CreateProcessAsUser未正确设置用户

Question

调用GUI应用程序

[DllImport(
    "advapi32.dll",
    EntryPoint = "CreateProcessAsUser",
    SetLastError = true,
    CharSet = CharSet.Ansi,
    CallingConvention = CallingConvention.StdCall)]
private static extern bool CreateProcessAsUser(
    IntPtr hToken,
    string lpApplicationName,
    string lpCommandLine,
    ref SECURITY_ATTRIBUTES lpProcessAttributes,
    ref SECURITY_ATTRIBUTES lpThreadAttributes,
    bool bInheritHandle,
    int dwCreationFlags,
    IntPtr lpEnvironment,
    string lpCurrentDirectory,
    ref STARTUPINFO lpStartupInfo,
    out PROCESS_INFORMATION lpProcessInformation);


bool result = CreateProcessAsUser(
    hUserTokenDup,
    null,
    applicationName + " " + arguments,
    ref sa,                 // pointer to process SECURITY_ATTRIBUTES
    ref sa,                 // pointer to thread SECURITY_ATTRIBUTES
    false,                  // handles are not inheritable
    NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE,        // creation flags
    IntPtr.Zero,            // pointer to new environment block 
    null,                   // name of current directory 
    ref si,                 // pointer to STARTUPINFO structure
    out procInfo);          // receives information about new process

从LocalSystem Windows工作。窗口在用户屏幕中弹出，但进程用户仍然是LocalSystem。有什么办法可以改变吗？

应PS的要求，我可以从hUserTokenDup获得

[DllImport("advapi32.dll", EntryPoint = "DuplicateTokenEx")]
private static extern bool DuplicateTokenEx(
    IntPtr ExistingTokenHandle,
    uint dwDesiredAccess,
    ref SECURITY_ATTRIBUTES lpThreadAttributes,
    int TokenType,
    int ImpersonationLevel,
    ref IntPtr DuplicateTokenHandle);

 DuplicateTokenEx(
     hPToken,
     MAXIMUM_ALLOWED,
     ref sa,
     (int)SECURITY_IMPERSONATION_LEVEL.SecurityIdentification,
     (int)TOKEN_TYPE.TokenPrimary,
     ref hUserTokenDup);

Answer 1

在我的服务中，我在调用WTSGetActiveConsoleSessionId()、WTSQueryUserToken()和DuplicationTokenEx()之前使用了CreateProcessAsUser()，这对我来说很好。派生进程在用户帐户中运行，而不是在服务帐户中运行。

Answer 2

看起来，与使用DuplicateTokenEx复制当前令牌不同，您需要调用LogonUser来获取表示目标用户的令牌。只需调用DuplicateTokenEx就可以为本地系统用户创建一个令牌。如果我正确理解你的代码片段。

另外，由于您要访问一个交互式用户，所以请考虑使用CreateProcessWithLogonW函数。