCCEEDED(res))
    CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_NONE,
        RPC_C_IMP_LEVEL_IDENTIFY, NULL, NULL, NULL);

// your code here....

if (SUCCEEDED(res))
    CoUninitialize();

OleClipboard and IDataObject under local SYSTEM account

1 Answers1