Given a username and password, how do you impersonate that user elevated?

Question

In Windows Vista and later, LogonUser returns a non-privileged token, even if the user provided is an administrator. Thus, when you impersonate using that token, you are non-elevated. Given a correct username and password for an administrator user, how do you run code that has elevated privileges for that administrator?

Are you wanting to impersonate an AD account, or a local account? — Botonomous, Sep 27 '13 at 12:28
Active Directory, primarily - though if it works for local as well that would be great! — Mark Raymond, Sep 27 '13 at 12:47

score 1 · Answer 1 · edited Sep 27 '13 at 13:03

1

I just worked with this example, It actually works fine. I guess if you want to run code in this context you'll have to set the current thread principal by:

Thread.CurrentPrincipal = new System.Security.Principal.WindowsPrincipal(WindowsIdentity.GetCurrent());

edited Sep 27 '13 at 13:03

Sam

7,252
16
46
65

answered Sep 27 '13 at 12:55

MichaC

13,104
2
44
56

score 0 · Accepted Answer · answered Sep 27 '13 at 16:40

If you are writing a Windows service, using LOGON32_LOGON_SERVICE instead of LOGON32_LOGON_INTERACTIVE or LOGON32_LOGON_NEW_CREDENTIALS will result in a privileged token, as long as the user you want to impersonate has 'log on as a service' permissions.

This doesn't provide a general solution (it won't work if you're writing a user-facing application), but is sufficient to solve the specific problem I had.

Given a username and password, how do you impersonate that user elevated?

2 Answers2