Re: CreateProcessAsUser "loses" privileges, why?

Tech-Archive recommends: Speed Up your PC by fixing your registry

Is the SeDebugPrivilege enabled or not before the CreateProcessAsUser call ?
You can use `!token <handle>` in a recent cdb/ntsd/windbg debugger to see
that.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


"Stefan Kuhr" <kustt110@xxxxxx> wrote in message
news:426974FB.2D2B229D@xxxxxxxxx
> Hello everyone,
>
> Stefan Kuhr wrote:
> >
> > <snip>
> > You also mention "the OSF code path" as opposed to LRPC. What is meant
> > with OSF? Does OSF mean all other RPC transports different to ncalrpc,
> > such as named pipes, sockets or whatever else, or does OSF mean "DCE RPC
> > without MS additions" (Open Software Foundation)?
>
> Just read this (from one of Ivan's postings): "...if the transport is
> LRPC, then all the privileges non enabled on the client token will be
> stripped before the token is ever seen by the server. if the transport
> is OSF (named pipes and Tcp), then all the privileges (enabled or not
> enabled) of the client token will be moved to the server side..""
>
> So OSF means "anything but LRPC" (is this MS specific terminology?). And
> it explains why my named pipe server end has the SE_DEBUG_NAME privilege
> assigned in the impersonation token. But it does not explain why the
> process started with CPAU with that token doesn't have the SE_DEBUG_NAME
> privilege assigned at all. Why is that the case?
>
> --
> Stefan


.

Relevant Pages

  • Re: CreateProcessAsUser "loses" privileges, why?
    ... > You can google for "non enabled privileges are stripped" in the `groups` ... but with the client and server side all on the ... You also mention "the OSF code path" as opposed to LRPC. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: CreateProcessAsUser "loses" privileges, why?
    ... You also mention "the OSF code path" as opposed to LRPC. ... Just read this: "...if the transport is ... then all the privileges non enabled on the client token will be ...
    (microsoft.public.win32.programmer.kernel)
  • Re: CreateProcessAsUser "loses" privileges, why?
    ... Stefan Kuhr wrote: ... > You also mention "the OSF code path" as opposed to LRPC. ... LRPC, then all the privileges non enabled on the client token will be ...
    (microsoft.public.win32.programmer.kernel)