RE: Performance of RevertToSelf and ImpersonateLoggedOnUser

Hi Charles ,

I have checked the source code of ImpersonateLoggedOnUser and RevertToSelf.
In user-mode, they merely get the handle to the token and invoke
ntdll!NtSetInformationThread to interrupt to kernel-mode. I did not check
the corresponding source code in kernel-mode, but I assume it will change
the impersonation information and access token pointer in ETHREAD/EPROCESS
structure to use the passed token. So I do not think there is any big
performance issue in using these 2 APIs.

In your scenario, another solution may be spawning a second thread to do
the impersonation and access the database while leaving the main thread to
access the local files with process token. This will eliminate your need to
switch the token back and forth.

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

.

Relevant Pages

  • RE: Impersonation and remote registry access
    ... Reading "App Lockdown", I found that remote registry uses named pipes. ... I'm confident (from examining the thread token during impersonation) that ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)
  • Re: Cross VPN Domain Authentication
    ... How to implement impersonation in an ASP.NET application ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.sqlserver.security)
  • Re: Howto refresh IIS 6 Application pool identity credential info
    ... How to implement impersonation in an ASP.NET application ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.inetserver.iis.security)
  • Re: How can I modify the user rigths on a xml file?
    ... Do you mean that you wanted to allow a user in normal Users group to be ... To perform impersonation in .Net, you may first p/invoke LogonUser Win32 ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Difference between base address of kernel modules and their image address
    ... in kernel-mode, the OS kernel will dynamically relocated. ... Windows normally use two modes of the modern CPU: ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.win32.programmer.kernel)
Quantcast