Question

我尝试从在本地管理员帐户下运行的Windows服务执行进程。该机器是Windows 7，它使用Remote Desktop/Terminal Service APIs。

代码在WTSQueryUserToken上失败，错误代码= 5。

首先，我尝试从当前线程获取令牌，然后调用SetPrivilege以启用SE_DEBUG_NAME和SE_TCB_NAME权限。然后调用WTSQueryUserToken，但得到错误5。

只是为了澄清：当服务在本地系统（localSystem）下时，即使不需要调用SetPrivilege，此代码也能完美运行。现在问题是我需要将服务移动到本地管理员用户!!!!

下运行

知道我错过了什么吗？

代码：

BOOL  T_Ex_RunProgram (DWORD sessionId, LPCWSTR targetPath)
{
#ifdef DEBUG
    if(g_pLog)
    {
         g_pLog->Format ("T_Ex_RunProgram: sessionId = %d, targetPath = \"%S\"\n", sessionId, targetPath);
    }
#endif
    HANDLE htoken;

    if(!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &htoken))
    {
        if (GetLastError() == ERROR_NO_TOKEN)
        {
            if (!ImpersonateSelf(SecurityImpersonation))
            {
                 DWORD dwErr = GetLastError();
#ifdef DEBUG
                    if(g_pLog)
                    {
                        g_pLog->Format ("ImpersonateSelf::RunProgram: dwErr = %d\n", dwErr);
                    }
#endif
                SetLastError(dwErr);
                return FALSE;
            }

            if(!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &htoken))
            {
                 DWORD dwErr = GetLastError();
#ifdef DEBUG
                    if(g_pLog)
                    {
                        g_pLog->Format ("OpenThreadToken::RunProgram: dwErr = %d\n", dwErr);
                    }
#endif
                SetLastError(dwErr);
                return FALSE;
            }
        }
        else{
                 DWORD dwErr = GetLastError();
#ifdef DEBUG
                    if(g_pLog)
                    {
                        g_pLog->Format ("OpenThreadToken::RunProgram: GetLastError return unexpected dwErr = %d\n", dwErr);
                    }
#endif
                SetLastError(dwErr);
                return FALSE;
            }
     }
#ifdef DEBUG
    if(g_pLog)
    {
        g_pLog->Format ("Before SetPrivilege(SE_DEBUG_NAME)::RunProgram\n");
    }
#endif
    // enable SeDebugPrivilege
    if(!SetPrivilege(htoken, SE_DEBUG_NAME, TRUE))
    {
        // close token handle
        CloseHandle(htoken);

        DWORD dwErr = GetLastError();
#ifdef DEBUG
        if(g_pLog)
        {
            g_pLog->Format ("SetPrivilege::RunProgram((SE_DEBUG_NAME): dwErr = %d\n", dwErr);
        }
#endif
        SetLastError(dwErr);
        return FALSE;
    }

#ifdef DEBUG
    if(g_pLog)
    {
        g_pLog->Format ("Before SetPrivilege(SE_TCB_NAME)::RunProgram\n");
    }
#endif
    // enable SeDebugPrivilege
    if(!SetPrivilege(htoken, SE_TCB_NAME, TRUE))
    {
        // close token handle
        CloseHandle(htoken);

        DWORD dwErr = GetLastError();
#ifdef DEBUG
        if(g_pLog)
        {
            g_pLog->Format ("SetPrivilege(SE_TCB_NAME)::RunProgram: dwErr = %d\n", dwErr);
        }
#endif
        SetLastError(dwErr);
        return FALSE;
    }

    BOOL b = WTSQueryUserToken (sessionId, &htoken);
    if (!b)
    {
        DWORD dwErr = GetLastError();
#ifdef DEBUG
    if(g_pLog)
    {
        g_pLog->Format ("T_Ex_RunProgram: WTSQueryUserToken failed. dwErr = %d\n", dwErr);
    }
#endif
        SetLastError(dwErr);
        return FALSE;
    }


    LPWSTR userName, userName1;
    DWORD userNameLength;
    b = WTSQuerySessionInformationW (WTS_CURRENT_SERVER_HANDLE, sessionId, WTSUserName, &userName, &userNameLength);
    if (b)
    {
        userName1 = _wcsdup (userName);
        WTSFreeMemory (userName);
    }
    else
    {
        DWORD dwErr = GetLastError();
    #ifdef DEBUG
        if(g_pLog)
        {
            g_pLog->Format ("T_Ex_RunProgram: WTSQuerySessionInformation failed: dwErr = %d\n", dwErr);
        }
    #endif
        SetLastError(dwErr);
        return FALSE;
    }
    b = RunProgramWithToken (htoken, userName1, targetPath,sessionId);
    DWORD dwreturnErr = GetLastError();


#ifdef DEBUG
    if(g_pLog)
    {
        g_pLog->Format ("Before SetPrivilege(SE_DEBUG_NAME,FALSE)::RunProgram\n");
    }
#endif
    // enable SeDebugPrivilege
    if(!SetPrivilege(htoken, SE_DEBUG_NAME, FALSE))
    {
        // close token handle
        CloseHandle(htoken);

        DWORD dwErr = GetLastError();
#ifdef DEBUG
        if(g_pLog)
        {
            g_pLog->Format ("SetPrivilege::RunProgram((SE_DEBUG_NAME,FALSE): dwErr = %d\n", dwErr);
        }
#endif
        SetLastError(dwErr);
    }

#ifdef DEBUG
    if(g_pLog)
    {
        g_pLog->Format ("Before SetPrivilege(SE_TCB_NAME,FALSE)::RunProgram\n");
    }
#endif
    // enable SeDebugPrivilege
    if(!SetPrivilege(htoken, SE_TCB_NAME, FALSE))
    {
        // close token handle
        CloseHandle(htoken);

        DWORD dwErr = GetLastError();
#ifdef DEBUG
        if(g_pLog)
        {
            g_pLog->Format ("SetPrivilege(SE_TCB_NAME,FALSE)::RunProgram: dwErr = %d\n", dwErr);
        }
#endif
        SetLastError(dwErr);
    }

    free (userName1);
    CloseHandle (htoken);
    if (!b)
        SetLastError (dwreturnErr);
    return b;
}
 BOOL SetPrivilege( HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
    ) 
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if ( !LookupPrivilegeValue( 
            NULL,            // lookup privilege on local system
            lpszPrivilege,   // privilege to lookup 
            &luid ) )        // receives LUID of privilege
    {
        printf("LookupPrivilegeValue error: %u\n", GetLastError() ); 
        return FALSE; 
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if ( !AdjustTokenPrivileges(
           hToken, 
           FALSE, 
           &tp, 
           sizeof(TOKEN_PRIVILEGES), 
           (PTOKEN_PRIVILEGES) NULL, 
           (PDWORD) NULL) )
    { 
          printf("AdjustTokenPrivileges error: %u\n", GetLastError() ); 
          return FALSE; 
    } 

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
          printf("The token does not have the specified privilege. \n");
          return FALSE;
    } 

    return TRUE;
}

Answer 1

WTSQueryUserToken上的代码失败，错误代码= 5 ...知道我缺少什么吗？

我认为这篇MSDN文章可能对您有用：Launching an interactive process from Windows Service in Windows Vista and later。根据该文章，您在使用WTSQueryUserToken时应该调用以下内容：

WTSQueryUserToken (WTSGetActiveConsoleSessionId (), &hToken);

然后使用在CreateProcessAsUser的调用中检索到的令牌。

在使用OpenThreadToken打电话给TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY时，您可能暂时将其增加到类似TOKEN_ALL_ACCESS的内容，直到您解决了皱纹（如果您还是需要打电话）。请参阅MSDN上的Access Rights for Access-Token Objects。

从其他用户运行进程

1 个答案: