How to launch an application with admin rights in user mode from a service which runs in system context

DieWithYourBootsON 21

My service is running in SYSTEM context.
I want to launch an application(test.exe) using CreateProcessAsUser () API from service.

The application(test.exe) must run in user context.
The application(test.exe) must have admin rights.

Experiments performed:
Set the application requestedExecutionLevel to requireAdministrator privilege.
Use the SCNotification(user context application which has admin privilege) tokens to launch the application(test.exe). OpenProcess() API, OpenProcessToken() API and DuplicateTokenEx() API is used to get the token which is passed to CreateProcessAsUser() API.

Result: the application(test.exe) is not launching in admin mode.

RLWA32 45,326 Reputation points

2022-09-13T22:28:16.713+00:00

Perhaps the process (SCNotification) from which you obtain the token is not actually running with elevated privileges. You can confirm if the process is elevated using the details pane of Task Manager.
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2022-09-14T01:59:19.723+00:00

Or using the example which shows checking a token for membership in the Administrators local group.
DieWithYourBootsON 21 Reputation points

2022-09-15T20:18:08.847+00:00

I had check the privileges of the SCNotifications. It has required privileges.

Group or User name Permissions
SYSTEM All Privilege
Administrator All Privilege
Interactive Read, Read & Execute
RLWA32 45,326 Reputation points

2022-09-15T21:12:33.82+00:00

I asked you to see if the SCNotification process was elevated by using the Task Manager details pane. That isn't what you did. The Task Manager information that I asked you to check looks like this -

If a process has a "Yes" in the indicated column then it is running with elevated privileges

So what does Task Manager show for the SCNotification process?
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2022-09-16T01:27:34.597+00:00

Does the user that the application is to run as have administrator privilege?
DieWithYourBootsON 21 Reputation points

2022-09-20T03:27:51.91+00:00

You are right. It says 'No'.
DieWithYourBootsON 21 Reputation points

2022-09-20T03:29:43.4+00:00

Yes. The user need to have admin rights.

1 answer

RLWA32 45,326 Reputation points

2022-09-20T07:25:32.123+00:00

If the process from which you are obtaining the token was started by a member of the Administrators group then it should have a linked token that contains elevated privileges. From a windows service running under the SYSTEM account you can query the process token to get a handle to the linked token containing the elevated privileges. Use the GetTokenInformation function with TokenLinkedToken to obtain a TOKEN_LINKED_TOKEN structure. This structure contains the handle to the token containing the elevated privileges. Use the linked token in the call to CreateProcessAsUser.
Please sign in to rate this answer.

1 person found this answer helpful.
Xiaopo Yang - MSFT 12,726 Reputation points Microsoft Vendor

2022-09-20T07:46:06.34+00:00

Fairly well. @DieWithYourBootsON Also have a look at https://stackoverflow.com/questions/21716527/in-windows-how-do-you-programatically-launch-a-process-in-administrator-mode-un

RLWA32 45,326 Reputation points

2022-09-20T08:51:16.187+00:00

Advantages to obtaining the linked token from a process already running in the user's interactive session are:

No credentials are needed for a call to the LogonUser function.

The linked token will contain a logon sid that permits access to the interactive session's window station and desktop.

The linked token will contain the correct session id.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to launch an application with admin rights in user mode from a service which runs in system context

1 answer

Your answer