Hi !
I must build a service which will launch applications with elevated
privileges in a given Windows session. I think I will use a pipe in
order to allow applications to "ask" the service to run a specific
process. My goal is to have something like this :
+ John runs application X in the context of a "standard" Windows
session, and the application asks the service through the pipe to run a
given process.
+ The service receive the request, and must run the process with its
rights *in the caller's session context* (i.e. John have to see the
application starting on its screen !)
The problem is how to use the "caller's session context" from the
service application. Which API should I use in order to make the program
appears on the caller's session screen form the service ? After reading
MSDN, my first thought is I should include the value of
GetProcessWindowStation() (called from the application X) in the
request, then the service would reuse it and call
SetProcessWindowStation(), maybe OpenDesktop(), then CreateProcess(). Is
it the right way to do this ? Should I use other impersonation functions
or duplicate tokens ?...
Another question : if I use a such mechanism, what happens if the
session is opened via Remote Desktop (unsing the Windows Terminal
Services) ? If Mark and John opens the same session remotely (for
instance the "Administrator" one) and user John asks the service to run
a process in its session, what happens ? Just John will see the
application (good !), or both of them will see it as they "share" the
same Windows session ? So should I also use WTS functions like
WTSGetActiveConsoleSessionId() in the service app ?...
Any hint appreciated, and sorry for my approximate English.
TIA
-- rabz
