create user and add to admin group under local system

[Philip Wagenaar]

Can a windows service running under the local system account create users
and add them to the administrators group?

When I try to do this and try to use process.start with the user created I
receive access denied.

When I change the windows service to and administrator account, I receive
the error:

cmd.exe - application error
The application failed to initialize properly (0xc0000142). Click on OK to
terminate the application.

I get this error no matter what .exe I try to open with process.start.

[Peter Huang [MSFT]]

Hi Philip,

Currently I am looking for somebody who could help you on it. We will reply
here with more information as soon as possible.
If you have any more concerns on it, please feel free to post here.
Thanks for your understanding!

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.

[Peter Huang [MSFT]]

Hi Philip,

Based on my research, to create a process and run it as another user
account in a windows service is not trivial.
We need to do many security related tuning which is hard to do in the .NET.
Here is a sample in C++ for your reference.
Starting an Interactive Client Process in C++
http://msdn.microsoft.com/library/de...us/secauthz/se
curity/starting_an_interactive_client_process_in_c__.asp

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.

[Philip Wagenaar]

Bummer.

I need to print a pcl file under an user account I create on the fly. And if
possbile put all this in a window service.

Any ideas on how to accomplish this other then the way I am trying?

""Peter Huang" [MSFT]" wrote:

Hi Philip,

Based on my research, to create a process and run it as another user
account in a windows service is not trivial.
We need to do many security related tuning which is hard to do in the .NET.
Here is a sample in C++ for your reference.
Starting an Interactive Client Process in C++
http://msdn.microsoft.com/library/de...us/secauthz/se
curity/starting_an_interactive_client_process_in_c__.asp

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.

[Peter Huang [MSFT]]

Hi Philip,

Based on my reviewing, it seems that in another post from you, you have
done this in a winform. If I have any concern, please feel free to post
here.
As for how to do that in a windows service, it is hard to do that in a dot
net application, because we need to call unmanaged code to tuning the
security setting as I mentioned in my last post.

If you have detailed concern about the C++ security sample, please post in
the security newsgroup.
microsoft.public.platformsdk.security

Thanks for your understanding!

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.