CreateProcessAsUser "loses" privileges, why?

Hello everyone,

I have a service (running in SYSTEM) that impersonates a client at a
server end of a named pipe. The client is a local administrator and has
the SE_DEBUG_NAME privilege granted. If I duplicate the impersonation
token in the service to make it a primary token and use it to create a
new process using CreateProcessAsUser, the SE_DEBUG_NAME privilege is
gone, i.e. I cannot even enable it anymore. Why is that? What can I do
to create a process with CPAU from the service running as the
impersonated user with the full set of privileges that the client has?
Note that this is not a restricted token that I create, it is just a
primary token created from an impersonation token, everything happens on
the same machine.

I can successfully enable the SE_DEBUG_NAME privilege within the service
using the primary token but somehow the process started via CPAU doesn't
get it and cannot enable it either.

Any help appreciated,

--
S
.

Relevant Pages

  • CreateProcessAsUser "loses" privileges, why?
    ... The client is a local administrator and has ... the SE_DEBUG_NAME privilege granted. ... primary token created from an impersonation token, ... using the primary token but somehow the process started via CPAU doesn't ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Application Flow / security issues
    ... impersonation and makes it possible for the server process to access remote ... resources while acting as the client." ... because i assume the root of this problem is the application pool. ... You can set impersonation in the web.config. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: IWbemConfigureRefresher->AddEnum & AddObjectByPath return WBEM_E_ACCESS_DENIED
    ... and your process receives calls from external client. ... >From the point of view of the RPC binding handle, a leaked impersonation ... Do you smuggle Interface pointers from apartment to apartment? ... both the COM server process (that is getting the ...
    (microsoft.public.win32.programmer.wmi)
  • Re: CreateProcessAsUser "loses" privileges, why?
    ... The client is a local administrator and has ... > the SE_DEBUG_NAME privilege granted. ... > primary token created from an impersonation token, ... > using the primary token but somehow the process started via CPAU doesn't ...
    (microsoft.public.win32.programmer.kernel)
  • passing impersonation token to out-of-proc COM server
    ... The client application uses LogonUser and ImpersonateLoggedOnUser to ... COM server uses CoImpersonateClient to change identity. ... Has anyone an idea on how to pass impersonation ...
    (microsoft.public.win2000.security)