Strategy for Process.Start and Impersonation

Hello 😃

I am trying to start a process with different rights from the inside of an windows service.

If i impersonate like this:

Impersonation.RunAsUser(credentials, LogonType.Interactive, () => {
                      ProcessStartInfo info = new ProcessStartInfo(cmd_name, parameters);

                    info.UseShellExecute = false;
                    info.CreateNoWindow = true;
                    info.RedirectStandardOutput = true;
                    console.StartInfo = info;
                    console.Start();

                    message = console.StandardOutput.ReadToEnd();
                    });

the process will still run as local system. If i set the Credentials also in the ProcessStartInfo Class, i get an Access Denied.

Currently i am using an implementation of the native call “CreateProcessAsUserW” but i was looking for an working solution with the Process Class of .NET

Thank you 😃

[mattjohnsonpint]

I did some research on this, and I believe that the ProcessStartInfo approach will not work in any case - regardless of the execution context - because you are running inside a Windows Service. All docs and blogs point at CreateProcessAsUser, so I would continue that approach.

I may consider adding another method to this library in the future, such as Impersonation.StartProcessAsUser which would make the appropriate calls (either through ProcessStartInfo or CreateProcessAsUser depending on environment). I’ll leave this issue open to remind me.

[PatrickSchmidtSE]

Thank you for your fast answer 😃 That would be a great addition to your library and make it even more powerful!

Just as an addition as i also ran in those issues… Simply starting the process over the CreateProcessAsUser method is not that hard, but mostly if users start processes they also want to access stdin/stdout and react to it. This is a little bit more difficult, because you need to create pipes.

I dont know if you want to handle that too, but just as feedback, that in this case, stdin/stdout handling is a often needed use case 😃