ImpersonateLoggedOnUser is successful but secondary process is still run in the initial context

Question

I have an installer that tries to (re)start my application in the current user context after the installation is done. The installer runs in the SYSTEM context and before launching the application it attempts (and theoretically succeeds) to impersonate the current user. However, when I look in the task manager, I see that my application is running in the SYSTEM context.

This is (a snippet from) my code:

    TCHAR szUsername[128] = _T("");
    DWORD dwUsernameSize = 128;
    GetUserName(szUsername, &dwUsernameSize);

    // Lets the calling process impersonate the security context of a logged-on user.
    if (!ImpersonateLoggedOnUser(hToken))
    {
        throw Win32Exception(GetLastError(), _T("Failed to impersonate current user"));
    }

    TCHAR szUsername2[128] = _T("");
    DWORD dwUsernameSize2 = 128;
    GetUserName(szUsername2, &dwUsernameSize2);

    MLOGD(_T("ProcessUtils::StartProcessInCurrentUserContext: Successfully impersonated %s"), szUsername2);

    ProcessUtils::StartProcess(sExeName, lstParams, sWorkingDir, bWaitToFinish, errCode);

ProcessUtils::StartProcess is a wrapper around CreateProcess.

szUsername contains SYSTEM and szUsername2 contains the current user. So ImpersonateLoggedOnUser is successful. However, as mentioned above, the process is started in the SYSTEM context, not the current user one.

I'm not sure how helpful this might be, but my installer is written in NSIS and it's calling the function that contains the code from above via a plugin written in C/C++.

Does anyone know why my application doesn't start in the current user context?

Answer 1

Win32 CreateProcess creates a process in the same security context as the caller which is SYSTEM (even though you are impersonating).

Think you need to be calling CreateProcessAsUser.