Windows 7 x64: low IL process msdn example does not work

Question

I want to create process with low integrity level from process with medium integrity level. I found msdn example: Designing Applications to Run at a Low Integrity Level

But it does not work on my system. Process is created successfully, but message box

"Alpplication failed to initialized properly(0xC0000022 -- STATUS_ACCESS_DENIED) ..." is appeared. Did anybody meet the same problem?

score 3 · Answer 1 · answered Oct 01 '10 at 20:55

3

I ran into this too. The SID used in the example is incorrect. It should be "S-1-16-4096", not "S-1-16-1024".

answered Oct 01 '10 at 20:55

dyared

31
3

score 2 · Answer 2 · answered Sep 11 '15 at 20:23

I have upvoted @dyared's answer because it helped me find the complete answer. I should mention first that I am not specialized in this matter and this is only a summary of my findings.

It seems that the MSDN example does not work with the specified SID string because it specifies an integrity level that is too low. From the Chromium's source code, the S-1-16-1024 SID used in the example is between INTEGRITY_LEVEL_BELOW_LOW and INTEGRITY_LEVEL_UNTRUSTED:

const wchar_t* GetIntegrityLevelString(IntegrityLevel integrity_level) {
  switch (integrity_level) {
    case INTEGRITY_LEVEL_SYSTEM:
      return L"S-1-16-16384";
    case INTEGRITY_LEVEL_HIGH:
      return L"S-1-16-12288";
    case INTEGRITY_LEVEL_MEDIUM:
      return L"S-1-16-8192";
    case INTEGRITY_LEVEL_MEDIUM_LOW:
      return L"S-1-16-6144";
    case INTEGRITY_LEVEL_LOW:
      return L"S-1-16-4096";
    case INTEGRITY_LEVEL_BELOW_LOW:
      return L"S-1-16-2048";
    case INTEGRITY_LEVEL_UNTRUSTED:
      return L"S-1-16-0";
    case INTEGRITY_LEVEL_LAST:
      return NULL;
  }

Furthermore, it seems that the SID S-1-16-4096, suggested by @dyared, is also used when launching Internet Explorer in protected mode, as claimed in Creating a Process in Protected Mode on Windows Vista article on MSDN Blogs.

However, because it was enough to get the example working does not mean it is strict enough for every situation and choosing the appropriate integrity level must be made understanding its implications.

Windows 7 x64: low IL process msdn example does not work

2 Answers2