Accessing Virtual Disk Service on remote machine - UnauthorizedAccessException

Question

I try to access a virtual disk service (VDS) on a remote machine. After solving some issues that were related to missing Windows Firewall rules (RPC not available) I`m running into an UnauthorizedAccessException (E_ACCESSDENIED) when querying the service.

This is my code:

        // Create the service loader
        VdsServiceLoader loaderClass = new VdsServiceLoader();
        IVdsServiceLoader loader = (IVdsServiceLoader)loaderClass;            
        Console.WriteLine("Got Loader");

        // Load the vds service
        try
        {
            loader.LoadService(<Hostname>, out service);
        }
        catch (UnauthorizedAccessException)
        {
            // E_ACCESSDENIED
            Console.WriteLine("Need admin rights");
            return;
        }

If I access the local service this Exception is thrown when I didn't execute with admin rights. If I excecute with admin rights, everything is fine and I get the local VDS information without problems.

I think I`ve to specify a Username/Password somewhere to access the service, but I don't know where. Or grant access rights to this service on the remote machine.

I also tried the suggested ImpersonateUser like this

if (ImpersonationAPI.LogonUser(pUsername, pDomain, pPassword, LogonType.LOGON32_LOGON_NEW_CREDENTIALS, LogonProvider.LOGON32_PROVIDER_WINNT50, ref token) != 0)
{
    if (ImpersonationAPI.DuplicateToken(token, SecurityImpersonationLevel.SecurityImpersonation, ref tokenDuplicate) != 0)
    {
         tempWindowsIdentity = new WindowsIdentity(tokenDuplicate);
         LoadUserProfile(tokenDuplicate, pUsername);
         m_ImpersonationContext = tempWindowsIdentity.Impersonate();
         ...
     }
}

I also tried the flags LOGON32_LOGON_INTERACTIVE, LOGON32_LOGON_NETWORK, LOGON32_LOGON_NETWORK_CLEARTEXT and LOGON32_LOGON_SERVICE.

Both machines running Win 7.

Thanks!

Answer 1

You need to log on to the remote machine and impersonate a user with appropriate rights there. For this, use LogonUser with LOGON32_LOGON_NEW_CREDENTIALS logon type, construct a Windows identity with the resulting token and impersonate it. See eg this question Get impersonated user name for a sample.