Search code examples
c++windowsserviceimpersonationprivileges

Calling OpenWindowStation from a service running under a "user" account

My service start an interactive client process with something really similar to this: https://msdn.microsoft.com/en-us/library/windows/desktop/aa379608(v=vs.85).aspx

It works when the service Log On as Local System, and it work if it's running under an Administrator account with the SE_ASSIGNPRIMARYTOKEN_NAME and SE_INCREASE_QUOTA_NAME privileges.

My issue is when using a Standard User account OR Local Service, it fails at OpenWindowStation with error code 5 (ACCESS DENIED).

// Get a handle to the interactive window station.
hwinsta = OpenWindowStation(_T("winsta0"),               // the interactive window station 
                            FALSE,                       // handle is not inheritable
                            READ_CONTROL | WRITE_DAC);   // rights to read/write the DACL

Is it possible to call OpenWindowStation from a Standard User account or my service must run under an Administrator account? I tried almost all Local Policies without success

Thanks!

Solution

  • Unfortunately it can't be done, it seems that only an Administrator can open the interactive station.