How to fix the Win32 API function error: 1312 (GetTokenInformation) occurring for the below code used for creating a windows application.

Question

I have used the below code and it is working fine for most of the cases but for one windows machine it is failing at the section where we call 'GetTokenInformation' win32 API function and throws an error as ERROR: API = GetTokenInformation, error code = 1312, message = A specified logon session does not exist. It may already have been terminated.)
What could have gone wrong and how can we resolve this. Please help. Thanks!

// Logging on as the passed ssh user (not logged in user) which is non-Administrator
        if (!LogonUser(username.c_str(), domain.c_str(), password.c_str(), LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken)) {
                DisplayError(L"LogonUser");
                goto Cleanup;
        }

        tokenUsed = hToken;
        
        // If the ssh user (not logged in user) is non-Administrator, we need linked token
        if (!adminUser)
        {
                if (!GetTokenInformation(hToken, TokenLinkedToken, &linkedToken, sizeof(TOKEN_LINKED_TOKEN), &returnLength))
                {
                        DisplayError(L"GetTokenInformation");
                        goto Cleanup;
                }

                // Duplicate the token to ensure valid usage
                if (!DuplicateTokenEx(linkedToken.LinkedToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hDupToken)) {
                        DisplayError(L"DuplicateTokenEx");
                        goto Cleanup;
                }

                tokenUsed = hDupToken;  // Use the duplicated token
        }

Answer 1

Ordinarily, a standard account (i.e., non-Administrator) will not have a linked token when UAC is enabled. Only accounts that are members of the Administrators group will have one when logged on with the usual Windows API functions such as LogonUser.

// If the ssh user (not logged in user) is non-Administrator, we need linked token

The posted code seems to be looking for a linked token for non-Administrator accounts which doesn't make sense to me.

Answer 2

@RLWA32 I used the control panel to create the new user and then used the interactive logon method just before GetTokenInformation which is as below. LogonUser(username.c_str(), domain.c_str(), password.c_str(), LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken) So, in our case the user created is not created by an S4Ulogon and thus it must fall under the 'Token Elevation type is TokenElevationTypeFull'..