Impersonating and CreateProcess

Question

The document states CreateProcess create a process running under the calling process's security context, not the current impersonating token's security context. Does this mean the permission for the new process will be the same regardless impersonating or not?

I have the following code that fails with ACCESS_DENIED error:

1. Process A runs under administrator;
2. Process A impersonates a normal user “test”;
3. Process A starts a new process B by calling CreateProcess;
4. Process B calls OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, ..);

Step 4 fails with ACCESS_DENIED error (5). I checked process B is running under Administrator as process A. Why would it fail when it's running under the same user context as process A?

Answer 1

As a commenter said, you want CreateProcessAsUser. You might find the following sample code on MSDN helpful, I used it with success a few years ago: http://support.microsoft.com/kb/165194