Re: Can't copy/rename file using CreateProcessWithLogonW, ImpersonateLoggedOnUser and LogonUser

Tech-Archive recommends: Fix windows errors by optimizing your registry

"TC" <aatcbbtccctc@xxxxxxxxx> wrote in message
news:1117956640.888740.129410@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>
> Sam Hobbs wrote:
>> If the programs you have written are executed without Administrator
>> priviliges then it makes sense that they can't get Administrator
>> priviliges.
>> Use of CreateProcessWithLogonW to grant higher privileges should not work
>> either. If any of that did work, it would be a huge violation of the
>> purpose
>> of security.
>
>
> Nonsense.
>
> I can't speak for the APIs in question, as I have never used them.
>
> But there is absolutely nothing wrong, in principle, with a program
> acquiring higher priviliges, at runtime, if it can provide the
> creditials of a suitable higher-priviliged user.


Actually, there is a restriction that contradicts your "in principle". The
user trying to acquire the higher privileges needs the "Impersonate a user
after logon / impersonate a client after logon" privilege (W2K SP4, XP SP2,
W2K3). Without that, all attempts will be rejected. By default, only
administrators have this privilege. That is, a user can only increase his
privileges if he has the privilege to do so, in addition to having and/or
knowing the credentials.

>
> HTH,
> TC
>


.

Relevant Pages