是否可以通过Vista/Windows 7在代码中设置用户名，登录名和密码来模拟管理员？
我的方案：很多用户（没有本地管理员资格）会执行C＃程序; C＃程序将文件复制到C:\Windows\。我希望程序使用管理员的凭据来执行复制，而不会收到“拒绝访问”消息，也不需要在UAC提示符下键入凭据。
我尝试过这两种方法：
requireAdministrator或highestAvailable的清单。系统将提示用户输入凭据，因此不起作用。LogonUser中的旧advapi32.dll API模拟。我已经完成了它并且像魅力一样......但仅限于Windows XP。这可能吗？
修改
很感兴趣我为什么要做这么可怕的事情。我正在编辑以包含一些我的评论，解释为什么我需要这个。
我们无法在每台用户计算机中创建计划任务。这是一个 时间：向所有用户发送电子邮件，要求他们执行.exe 文件在网络文件夹中（或附加.exe）。这就是整体 要点：避免用电脑做电脑。
加油吧！我知道这不是严格的，但那是场景。该 正常和正确的方式将需要我们2个月的公司 程序。总经理要求我们找到一种方法来做到这一点 一周因商业原因。这不是关于某些病毒或攻击...... 这是一个愚蠢的任务，用一个更改过时的壁纸 与新的销售“口头禅”。
答案 0 :(得分：3)
你说你只是在改变用户的壁纸，正确的方法是两个步骤，可以完全用组策略完成。
第1步： 有一个one time per-machine startup script将背景从网络共享复制到本地Windows目录。
第2步：
Update the users wallpaper到新的企业壁纸。 （您需要更新的注册码位于HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\，具体为Wallpaper和WallpaperStyle）
如果新壁纸的名称与旧壁纸的名称相同，则可以删除第2步。
如果您真的必须按照自己的方式行事，这里的解决方案基于我使用this question for my own tasks的答案。
将以下NativeMethods类添加到您的代码中。
using System;
using System.Runtime.InteropServices;
/// <summary>
/// Implements P/Invoke Interop calls to the operating system.
/// </summary>
internal static class NativeMethods
{
/// <summary>
/// The type of logon operation to perform.
/// </summary>
internal enum LogonType : int
{
/// <summary>
/// This logon type is intended for users who will be interactively
/// using the computer, such as a user being logged on by a
/// terminal server, remote shell, or similar process.
/// This logon type has the additional expense of caching logon
/// information for disconnected operations; therefore, it is
/// inappropriate for some client/server applications, such as a
/// mail server.
/// </summary>
Interactive = 2,
/// <summary>
/// This logon type is intended for high performance servers to
/// authenticate plaintext passwords.
/// The LogonUser function does not cache credentials for this
/// logon type.
/// </summary>
Network = 3,
/// <summary>
/// This logon type is intended for batch servers, where processes
/// may be executing on behalf of a user without their direct
/// intervention. This type is also for higher performance servers
/// that process many plaintext authentication attempts at a time,
/// such as mail or Web servers.
/// The LogonUser function does not cache credentials for this
/// logon type.
/// </summary>
Batch = 4,
/// <summary>
/// Indicates a service-type logon. The account provided must have
/// the service privilege enabled.
/// </summary>
Service = 5,
/// <summary>
/// This logon type is for GINA DLLs that log on users who will be
/// interactively using the computer.
/// This logon type can generate a unique audit record that shows
/// when the workstation was unlocked.
/// </summary>
Unlock = 7,
/// <summary>
/// This logon type preserves the name and password in the
/// authentication package, which allows the server to make
/// connections to other network servers while impersonating the
/// client. A server can accept plaintext credentials from a
/// client, call LogonUser, verify that the user can access the
/// system across the network, and still communicate with other
/// servers.
/// NOTE: Windows NT: This value is not supported.
/// </summary>
NetworkCleartext = 8,
/// <summary>
/// This logon type allows the caller to clone its current token
/// and specify new credentials for outbound connections. The new
/// logon session has the same local identifier but uses different
/// credentials for other network connections.
/// NOTE: This logon type is supported only by the
/// LOGON32_PROVIDER_WINNT50 logon provider.
/// NOTE: Windows NT: This value is not supported.
/// </summary>
NewCredentials = 9
}
/// <summary>
/// Specifies the logon provider.
/// </summary>
internal enum LogonProvider : int
{
/// <summary>
/// Use the standard logon provider for the system.
/// The default security provider is negotiate, unless you pass
/// NULL for the domain name and the user name is not in UPN format.
/// In this case, the default provider is NTLM.
/// NOTE: Windows 2000/NT: The default security provider is NTLM.
/// </summary>
Default = 0,
/// <summary>
/// Use this provider if you'll be authenticating against a Windows
/// NT 3.51 domain controller (uses the NT 3.51 logon provider).
/// </summary>
WinNT35 = 1,
/// <summary>
/// Use the NTLM logon provider.
/// </summary>
WinNT40 = 2,
/// <summary>
/// Use the negotiate logon provider.
/// </summary>
WinNT50 = 3
}
/// <summary>
/// The type of logon operation to perform.
/// </summary>
internal enum SecurityImpersonationLevel : int
{
/// <summary>
/// The server process cannot obtain identification information
/// about the client, and it cannot impersonate the client. It is
/// defined with no value given, and thus, by ANSI C rules,
/// defaults to a value of zero.
/// </summary>
Anonymous = 0,
/// <summary>
/// The server process can obtain information about the client,
/// such as security identifiers and privileges, but it cannot
/// impersonate the client. This is useful for servers that export
/// their own objects, for example, database products that export
/// tables and views. Using the retrieved client-security
/// information, the server can make access-validation decisions
/// without being able to use other services that are using the
/// client's security context.
/// </summary>
Identification = 1,
/// <summary>
/// The server process can impersonate the client's security
/// context on its local system. The server cannot impersonate the
/// client on remote systems.
/// </summary>
Impersonation = 2,
/// <summary>
/// The server process can impersonate the client's security
/// context on remote systems.
/// NOTE: Windows NT: This impersonation level is not supported.
/// </summary>
Delegation = 3
}
/// <summary>
/// Logs on the user.
/// </summary>
/// <param name="userName">Name of the user.</param>
/// <param name="domain">The domain.</param>
/// <param name="password">The password.</param>
/// <param name="logonType">Type of the logon.</param>
/// <param name="logonProvider">The logon provider.</param>
/// <param name="token">The token.</param>
/// <returns>True if the function succeeds, false if the function fails.
/// To get extended error information, call GetLastError.</returns>
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool LogonUser(
string userName,
string domain,
string password,
LogonType logonType,
LogonProvider logonProvider,
out IntPtr token);
/// <summary>
/// Duplicates the token.
/// </summary>
/// <param name="existingTokenHandle">The existing token
/// handle.</param>
/// <param name="securityImpersonationLevel">The security impersonation
/// level.</param>
/// <param name="duplicateTokenHandle">The duplicate token
/// handle.</param>
/// <returns>True if the function succeeds, false if the function fails.
/// To get extended error information, call GetLastError.</returns>
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool DuplicateToken(
IntPtr existingTokenHandle,
SecurityImpersonationLevel securityImpersonationLevel,
out IntPtr duplicateTokenHandle);
/// <summary>
/// Closes the handle.
/// </summary>
/// <param name="handle">The handle.</param>
/// <returns>True if the function succeeds, false if the function fails.
/// To get extended error information, call GetLastError.</returns>
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool CloseHandle(IntPtr handle);
}
以下是代码中使用的实现。
IntPtr token;
if (!NativeMethods.LogonUser(
this.userName,
this.domain,
this.password,
NativeMethods.LogonType.NewCredentials,
NativeMethods.LogonProvider.Default,
out token))
{
throw new Win32Exception();
}
try
{
IntPtr tokenDuplicate;
if (!NativeMethods.DuplicateToken(
token,
NativeMethods.SecurityImpersonationLevel.Impersonation,
out tokenDuplicate))
{
throw new Win32Exception();
}
try
{
using (WindowsImpersonationContext impersonationContext =
new WindowsIdentity(tokenDuplicate).Impersonate())
{
//Copy your file to the windows directory here.
impersonationContext.Undo();
return;
}
}
finally
{
if (tokenDuplicate != IntPtr.Zero)
{
if (!NativeMethods.CloseHandle(tokenDuplicate))
{
// Uncomment if you need to know this case.
////throw new Win32Exception();
}
}
}
}
finally
{
if (token != IntPtr.Zero)
{
if (!NativeMethods.CloseHandle(token))
{
// Uncomment if you need to know this case.
////throw new Win32Exception();
}
}
}
答案 1 :(得分：3)
正如其他人所说，你的解决方法打破了几个最佳实践，并且“只需要立即完成”是历史已经证明打破最佳实践的好时机。所以你应该先做一些建议：
这至少可以保证一年后的某个人不会偶然发现该程序，并且无处不在。现在有了这样的程序，它可能只需要一天，但已经指出安全性与这样的事情是徒劳的。
鉴于此，我找到了post talking about a breaking change in LogonUser。它要求更改您的DllImport代码：
[DllImport("advapi32.dll", SetLastError = true)]
private extern static bool LogonUser(
string pszUsername, string pszDomain, string pszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
要：
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
public static extern bool LogonUser(String lpszUsername, String lpszDomain,
String lpszPassword, int dwLogonType, int dwLogonProvider,
out SafeTokenHandle phToken);
看看是否能够解决“仅适用于Windows XP”问题。
现在您已经找到了编程问题的解决方案，您真的需要与您的公司讨论，找出您的公司政策为什么要将您的IT部门破坏到部署新壁纸需要2个月的时间。这些问题可能会恶化到不能再修复不良做法的程度，因为这样做的时间表是如此。 （哦，服务帐户有一个三年前的密码，是一个域管理员，修好它需要大量的文书工作......）