File access with other credentials returns unexpected Results

Question

Hello,

I want to access files with the credentials of another user. This should be possible, if the current user has the SeImpersonatePrivilege. I use this code:

    login_success = LogonUser(user, domain, Password, LOGON32_LOGON_NETWORK_CLEARTEXT, LOGON32_PROVIDER_DEFAULT, &token);

    if (login_success)
      login_success = DuplicateToken(token, SECURITY_IMPERSONATION_LEVEL::SecurityImpersonation, &impersonate_token);

    if (login_success)
      login_success = ImpersonateLoggedOnUser(impersonate_token);

// Do some file access

Now I get some unexpected results:

If I use this code in a standard application, the file access fails always with ERROR_BAD_IMPERSONATION_LEVEL, even if the user has the SeImpersonatePrivilege.
If I use this code in a service, the file access is always successful, even if the user has not the SeImpersonatePrivilege.

Why is there a difference if the code is executed in an application or a service even if the same user is used?

Answer 1

Try passing LOGON32_LOGON_INTERACTIVE to LogonUser instead of LOGON32_LOGON_NETWORK_CLEARTEXT.