CreateProcessAsUser How to add privileges?

Question

I'm trying to call execute an application from another windows application under another users account using this code:

procedure TForm1.Button3Click(Sender: TObject);
var
  userName: string;
  password: string;
  domain: string;
  path: string;
  logonok: boolean;
  impok: boolean;
  hUserToken: THandle;
  ProcessCreatedOK: Boolean;
  startupInfo: TStartupInfo;
  processInfo: TProcessInformation;
  err: DWORD;
begin
    username := 'theusername';
    password := 'thepassword';
    domain := '';
    Path := 'myapp.exe';

    LogonOK := LogonUser(PWideChar(username), PWideChar(domain), PWideChar(password),
      LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, hUserToken);

    if LogonOK then
    begin
      impOK := ImpersonateLoggedOnUser(hUserToken);

      if impok then
      begin
        FillChar(startupInfo, SizeOf(startupInfo), 0);
        startupInfo.CB := SizeOf(startupinfo);
        startupInfo.dwFlags := STARTF_USESHOWWINDOW;
        startupinfo.wShowWindow := SW_SHOWNORMAL;

        NewState.PrivilegeCount := 1;
        res := LookupPrivilegeValue(
          nil,
          SE_ASSIGNPRIMARYTOKEN_NAME,
          NewState.Privileges[0].Luid);
          Win32Check(res);

        NewState.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
        res := AdjustTokenPrivileges(
          hUserToken,
          False,
          NewState,
          SizeOf(NewState),
          nil,
          returnLength);
        Win32Check(res);

        NewState.PrivilegeCount := 1;
        res := LookupPrivilegeValue(
          nil,
          SE_INCREASE_QUOTA_NAME,
          NewState.Privileges[0].Luid);
          Win32Check(res);

        NewState.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
        res := AdjustTokenPrivileges(
          hUserToken,
          False,
          NewState,
          SizeOf(NewState),
          nil,
          returnLength);
        Win32Check(res);

        ProcessCreatedOK := CreateProcessAsUser(
           hUserToken,
           nil,
           PChar(path),
           nil, nil,
           false,
           CREATE_NEW_CONSOLE or NORMAL_PRIORITY_CLASS, nil, nil,
           startupInfo, processInfo);

        if GetLastError <> 0 then
        begin
          err := GetlastError;
          ShowMessage(inttostr(err) + ' ' +  SysErrorMessage(err));
        end;
      end;
    end;

I'm getting a 1314 "A required privilege is not held by the client" error.

Now from some digging around I can see that I need to apply some privileges to the impersonated account: SE_ASSIGNPRIMARYTOKEN_NAME and SE_INCREASE_QUOTA_NAME?

Does anyone have some suggestions on how to do this?

I've seen the JCL example given in this Stackoverflow answer but I get similar issues with regards to account privileges.

I'd prefer not to use CreateProcessWithLogonW - I can explain why on request.

score 5 · Accepted Answer · answered Sep 26 '12 at 14:58

5

Use AdjustTokenPrivileges. First, call LookupPrivilegeValue to get the IDs of the privileges you want, and then set them. Here's an example adapted from some C code I happen to have:

var
  NewState: TTokenPrivileges;

NewState.PrivilegeCount := 1;
res := LookupPrivilegeValue(nil, Se_AssignPrimaryToken_Name,
  @NewState.Privileges[0].Luid);
Win32Check(res);

NewState.Privileges[0].Attributes := Se_Privilege_Enabled;
res := AdjustTokenPrivileges(hUserToken, False, @NewState,
  SizeOf(NewState), nil, nil);
Win32Check(res);

answered Sep 26 '12 at 14:58

Rob Kennedy

161,384
21
275
467

Thanks for that. I've edited the above code with your examples but unfortunately I've still got the same error - 1314 "A required privilege is not held by the client". Maybe there are other privileges required? – Mattl Sep 26 '12 at 15:39
Maybe. Sounds like something worth investigating, but I think I've answered the question you asked, which was how to grant new privileges. Please don't change the nature of the question after it's already been answered. I think you need to ask a new question: "When the OS says a required privilege isn't held, how do I find out which one?" – Rob Kennedy Sep 26 '12 at 15:47
AdjustTokenPrivileges isn't actually needed in this case, as per the documentation: "If the necessary privileges are not already enabled, CreateProcessAsUser enables them for the duration of the call." The OPs problem was likely that he simply didn't have those privileges, not that they weren't enabled. – Harry Johnston Sep 09 '14 at 22:50

CreateProcessAsUser How to add privileges?

1 Answers1