1

I'm writing the 32bit service app where I want to be able to launch Start menu items for the logged users. I did manage to accomplish this task by impersonating user and launching selected .lnk-file using CreateProcessAsUser with command-line: %windir%\system32\cmd /c " start /b /i "" "<path-to-lnk-file>" ". And it works for almost every shortcut except bunch of the system shortcuts from Accessories folder (e.g. Sticky Notes.lnk, Snipping Tool.lnk). During the launch of the Snipping Tool I'm receiving the message box with this error from cmd:

Windows cannot find 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk'. Make sure you typed the name correctly, and then try again.

But the .lnk-file exists in this very directory!

Summary:

  • service is 32 bit
  • Windows 8 Pro x64
  • launching shortcuts by user impersonation and CreateProcessAsUser with command-line %windir%\system32\cmd /c " start /b /i "" "<path-to-lnk-file>" "
  • approach works for almost every shortcut in Start menu except some in Start/Accessories folder (not all of them, e.g. Paint.lnk opens fine)

  • example code:

    int launchAppForCurrentLoggedUser() 
{
    HANDLE userToken = WTSApiHelper::currentLoggedUserToken();
    if (userToken == INVALID_HANDLE_VALUE) {
        return -1;
    }

    //Duplicating token with access TOKEN_DUPLICATE | TOKEN_ALL_ACCESS, 
    //impersonation level SecurityImpersonation and token type TokenPrimary.
    //Also closing original userToken
    HANDLE dup = WTSApiHelper::duplicateToken(userToken);
    if (dup == INVALID_HANDLE_VALUE) {
        return -1;
    }

    int res = -1;

    uint8 *env = NULL;
    BOOL succeeded = CreateEnvironmentBlock((LPVOID *)&env, dup, FALSE);
    if (!succeeded) {
        Log("failed to get environment variables for user (error 0x%x).", GetLastError());
    }

    PROCESS_INFORMATION pi;
    memset(&pi, 0, sizeof(PROCESS_INFORMATION));

    STARTUPINFOW si;
    memset(&si, 0, sizeof(STARTUPINFOW));
    si.cb = sizeof(STARTUPINFOW);
    si.lpDesktop = L"winsta0\\Default";
    WCHAR params[] = L"/c \" start /b /i \"\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk\" \" ";
    WCHAR cmd[] = L"C:\\Windows\\system32\\cmd.exe";

    DWORD flags = env ? CREATE_UNICODE_ENVIRONMENT : 0;
    succeeded = CreateProcessAsUserW(dup, cmd, params, NULL, NULL, FALSE, flags | CREATE_NO_WINDOW, env, NULL, &si, &pi);
    if (!succeeded) {
        Log("cannot launch process for user with error 0x%x.", GetLastError());
    } else {
        nres = 0;
    }

    DestroyEnvironmentBlock(env);
    CloseHandle(dup);

    return nres;
}

What do I miss here?

teapot_of_wine
  • 516
  • 3
  • 18
  • [CreateProcessAsUser](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682429.aspx): *"lpCommandLine: The Unicode version of this function, **CreateProcessAsUserW**, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a **literal string**). If this parameter is a constant string, the function may cause an access violation."* – IInspectable Aug 03 '15 at 13:03
  • @IInspectable, I do know that, specified code is a little simplified. – teapot_of_wine Aug 03 '15 at 13:32
  • There's a difference between simplifying and introducing bugs. A simplified versions would use `WCHAR params[] = L"/c [...] ";`. Equally simple, yet correct. – IInspectable Aug 03 '15 at 13:55
  • @IInspectable yes, you're right, my bad. I'll fix this right away. – teapot_of_wine Aug 03 '15 at 14:03

2 Answers2

3

It's not the LNK file that is missing, but its target.

Seems like a WOW64 issue -- for your 32-bit service, %WINDIR%\System32 actually redirects to SysWOW64 and these executable files do not exist there.

Well, actually your 32-bit service is finding the 32-bit cmd.exe which does exist in SysWOW64, and then 32-bit cmd.exe has the above problem, when looking up the path %windir%\system32\SnippingTool.exe found in the shortcut .

I can reproduce the problem using a 32-bit Command Prompt. 32-bit processes attempting to use these shortcuts simply fail.

Try spawning the native version of cmd.exe (64-bit on your system), using %WINDIR%\SysNative\cmd.exe

In addition, you have quoting problems. You're trying to nest quotes, but what actually happens is that the second quote matches the first quote and exits quoting, rather than nesting.

In the future, when things fail in a service it is helpful to run the same call from a normal console application. In this case you would have immediately discovered that the issue is completely unrelated to impersonation. Second step, if it worked from a console application running in-profile would be using "Run As" with the console application, to test impersonation logic, still without the additional complexity of the service environment.

Ben Voigt
  • 277,958
  • 43
  • 419
  • 720
0

CreateProcessAsUser does not load the specified user's profile into the HKEY_USERS registry key. Therefore, to access the information in the HKEY_CURRENT_USER registry key, you must load the user's profile information into HKEY_USERS with the LoadUserProfile function before calling CreateProcessAsUser. Be sure to call UnloadUserProfile after the new process exits.

According to the msdn page

MSDN suggests to use CreateProcessWithLogonW or CreateProcessWithTokenW, or to manually load the user's profile information.

And also:

CreateProcessAsUser allows you to access the specified directory and executable image in the security context of the caller or the target user. By default, CreateProcessAsUser accesses the directory and executable image in the security context of the caller. In this case, if the caller does not have access to the directory and executable image, the function fails. To access the directory and executable image using the security context of the target user, specify hToken in a call to the ImpersonateLoggedOnUser function before calling CreateProcessAsUser.

Mark Jansen
  • 1,491
  • 12
  • 24