Windows background service (system profile) is UNABLE to access user appData folder on win 10 using C++?

Question

Wondering if Windows background service (system profile) is UNABLE to access user appData folder on win 10 using C++ ? It seems Windows service does not load user profile by default as links below and wondering if it is same as win 10.

• .net windows service local application data is different then in normal app
• https://social.msdn.microsoft.com/Forums/windows/en-US/0e8892b2-a9ce-446d-a8ee-c37c0a217ddd/not-able-to-get-user-s-app-data-folder-when-using-windows-service?forum=winforms
• AppData\\Roaming folder in windows service project

Thanks

Answer 1

The SYSTEM account has full access to the local machine, so of course it can access any user's AppData folder. The trick will be in obtaining the path to a given user's AppData folder in the first place.

APIs exist for the very purpose of obtaining user-related folder paths, see SHGetFolderPath() and SHGetKnownFolderPath() , both of which take a user token as input. Services run in a separate session from users, and the SYSTEM account has its own profile in the Registry, so you can't use anything that depends on HKEY_CURRENT_USER of the calling process to query the paths, as it will query the SYSTEM 's paths, not a user's paths. You need to obtain the token of the desired user you want to query.

If the target user is logged in, you can use WTSQueryUserToken() to get the user's token. You just need the user's session ID, which you can get from ProcessIdToSessionId() for any process running on the user's session, or you can use WTSEnumerateSessions() and WTSQuerySessionInformation() to find the session containing the desired user's login info (if there is more than 1 user logged in), or you can use WTSGetActiveConsoleSessionId() to get the session that is logged in and currently attached to the physical keyboard/mouse/monitor.

If the target user is not logged in, but you have the user's credentials, you can use LogonUser() to get the user's token. You can then use LoadUserProfile() to access the user's HKEY_CURRENT_USER Registry hive and query the "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" subkey directly.

Otherwise, you are pretty such SOL, unless you happen to know the user's SID, in which case you can enumerate the HKEY_USERS Registry hive looking for that SID, and then you can query the "\\<SID>\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" subkey directly.