/****************************** Module Header ******************************\
* Module Name: CppRunAsUser.cpp
* Project: CppRunAsUser
* Copyright (c) Microsoft Corporation.
*
*
*
* This source is subject to the Microsoft Public License.
* See http://www.microsoft.com/opensource/licenses.mspx#Ms-PL.
* All other rights reserved.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
* EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
\***************************************************************************/
#pragma region Includes and Manifest Dependencies
#include <stdio.h>
#include <windows.h>
#include <windowsx.h>
#include "Resource.h"
#include <userenv.h>
#pragma comment(lib, "userenv.lib")
// Enable Visual Style
#if defined _M_IX86
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"")
#elif defined _M_IA64
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"")
#elif defined _M_X64
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"")
#else
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")
#endif
#pragma endregion
#pragma region Helper Functions
//
// FUNCTION: ReportError(LPWSTR, DWORD)
//
// PURPOSE: Display an error dialog for the failure of a certain function.
//
// PARAMETERS:
// * pszFunction - the name of the function that failed.
// * dwError - the Win32 error code. Its default value is the calling
// thread's last-error code value.
//
// NOTE: The failing function must be immediately followed by the call of
// ReportError if you do not explicitly specify the dwError parameter of
// ReportError. This is to ensure that the calling thread's last-error code
// value is not overwritten by any calls of API between the failing
// function and ReportError.
//
void ReportError(LPWSTR pszFunction, DWORD dwError = GetLastError())
{
wchar_t szMessage[200];
int len = swprintf_s(szMessage, ARRAYSIZE(szMessage),
L"%s failed w/err 0x%08lx", pszFunction, dwError);
MessageBox(NULL, (len != -1) ? szMessage : pszFunction,
L"An error occurred!", MB_ICONERROR);
}
//
// FUNCTION: GetLogonSID(HANDLE, PSID *)
//
// PURPOSE: Obtain the logon SID of the user.
//
// PARAMETERS:
// * hToken -
// * ppSid -
//
BOOL GetLogonSID(HANDLE hToken, PSID *ppSid)
{
BOOL fSucceeded = FALSE;
DWORD cbTokenGroups = 0;
PTOKEN_GROUPS pTokenGroups = NULL;
DWORD dwIndex = 0;
DWORD dwLength = 0;
// Get required buffer size and allocate the TOKEN_GROUPS buffer.
if (!GetTokenInformation(hToken, TokenGroups, NULL, 0, &cbTokenGroups))
{
if (ERROR_INSUFFICIENT_BUFFER != GetLastError())
{
ReportError(L"GetTokenInformation");
goto Exit;
}
pTokenGroups = (PTOKEN_GROUPS)LocalAlloc(LPTR, cbTokenGroups);
if (pTokenGroups == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
}
// Get the token group information from the access token.
if (!GetTokenInformation(hToken, TokenGroups, pTokenGroups,
cbTokenGroups, &cbTokenGroups))
{
ReportError(L"GetTokenInformation");
goto Exit;
}
// Loop through the groups to find the logon SID.
for (dwIndex = 0; dwIndex < pTokenGroups->GroupCount; dwIndex++)
{
if ((pTokenGroups->Groups[dwIndex].Attributes & SE_GROUP_LOGON_ID)
== SE_GROUP_LOGON_ID)
{
// Found the logon SID; make a copy of it.
// Determine the length of the SID.
dwLength = GetLengthSid(pTokenGroups->Groups[dwIndex].Sid);
// Allocate a buffer for the logon SID.
*ppSid = (PSID)LocalAlloc(LPTR, dwLength);
if (*ppSid == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
// Obtain a copy of the logon SID.
if (!CopySid(dwLength, *ppSid, pTokenGroups->Groups[dwIndex].Sid))
{
ReportError(L"CopySid");
goto Exit;
}
break;
}
}
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (pTokenGroups)
{
if (LocalFree(pTokenGroups))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
// Set variable to same state as resources
pTokenGroups = NULL;
cbTokenGroups = 0;
}
return fSucceeded;
}
//
// FUNCTION: FreeLogonSID(PSID *)
//
// PURPOSE: Free the logon SID of the user.
//
// PARAMETERS:
// * pSid -
//
void FreeLogonSID(PSID *ppSid)
{
if (LocalFree(*ppSid))
{
ReportError(L"LocalFree");
}
}
#define GENERIC_ACCESS (GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | \
GENERIC_ALL)
#define WINSTA_ALL (WINSTA_ACCESSCLIPBOARD | WINSTA_ACCESSGLOBALATOMS | \
WINSTA_CREATEDESKTOP | WINSTA_ENUMDESKTOPS | \
WINSTA_ENUMERATE | WINSTA_EXITWINDOWS | \
WINSTA_READATTRIBUTES | WINSTA_READSCREEN | \
WINSTA_WRITEATTRIBUTES | DELETE | \
READ_CONTROL | WRITE_DAC | \
WRITE_OWNER)
#define DESKTOP_ALL (DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | \
DESKTOP_ENUMERATE | DESKTOP_HOOKCONTROL | \
DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | \
DESKTOP_READOBJECTS | DESKTOP_SWITCHDESKTOP | \
DESKTOP_WRITEOBJECTS | DELETE | \
READ_CONTROL | WRITE_DAC | \
WRITE_OWNER)
BOOL AddAceToWindowStation(HWINSTA hWinsta, PSID pSid)
{
BOOL fSucceeded = FALSE;
SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
DWORD cbSd = 0;
PSECURITY_DESCRIPTOR pSd = NULL;
BOOL fDaclPresent = FALSE;
BOOL fDaclExist = FALSE;
ACL_SIZE_INFORMATION aclSizeInfo = { 0 };
DWORD cbDacl = 0;
PACL pDacl = NULL;
PSECURITY_DESCRIPTOR pNewSd = NULL;
DWORD cbNewDacl = 0;
PACL pNewDacl = NULL;
DWORD cbNewAce = 0;
PACCESS_ALLOWED_ACE pNewAce = NULL;
DWORD dwIndex = 0;
PVOID pTempAce = NULL;
// Get required buffer size and allocate the SECURITY_DESCRIPTOR buffer.
if (!GetUserObjectSecurity(hWinsta, &si, NULL, 0, &cbSd))
{
if (ERROR_INSUFFICIENT_BUFFER != GetLastError())
{
ReportError(L"GetUserObjectSecurity");
goto Exit;
}
pSd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, cbSd);
if (pSd == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
}
// Obtain the security descriptor for the window station.
if (!GetUserObjectSecurity(hWinsta, &si, pSd, cbSd, &cbSd))
{
ReportError(L"GetUserObjectSecurity");
goto Exit;
}
// Get the DACL from the security descriptor.
if (!GetSecurityDescriptorDacl(pSd, &fDaclPresent, &pDacl, &fDaclExist))
{
ReportError(L"GetSecurityDescriptorDacl");
goto Exit;
}
// Get the size information of the DACL.
if (pDacl == NULL)
{
// If GetSecurityDescriptorDacl stores a NULL value in the pointer
// pointed to by pDacl, the security descriptor has a NULL DACL. A
// NULL DACL implicitly allows all access to an object.
cbDacl = 0;
}
else
{
if (!GetAclInformation(pDacl, (LPVOID)&aclSizeInfo,
sizeof(aclSizeInfo), AclSizeInformation))
{
ReportError(L"GetAclInformation");
goto Exit;
}
cbDacl = aclSizeInfo.AclBytesInUse;
}
// Allocate memory for the new security descriptor.
pNewSd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, cbSd);
if (pNewSd == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
// Initialize the new security descriptor.
if (!InitializeSecurityDescriptor(pNewSd, SECURITY_DESCRIPTOR_REVISION))
{
ReportError(L"InitializeSecurityDescriptor");
goto Exit;
}
// Compute the size of a DACL to be added to the new security descriptor.
cbNewAce = sizeof(ACCESS_ALLOWED_ACE) + GetLengthSid(pSid) - sizeof(DWORD);
cbNewDacl = (cbDacl == 0 ? sizeof(ACL) : cbDacl) + 2 * cbNewAce;
// Allocate memory for the new DACL.
pNewDacl = (PACL)LocalAlloc(LPTR, cbNewDacl);
if (pNewDacl == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
// Initialize the new DACL.
if (!InitializeAcl(pNewDacl, cbNewDacl, ACL_REVISION))
{
ReportError(L"InitializeAcl");
goto Exit;
}
// If the original DACL is present, copy it to the new DACL.
if (fDaclPresent)
{
// Copy the ACEs to the new DACL.
if (aclSizeInfo.AceCount)
{
for (dwIndex = 0; dwIndex < aclSizeInfo.AceCount; dwIndex++)
{
// Get an ACE.
if (!GetAce(pDacl, dwIndex, &pTempAce))
{
ReportError(L"GetAce");
goto Exit;
}
// Add the ACE to the new ACL.
if (!AddAce(pNewDacl, ACL_REVISION, MAXDWORD, pTempAce,
((PACE_HEADER)pTempAce)->AceSize))
{
ReportError(L"AddAce");
goto Exit;
}
}
}
}
// Add two new ACEs to the new DACL to allow the SID full access to the
// interactive window station.
pNewAce = (PACCESS_ALLOWED_ACE)LocalAlloc(LPTR, cbNewAce);
if (pNewAce == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
pNewAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
pNewAce->Header.AceFlags = CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE |
OBJECT_INHERIT_ACE;
pNewAce->Header.AceSize = (WORD)cbNewAce;
pNewAce->Mask = GENERIC_ACCESS;
if (!CopySid(GetLengthSid(pSid), &pNewAce->SidStart, pSid))
{
ReportError(L"CopySid");
goto Exit;
}
if (!AddAce(pNewDacl, ACL_REVISION, MAXDWORD, (LPVOID)pNewAce,
pNewAce->Header.AceSize))
{
ReportError(L"AddAce");
goto Exit;
}
pNewAce->Header.AceFlags = NO_PROPAGATE_INHERIT_ACE;
pNewAce->Mask = WINSTA_ALL;
if (!AddAce(pNewDacl, ACL_REVISION, MAXDWORD, (LPVOID)pNewAce,
pNewAce->Header.AceSize))
{
ReportError(L"AddAce");
goto Exit;
}
// Assign the new DACL to the new security descriptor.
if (!SetSecurityDescriptorDacl(pNewSd, TRUE, pNewDacl, FALSE))
{
ReportError(L"SetSecurityDescriptorDacl");
goto Exit;
}
// Set the new security descriptor for the window station.
if (!SetUserObjectSecurity(hWinsta, &si, pNewSd))
{
ReportError(L"SetUserObjectSecurity");
goto Exit;
}
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (pSd)
{
if (LocalFree(pSd))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pSd = NULL;
cbSd = 0;
}
if (pNewSd)
{
if (LocalFree(pNewSd))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewSd = NULL;
}
if (pNewDacl)
{
if (LocalFree(pNewDacl))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewDacl = NULL;
cbNewDacl = 0;
}
if (pNewAce)
{
if (LocalFree(pNewAce))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewAce = NULL;
cbNewAce = 0;
}
return fSucceeded;
}
BOOL AddAceToDesktop(HDESK hDesktop, PSID pSid)
{
BOOL fSucceeded = FALSE;
SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
DWORD cbSd = 0;
PSECURITY_DESCRIPTOR pSd = NULL;
BOOL fDaclPresent = FALSE;
BOOL fDaclExist = FALSE;
ACL_SIZE_INFORMATION aclSizeInfo = { 0 };
DWORD cbDacl = 0;
PACL pDacl = NULL;
PSECURITY_DESCRIPTOR pNewSd = NULL;
DWORD cbNewDacl = 0;
PACL pNewDacl = NULL;
DWORD cbNewAce = 0;
PACCESS_ALLOWED_ACE pNewAce = NULL;
DWORD dwIndex = 0;
PVOID pTempAce = NULL;
// Get required buffer size and allocate the SECURITY_DESCRIPTOR buffer.
if (!GetUserObjectSecurity(hDesktop, &si, NULL, 0, &cbSd))
{
if (ERROR_INSUFFICIENT_BUFFER != GetLastError())
{
ReportError(L"GetUserObjectSecurity");
goto Exit;
}
pSd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, cbSd);
if (pSd == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
}
// Obtain the security descriptor for the desktop object.
if (!GetUserObjectSecurity(hDesktop, &si, pSd, cbSd, &cbSd))
{
ReportError(L"GetUserObjectSecurity");
goto Exit;
}
// Get the DACL from the security descriptor.
if (!GetSecurityDescriptorDacl(pSd, &fDaclPresent, &pDacl, &fDaclExist))
{
ReportError(L"GetSecurityDescriptorDacl");
goto Exit;
}
// Get the size information of the DACL.
if (pDacl == NULL)
{
cbDacl = 0;
}
else
{
if (!GetAclInformation(pDacl, (LPVOID)&aclSizeInfo,
sizeof(aclSizeInfo), AclSizeInformation))
{
ReportError(L"GetAclInformation");
goto Exit;
}
cbDacl = aclSizeInfo.AclBytesInUse;
}
// Allocate memory for the new security descriptor.
pNewSd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, cbSd);
if (pNewSd == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
// Initialize the new security descriptor.
if (!InitializeSecurityDescriptor(pNewSd, SECURITY_DESCRIPTOR_REVISION))
{
ReportError(L"InitializeSecurityDescriptor");
goto Exit;
}
// Compute the size of a DACL to be added to the new security descriptor.
cbNewAce = sizeof(ACCESS_ALLOWED_ACE) + GetLengthSid(pSid) - sizeof(DWORD);
cbNewDacl = (cbDacl == 0 ? sizeof(ACL) : cbDacl) + cbNewAce;
// Allocate memory for the new DACL.
pNewDacl = (PACL)LocalAlloc(LPTR, cbNewDacl);
if (pNewDacl == NULL)
{
ReportError(L"LocalAlloc");
goto Exit;
}
// Initialize the new DACL.
if (!InitializeAcl(pNewDacl, cbNewDacl, ACL_REVISION))
{
ReportError(L"InitializeAcl");
goto Exit;
}
// If the original DACL is present, copy it to the new DACL.
if (fDaclPresent)
{
// Copy the ACEs to the new DACL.
if (aclSizeInfo.AceCount)
{
for (dwIndex = 0; dwIndex < aclSizeInfo.AceCount; dwIndex++)
{
// Get an ACE.
if (!GetAce(pDacl, dwIndex, &pTempAce))
{
ReportError(L"GetAce");
goto Exit;
}
// Add the ACE to the new ACL.
if (!AddAce(pNewDacl, ACL_REVISION, MAXDWORD, pTempAce,
((PACE_HEADER)pTempAce)->AceSize))
{
ReportError(L"AddAce");
goto Exit;
}
}
}
}
// Add a new ACE to the new DACL.
if (!AddAccessAllowedAce(pNewDacl, ACL_REVISION, DESKTOP_ALL, pSid))
{
ReportError(L"AddAccessAllowedAce");
goto Exit;
}
// Assign the new DACL to the new security descriptor.
if (!SetSecurityDescriptorDacl(pNewSd, TRUE, pNewDacl, FALSE))
{
ReportError(L"SetSecurityDescriptorDacl");
goto Exit;
}
// Set the new security descriptor for the desktop object.
if (!SetUserObjectSecurity(hDesktop, &si, pNewSd))
{
ReportError(L"SetUserObjectSecurity");
goto Exit;
}
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (pSd)
{
if (LocalFree(pSd))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pSd = NULL;
cbSd = 0;
}
if (pNewSd)
{
if (LocalFree(pNewSd))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewSd = NULL;
}
if (pNewDacl)
{
if (LocalFree(pNewDacl))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewDacl = NULL;
cbNewDacl = 0;
}
if (pNewAce)
{
if (LocalFree(pNewAce))
{
fSucceeded = FALSE;
ReportError(L"LocalFree");
}
pNewAce = NULL;
cbNewAce = 0;
}
return fSucceeded;
}
#pragma endregion
#pragma region CreateInteractiveProcessWithLogon
//
// FUNCTION: CreateInteractiveProcessWithLogon(LPCWSTR, LPCWSTR, LPCWSTR, LPWSTR)
//
// PURPOSE:
//
// PARAMETERS:
// * pszUserName - A pointer to a null-terminated string that specifies the
// name of the user. This is the name of the user account to log on to. If
// you use the user principal name (UPN) format, User@DNSDomainName, the
// pszDomain parameter must be NULL.
// * pszDomain - A pointer to a null-terminated string that specifies the
// name of the domain or server whose account database contains the
// pszUsername account. If this parameter is NULL, the user name must be
// specified in UPN format. If this parameter is ".", the function validates
// the account by using only the local account database.
// * pszPassword - A pointer to a null-terminated string that specifies the
// plaintext password for the user account specified by lpszUsername. When
// you have finished using the password, clear the password from memory by
// calling the SecureZeroMemory function.
// * pszCommandLine - The command line to be executed. The maximum length
// of this string is 1024 characters. The module name portion of
// pszCommandLine is limited to MAX_PATH characters.
//
// NOTE:
//
BOOL CreateInteractiveProcessWithLogon(LPCWSTR pszUserName,
LPCWSTR pszDomain,
LPCWSTR pszPassword,
LPWSTR pszCommandLine)
{
BOOL fSucceeded = FALSE;
HANDLE hToken = NULL;
LPVOID lpvEnv = NULL;
wchar_t szUserProfile[MAX_PATH];
DWORD dwSize = 0;
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
// Attempt to log the user on to the local computer. The logon type is
// intended for users who will be interactively using the computer.
if (!LogonUser(pszUserName, pszDomain, pszPassword,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken))
{
ReportError(L"LogonUser");
goto Exit;
}
// Retrieve the environment variables for the specified user. The
// environment block inherits from the current process's environment.
if (!CreateEnvironmentBlock(&lpvEnv, hToken, TRUE))
{
ReportError(L"CreateEnvironmentBlock");
goto Exit;
}
// Retrieve the path to the root directory of the user's profile.
dwSize = ARRAYSIZE(szUserProfile);
if (!GetUserProfileDirectory(hToken, szUserProfile, &dwSize))
{
ReportError(L"GetUserProfileDirectory");
goto Exit;
}
// If the lpDesktop member of the STARTUPINFO structure is initialized
// to either NULL or "", CreateProcessWithLogonW implementation adds
// permissions for the specified user account to the window station and
// desktop inherited from the parent process, which is "winsta0\default"
// for the "Default" application desktop.
si.lpDesktop = NULL;
// Launch the interative child process.
if (!CreateProcessWithLogonW(pszUserName, pszDomain, pszPassword,
LOGON_WITH_PROFILE, NULL, pszCommandLine,
CREATE_UNICODE_ENVIRONMENT, lpvEnv, szUserProfile, &si, &pi))
{
ReportError(L"CreateProcessWithLogonW");
goto Exit;
}
// The child process is running now ...
// (Optional) Wait for the exit of the child process.
//WaitForSingleObject(pi.hProcess);
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (hToken)
{
if (!CloseHandle(hToken))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
hToken = NULL;
}
if (lpvEnv)
{
if (!DestroyEnvironmentBlock(lpvEnv))
{
fSucceeded = FALSE;
ReportError(L"DestroyEnvironmentBlock");
}
lpvEnv = NULL;
}
if (pi.hProcess)
{
if (!CloseHandle(pi.hProcess))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hProcess = NULL;
}
if (pi.hThread)
{
if (!CloseHandle(pi.hThread))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hThread = NULL;
}
return fSucceeded;
}
#pragma endregion
#pragma region CreateInteractiveProcessWithToken
//
// FUNCTION: CreateInteractiveProcessWithToken(LPCWSTR, LPCWSTR, LPCWSTR, LPWSTR)
//
// PURPOSE:
//
// PARAMETERS:
// * pszUserName - A pointer to a null-terminated string that specifies the
// name of the user. This is the name of the user account to log on to. If
// you use the user principal name (UPN) format, User@DNSDomainName, the
// pszDomain parameter must be NULL.
// * pszDomain - A pointer to a null-terminated string that specifies the
// name of the domain or server whose account database contains the
// pszUsername account. If this parameter is NULL, the user name must be
// specified in UPN format. If this parameter is ".", the function validates
// the account by using only the local account database.
// * pszPassword - A pointer to a null-terminated string that specifies the
// plaintext password for the user account specified by lpszUsername. When
// you have finished using the password, clear the password from memory by
// calling the SecureZeroMemory function.
// * pszCommandLine - The command line to be executed. The maximum length
// of this string is 1024 characters. The module name portion of
// pszCommandLine is limited to MAX_PATH characters.
//
// NOTE:
//
BOOL CreateInteractiveProcessWithToken(LPCWSTR pszUserName,
LPCWSTR pszDomain,
LPCWSTR pszPassword,
LPWSTR pszCommandLine)
{
BOOL fSucceeded = FALSE;
HANDLE hToken = NULL;
HWINSTA hWinstaSave = NULL;
HWINSTA hWinsta = NULL;
HDESK hDesktop = NULL;
PSID pSid = NULL;
wchar_t szUserProfile[MAX_PATH];
DWORD dwSize = ARRAYSIZE(szUserProfile);
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
// Attempt to log the user on to the local computer. The logon type is
// intended for users who will be interactively using the computer.
if (!LogonUser(pszUserName, pszDomain, pszPassword,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken))
{
ReportError(L"LogonUser");
goto Exit;
}
// Save a handle to the caller's current window station.
hWinstaSave = GetProcessWindowStation();
if (hWinstaSave == NULL)
{
ReportError(L"GetProcessWindowStation");
goto Exit;
}
// Get a handle to the interactive window station.
hWinsta = OpenWindowStation(
L"winsta0", // The interactive window station
FALSE, // Handle is not inheritable
READ_CONTROL | WRITE_DAC); // Rights to read/write the DACL
if (hWinsta == NULL)
{
ReportError(L"OpenWindowStation");
goto Exit;
}
// To get the correct default desktop, set the caller's window station
// to the interactive window station.
if (!SetProcessWindowStation(hWinsta))
{
ReportError(L"SetProcessWindowStation");
goto Exit;
}
// Get a handle to the interactive desktop.
hDesktop = OpenDesktop(
L"default", // The interactive window station
0, // No interaction with other desktop processes
FALSE, // Handle is not inheritable
READ_CONTROL | WRITE_DAC | DESKTOP_WRITEOBJECTS |
DESKTOP_READOBJECTS); // Rights to read/write the DACL
// Restore the caller's window station.
if (!SetProcessWindowStation(hWinstaSave))
{
ReportError(L"SetProcessWindowStation");
goto Exit;
}
if (hDesktop == NULL)
{
ReportError(L"OpenDesktop");
goto Exit;
}
// Get the SID for the client's logon session.
if (!GetLogonSID(hToken, &pSid))
{
goto Exit;
}
// Allow logon SID full access to interactive window station.
if (!AddAceToWindowStation(hWinsta, pSid))
{
goto Exit;
}
// Allow logon SID full access to interactive desktop.
if (!AddAceToDesktop(hDesktop, pSid))
{
goto Exit;
}
// Retrieve the path to the root directory of the user's profile.
if (!GetUserProfileDirectory(hToken, szUserProfile, &dwSize))
{
ReportError(L"GetUserProfileDirectory");
goto Exit;
}
// Specify that the child process runs in the interactive desktop.
si.lpDesktop = L"winsta0\\default";
// Launch the process in the client's logon session.
if (!CreateProcessWithTokenW(hToken, LOGON_WITH_PROFILE, NULL,
pszCommandLine, CREATE_UNICODE_ENVIRONMENT, NULL, szUserProfile,
&si, &pi))
{
ReportError(L"CreateProcessWithTokenW");
goto Exit;
}
// The child process is running now ...
// (Optional) Wait for the exit of the child process.
//WaitForSingleObject(pi.hProcess);
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (hToken)
{
if (!CloseHandle(hToken))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
hToken = NULL;
}
if (hWinsta)
{
if (!CloseWindowStation(hWinsta))
{
fSucceeded = FALSE;
ReportError(L"CloseWindowStation");
}
hWinsta = NULL;
}
if (hDesktop)
{
if (!CloseDesktop(hDesktop))
{
fSucceeded = FALSE;
ReportError(L"CloseDesktop");
}
hDesktop = NULL;
}
if (pSid)
{
FreeLogonSID(&pSid);
pSid = NULL;
}
if (pi.hProcess)
{
if (!CloseHandle(pi.hProcess))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hProcess = NULL;
}
if (pi.hThread)
{
if (!CloseHandle(pi.hThread))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hThread = NULL;
}
return fSucceeded;
}
#pragma endregion
#pragma region CreateInteractiveProcessAsUser
//
// FUNCTION: CreateInteractiveProcessAsUser(LPCWSTR, LPCWSTR, LPCWSTR, LPWSTR)
//
// PURPOSE:
//
// PARAMETERS:
// * pszUserName - A pointer to a null-terminated string that specifies the
// name of the user. This is the name of the user account to log on to. If
// you use the user principal name (UPN) format, User@DNSDomainName, the
// pszDomain parameter must be NULL.
// * pszDomain - A pointer to a null-terminated string that specifies the
// name of the domain or server whose account database contains the
// pszUsername account. If this parameter is NULL, the user name must be
// specified in UPN format. If this parameter is ".", the function validates
// the account by using only the local account database.
// * pszPassword - A pointer to a null-terminated string that specifies the
// plaintext password for the user account specified by lpszUsername. When
// you have finished using the password, clear the password from memory by
// calling the SecureZeroMemory function.
// * pszCommandLine - The command line to be executed. The maximum length
// of this string is 1024 characters. The module name portion of
// pszCommandLine is limited to MAX_PATH characters.
//
// NOTE:
//
BOOL CreateInteractiveProcessAsUser(LPCWSTR pszUserName,
LPCWSTR pszDomain,
LPCWSTR pszPassword,
LPWSTR pszCommandLine)
{
BOOL fSucceeded = FALSE;
HANDLE hToken = NULL;
HWINSTA hWinstaSave = NULL;
HWINSTA hWinsta = NULL;
HDESK hDesktop = NULL;
PSID pSid = NULL;
wchar_t szUserProfile[MAX_PATH];
DWORD dwSize = ARRAYSIZE(szUserProfile);
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
// Attempt to log the user on to the local computer. The logon type is
// intended for users who will be interactively using the computer.
if (!LogonUser(pszUserName, pszDomain, pszPassword,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken))
{
ReportError(L"LogonUser");
goto Exit;
}
// Save a handle to the caller's current window station.
hWinstaSave = GetProcessWindowStation();
if (hWinstaSave == NULL)
{
ReportError(L"GetProcessWindowStation");
goto Exit;
}
// Get a handle to the interactive window station.
hWinsta = OpenWindowStation(
L"winsta0", // The interactive window station
FALSE, // Handle is not inheritable
READ_CONTROL | WRITE_DAC); // Rights to read/write the DACL
if (hWinsta == NULL)
{
ReportError(L"OpenWindowStation");
goto Exit;
}
// To get the correct default desktop, set the caller's window station
// to the interactive window station.
if (!SetProcessWindowStation(hWinsta))
{
ReportError(L"SetProcessWindowStation");
goto Exit;
}
// Get a handle to the interactive desktop.
hDesktop = OpenDesktop(
L"default", // The interactive window station
0, // No interaction with other desktop processes
FALSE, // Handle is not inheritable
READ_CONTROL | WRITE_DAC | DESKTOP_WRITEOBJECTS |
DESKTOP_READOBJECTS); // Rights to read/write the DACL
// Restore the caller's window station.
if (!SetProcessWindowStation(hWinstaSave))
{
ReportError(L"SetProcessWindowStation");
goto Exit;
}
if (hDesktop == NULL)
{
ReportError(L"OpenDesktop");
goto Exit;
}
// Get the SID for the client's logon session.
if (!GetLogonSID(hToken, &pSid))
{
goto Exit;
}
// Allow logon SID full access to interactive window station.
if (!AddAceToWindowStation(hWinsta, pSid))
{
goto Exit;
}
// Allow logon SID full access to interactive desktop.
if (!AddAceToDesktop(hDesktop, pSid))
{
goto Exit;
}
// Retrieve the path to the root directory of the user's profile.
if (!GetUserProfileDirectory(hToken, szUserProfile, &dwSize))
{
ReportError(L"GetUserProfileDirectory");
goto Exit;
}
// Specify that the child process runs in the interactive desktop.
si.lpDesktop = L"winsta0\\default";
// Launch the process in the client's logon session. The process that
// calls the CreateProcessAsUser function must have the
// SE_ASSIGNPRIMARYTOKEN_NAME and SE_INCREASE_QUOTA_NAME privileges.
// Generally only processes run as the SYSTEM account has both
// privileges. The function fails with the ERROR_PRIVILEGE_NOT_HELD
// (0x522) error when the required privileges are not available.
if (!CreateProcessAsUser(hToken, NULL, pszCommandLine, NULL, NULL, FALSE,
CREATE_UNICODE_ENVIRONMENT, NULL, szUserProfile, &si, &pi))
{
ReportError(L"CreateProcessAsUser");
goto Exit;
}
// The child process is running now ...
// (Optional) Wait for the exit of the child process.
//WaitForSingleObject(pi.hProcess);
fSucceeded = TRUE;
Exit:
// Centralized cleanup for all allocated resources. Clean up only those
// which were allocated, and clean them up in the right order.
if (hToken)
{
if (!CloseHandle(hToken))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
hToken = NULL;
}
if (hWinsta)
{
if (!CloseWindowStation(hWinsta))
{
fSucceeded = FALSE;
ReportError(L"CloseWindowStation");
}
hWinsta = NULL;
}
if (hDesktop)
{
if (!CloseDesktop(hDesktop))
{
fSucceeded = FALSE;
ReportError(L"CloseDesktop");
}
hDesktop = NULL;
}
if (pSid)
{
FreeLogonSID(&pSid);
pSid = NULL;
}
if (pi.hProcess)
{
if (!CloseHandle(pi.hProcess))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hProcess = NULL;
}
if (pi.hThread)
{
if (!CloseHandle(pi.hThread))
{
fSucceeded = FALSE;
ReportError(L"CloseHandle");
}
pi.hThread = NULL;
}
return fSucceeded;
}
#pragma endregion
void OnCreateProcess(HWND hWnd, int id)
{
int cchText;
DWORD cbUserName = 0;
PWSTR pszUserName = NULL;
DWORD cbDomain = 0;
PWSTR pszDomain = NULL;
DWORD cbPassword = 0;
PWSTR pszPassword = NULL;
DWORD cbCommand = 0;
PWSTR pszCommand = NULL;
// Get the user name from the dialog.
HWND hUserNameEdit = GetDlgItem(hWnd, IDC_USERNAME_EDIT);
cchText = GetWindowTextLength(hUserNameEdit);
if (cchText == 0)
{
MessageBox(hWnd, L"User Name cannot be empty", L"Error", MB_ICONERROR);
goto Exit;
}
cbUserName = (cchText + 1) * sizeof(*pszUserName);
pszUserName = (PWSTR)LocalAlloc(LPTR, cbUserName);
GetWindowText(hUserNameEdit, pszUserName, cchText + 1);
// Get the domain from the dialog.
HWND hDomainEdit = GetDlgItem(hWnd, IDC_DOMAIN_EDIT);
cchText = GetWindowTextLength(hDomainEdit);
if (cchText != 0)
{
cbDomain = (cchText + 1) * sizeof(*pszDomain);
pszDomain = (PWSTR)LocalAlloc(LPTR, cbDomain);
GetWindowText(hDomainEdit, pszDomain, cchText + 1);
}
// Get the password from the dialog.
HWND hPasswordEdit = GetDlgItem(hWnd, IDC_PASSWORD_EDIT);
cchText = GetWindowTextLength(hPasswordEdit);
if (cchText != 0)
{
cbPassword = (cchText + 1) * sizeof(*pszPassword);
pszPassword = (PWSTR)LocalAlloc(LPTR, cbPassword);
GetWindowText(hPasswordEdit, pszPassword, cchText + 1);
}
// Get the command from the dialog.
HWND hCommandEdit = GetDlgItem(hWnd, IDC_COMMAND_EDIT);
cchText = GetWindowTextLength(hCommandEdit);
if (cchText == 0)
{
MessageBox(hWnd, L"Command cannot be empty", L"Error", MB_ICONERROR);
goto Exit;
}
cbCommand = (cchText + 1) * sizeof(*pszCommand);
pszCommand = (PWSTR)LocalAlloc(LPTR, cbCommand);
GetWindowText(hCommandEdit, pszCommand, cchText + 1);
// Create the child process.
switch (id)
{
case IDC_CREATEPROCESSWITHLOGON_BN:
if (!CreateInteractiveProcessWithLogon(pszUserName, pszDomain,
pszPassword, pszCommand))
{
ReportError(L"CreateInteractiveProcessWithLogon");
}
break;
case IDC_CREATEPROCESSWITHTOKEN_BN:
if (!CreateInteractiveProcessWithToken(pszUserName, pszDomain,
pszPassword, pszCommand))
{
ReportError(L"CreateInteractiveProcessWithToken");
}
break;
case IDC_CREATEPROCESSASUSER_BN:
if (!CreateInteractiveProcessAsUser(pszUserName, pszDomain,
pszPassword, pszCommand))
{
ReportError(L"CreateInteractiveProcessAsUser");
}
break;
}
Exit:
if (pszUserName)
{
if (LocalFree(pszUserName))
{
ReportError(L"LocalFree");
}
pszUserName = NULL;
cbUserName = 0;
}
if (pszDomain)
{
if (LocalFree(pszDomain))
{
ReportError(L"LocalFree");
}
pszDomain = NULL;
cbDomain = 0;
}
if (pszPassword)
{
SecureZeroMemory(pszPassword, cbPassword);
if (LocalFree(pszPassword))
{
ReportError(L"LocalFree");
}
pszPassword = NULL;
cbPassword = 0;
}
if (pszCommand)
{
if (LocalFree(pszCommand))
{
ReportError(L"LocalFree");
}
pszCommand = NULL;
cbCommand = 0;
}
}
//
// FUNCTION: OnInitDialog(HWND, HWND, LPARAM)
//
// PURPOSE: Process the WM_INITDIALOG message.
//
BOOL OnInitDialog(HWND hWnd, HWND hwndFocus, LPARAM lParam)
{
return TRUE;
}
//
// FUNCTION: OnCommand(HWND, int, HWND, UINT)
//
// PURPOSE: Process the WM_COMMAND message.
//
void OnCommand(HWND hWnd, int id, HWND hwndCtl, UINT codeNotify)
{
switch (id)
{
case IDC_CREATEPROCESSWITHLOGON_BN:
case IDC_CREATEPROCESSWITHTOKEN_BN:
case IDC_CREATEPROCESSASUSER_BN:
OnCreateProcess(hWnd, id);
break;
case IDOK:
case IDCANCEL:
EndDialog(hWnd, 0);
break;
}
}
//
// FUNCTION: OnClose(HWND)
//
// PURPOSE: Process the WM_CLOSE message.
//
void OnClose(HWND hWnd)
{
EndDialog(hWnd, 0);
}
//
// FUNCTION: DialogProc(HWND, UINT, WPARAM, LPARAM)
//
// PURPOSE: Processes messages for the main dialog.
//
INT_PTR CALLBACK DialogProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
switch (message)
{
// Handle the WM_INITDIALOG message in OnInitDialog
HANDLE_MSG (hWnd, WM_INITDIALOG, OnInitDialog);
// Handle the WM_COMMAND message in OnCommand
HANDLE_MSG (hWnd, WM_COMMAND, OnCommand);
// Handle the WM_CLOSE message in OnClose
HANDLE_MSG (hWnd, WM_CLOSE, OnClose);
default:
return FALSE;
}
return 0;
}
//
// FUNCTION: wWinMain(HINSTANCE, HINSTANCE, LPWSTR, int)
//
// PURPOSE: The entry point of the application.
//
int APIENTRY wWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPWSTR lpCmdLine,
int nCmdShow)
{
return DialogBox(hInstance, MAKEINTRESOURCE(IDD_MAINDIALOG), NULL, DialogProc);
}
