Reading keys from HKEY_CURRENT_US ER from an impersonated Web Service

[Simon Hart]

Hi,

I am using Impersonation and turned off anon access for my web service. I am
using the administator to authenticate the request using ICredentials. I am
simply trying to read a key in HKEY_CURRENT_US ER from my Web Service method
call which I am unable to. When I try and open it it returns null. Even
iterating all keys under HKEY_CURRENT_US ER only returns a handful of keys.

I can happily read any key under HKEY_LOCAL_MACH INE. I have checked the
identity of the user and it is definately running under the local
administrator.

Any ideas what to check would be great.
Regards
Simon Hart.

[Simon Hart]

Thank you for your very valued input Willy.

I think what I will probebly do is call a out-of-process COM object that
will return me the path of a key that I need to read.
Then of course terminate the COM object.

Regards
Simon.

"Willy Denoyette [MVP]" <wi************ *@telenet.be> wrote in message
news:eo******** ******@TK2MSFTN GP12.phx.gbl...

Yes, impersonating does not load the profile of the impersonated user.
Only
"accounts" that are logged in interactively (called an interactive
session)
have their profiles loaded by the Winlogon process. If you need to load a
profile for a specific user, you'll have to load it yourself by calling
LoadUserProfile Win32 API via PInvoke, but this can become extremely
expensive (in terms of speed and space) in Web services where you need to
impersonate different users, and it's extremely unsafe to load a users
profile in the context of a webservice, user profiles can hold private
secured info of a user that is supposed to run in an interactive session
only!
Really, services (all kind) should not rely on the presence of a specific
user profiles.
Willy.


"Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
news:uJ******** ******@TK2MSFTN GP12.phx.gbl...
| Hi Willy,
|
| Is this true even though impersonation is used? and the user is
| authenticated correctly?
|
| Regards
| Simon.
| "Willy Denoyette [MVP]" <wi************ *@telenet.be> wrote in message
| news:OP******** *****@TK2MSFTNG P09.phx.gbl...
| > Ignacio is right, web services or web applications do load a profile,
the
| > HKCU is pointing to the default profile of the IIS user ('localsystem'
for
| > IIS5.x or 'network user' for IIS6). That means that HKCU is mapped to
| > HKU\.default on XP/W2K or HKU\S-1-5-19 on W2K3.
| >
| > Willy.
| >
| >
| > "Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
| > news:ul******** ********@TK2MSF TNGP09.phx.gbl. ..
| > | Hi,
| > |
| > | I thought this *might* be the case. When I check the user identity
using
| > | WindowsIdentity class, the user is the local Administrator account.
The
| > key
| > | was installed via an install set which was installed under the local
| > | Administrator account.
| > |
| > | How do I do a real impersonate then, is it not possible to read a
| > | *non-windows* key in HKEY_CURRENT_US ER via a Web service?
| > |
| > | I know this works if running under a Serviced Component. What I
might
| > have
| > | to do as a work around, is hand off control to the Serviced
Component
to
| > do
| > | the work, reading registry etc.
| > |
| > | Florida - what a fine place btw - I learned to skydive there in 2004
at
| > | DeLand.
| > |
| > | Cheers
| > | Simon.
| > |
| > | "Ignacio Machin ( .NET/ C# MVP )" <ignacio.mach in AT
dot.state.fl.us >
| > wrote
| > | in message news:uQ******** ******@TK2MSFTN GP09.phx.gbl...
| > | > Hi,
| > | >
| > | > IIRC CURRENT_USER refer to the user currently logged in the
computer
,
| > | > your service does not has this info associated
| > | >
| > | >
| > | > --
| > | > Ignacio Machin,
| > | > ignacio.machin AT dot.state.fl.us
| > | > Florida Department Of Transportation
| > | >
| > | > "Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
| > | > news:ep******** ******@TK2MSFTN GP14.phx.gbl...
| > | >> Hi,
| > | >>
| > | >> I am using Impersonation and turned off anon access for my web
| > service.
| > I
| > | >> am
| > | >> using the administator to authenticate the request using
| > ICredentials.
| > I
| > | >> am
| > | >> simply trying to read a key in HKEY_CURRENT_US ER from my Web
Service
| > | >> method
| > | >> call which I am unable to. When I try and open it it returns
null.
| > Even
| > | >> iterating all keys under HKEY_CURRENT_US ER only returns a handful
of
| > | >> keys.
| > | >>
| > | >> I can happily read any key under HKEY_LOCAL_MACH INE. I have
checked
| > the
| > | >> identity of the user and it is definately running under the local
| > | >> administrator.
| > | >>
| > | >> Any ideas what to check would be great.
| > | >> Regards
| > | >> Simon Hart.
| > | >>
| > | >>
| > | >
| > | >
| > |
| > |
| >
| >
|
|

[Simon Hart]

This would never work as it would need to be called from a Web Service so
the process would run under ASPNET user account regardless of if
impersonation is used.

Furthermore C# does not support out-of-process COM object so it would have
to have been developed in native code.

I have got the developer to change where the registry settings will be
stored. They will now be stored in HKEY_LOCAL_MACH INE.

Regards and thanks for all your help.
Simon.

"Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
news:uZ******** ******@TK2MSFTN GP09.phx.gbl...

Thank you for your very valued input Willy.

I think what I will probebly do is call a out-of-process COM object that
will return me the path of a key that I need to read.
Then of course terminate the COM object.

Regards
Simon.

"Willy Denoyette [MVP]" <wi************ *@telenet.be> wrote in message
news:eo******** ******@TK2MSFTN GP12.phx.gbl...

Yes, impersonating does not load the profile of the impersonated user.
Only
"accounts" that are logged in interactively (called an interactive
session)
have their profiles loaded by the Winlogon process. If you need to load a
profile for a specific user, you'll have to load it yourself by calling
LoadUserProfile Win32 API via PInvoke, but this can become extremely
expensive (in terms of speed and space) in Web services where you need to
impersonate different users, and it's extremely unsafe to load a users
profile in the context of a webservice, user profiles can hold private
secured info of a user that is supposed to run in an interactive session
only!
Really, services (all kind) should not rely on the presence of a specific
user profiles.
Willy.


"Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
news:uJ******** ******@TK2MSFTN GP12.phx.gbl...
| Hi Willy,
|
| Is this true even though impersonation is used? and the user is
| authenticated correctly?
|
| Regards
| Simon.
| "Willy Denoyette [MVP]" <wi************ *@telenet.be> wrote in message
| news:OP******** *****@TK2MSFTNG P09.phx.gbl...
| > Ignacio is right, web services or web applications do load a profile,
the
| > HKCU is pointing to the default profile of the IIS user
('localsystem'
for
| > IIS5.x or 'network user' for IIS6). That means that HKCU is mapped to
| > HKU\.default on XP/W2K or HKU\S-1-5-19 on W2K3.
| >
| > Willy.
| >
| >
| > "Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
| > news:ul******** ********@TK2MSF TNGP09.phx.gbl. ..
| > | Hi,
| > |
| > | I thought this *might* be the case. When I check the user identity
using
| > | WindowsIdentity class, the user is the local Administrator account.
The
| > key
| > | was installed via an install set which was installed under the
local
| > | Administrator account.
| > |
| > | How do I do a real impersonate then, is it not possible to read a
| > | *non-windows* key in HKEY_CURRENT_US ER via a Web service?
| > |
| > | I know this works if running under a Serviced Component. What I
might
| > have
| > | to do as a work around, is hand off control to the Serviced
Component
to
| > do
| > | the work, reading registry etc.
| > |
| > | Florida - what a fine place btw - I learned to skydive there in
2004
at
| > | DeLand.
| > |
| > | Cheers
| > | Simon.
| > |
| > | "Ignacio Machin ( .NET/ C# MVP )" <ignacio.mach in AT
dot.state.fl.us >
| > wrote
| > | in message news:uQ******** ******@TK2MSFTN GP09.phx.gbl...
| > | > Hi,
| > | >
| > | > IIRC CURRENT_USER refer to the user currently logged in the
computer
,
| > | > your service does not has this info associated
| > | >
| > | >
| > | > --
| > | > Ignacio Machin,
| > | > ignacio.machin AT dot.state.fl.us
| > | > Florida Department Of Transportation
| > | >
| > | > "Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
| > | > news:ep******** ******@TK2MSFTN GP14.phx.gbl...
| > | >> Hi,
| > | >>
| > | >> I am using Impersonation and turned off anon access for my web
| > service.
| > I
| > | >> am
| > | >> using the administator to authenticate the request using
| > ICredentials.
| > I
| > | >> am
| > | >> simply trying to read a key in HKEY_CURRENT_US ER from my Web
Service
| > | >> method
| > | >> call which I am unable to. When I try and open it it returns
null.
| > Even
| > | >> iterating all keys under HKEY_CURRENT_US ER only returns a
handful
of
| > | >> keys.
| > | >>
| > | >> I can happily read any key under HKEY_LOCAL_MACH INE. I have
checked
| > the
| > | >> identity of the user and it is definately running under the
local
| > | >> administrator.
| > | >>
| > | >> Any ideas what to check would be great.
| > | >> Regards
| > | >> Simon Hart.
| > | >>
| > | >>
| > | >
| > | >
| > |
| > |
| >
| >
|
|

[Willy Denoyette [MVP]]

"Simon Hart" <srhartone@[no spam]yahoo.com> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..
| This would never work as it would need to be called from a Web Service so
| the process would run under ASPNET user account regardless of if
| impersonation is used.
|
| Furthermore C# does not support out-of-process COM object so it would have
| to have been developed in native code.
|

COM+ is made for this, drop your class ,derived from ComponentServic es, in a
server type COM+ application and run this one as a local user.

Willy.