Elevated process needs to start Threads with differ username that will be used for file creation, etc.

Question

I have an application running elevated, that I would like to start "worker" threads with a different username's credentials that will allow files created ( read/written/new/old ) to be authenticated with that user's credentials. I know on the CreateThread call that SecurityAttributes can be passed. However, files are still being created with the processes authorities.

Please provider some basic pointers to where to look for help with this ...

Thanks

Answer 1

The default security descriptor for a file system object (e.g., folder/file) is inherited from its parent folder. If the elevated process is creating the new files in a location where the other user already has the desired access permissions then the security descriptors for the newly created files will permit access to the other user. In this case the only difference between the security descriptor created by the thread in the elevated process (running as Administrator) and a thread that is impersonating the other user will be the Owner of the files. For example, an elevated process created two files in the Documents folder of User Bozo.

If you intend for the elevated process to create files in a location to which the other user ordinarily would not have access then you must construct a security descriptor that permits the desired access and pass it to CreateFile using a SECURITY_ATTRIBUTES structure. Alternatively, you can allow the system to create a default security descriptor when the file is created and then modify it afterwards to grant the desired access permissions to the other user.