Creating a process as a normal user without password (Linux 'su' for Windows 7?)

[stringZ]

Hey there,

Does anyone know if there's a library or tool which could create a process as a normal user that has empty password. The situation is the following. My application runs with full administrative credentials (as a Windows service) under a LUA-enabled Windows 7. There are normal users (with limited rights) who are logged on locally (has their desktop shown), they can open applications (run processes) by double-clicking icons or from the command-line. I would like my service to create a process impersonating one of these logged on users. These users don't and won't have password, so Win32::AdminMisc::CreateProcessAsUser() is not an option since it requires LogonAsUser() which fails to impersonate a user with empty password. Running an application as a different user is also impossible with the command-line tool RUNAS. I understand this is for security reasons, but a network service should be able to somehow bypass this. So I'm looking for a solution similar to the su (or login -f) command under Linux. It doesn't require a password if you're root. My network service has elevated rights over the normal users I want it to impersonate.
Is there any solution or API call?

I have an older thread in which I asked about creating a process with elevated privileges using the Windows API.
One of the answers I got suggested using Win32::FileOp::ShellExecute(). Its syntax is the following:

Win32::FileOp::ShellExecute( runas => 'theProgram.exe' )

You can replace the string runas by open, in this case it won't elevate, but run theProgram.exe as the current user. Jenda, who wrote me this answer, noted that I can use runasuser instead of runas, but I don't understand how it would fit in this syntax. Is it possible with ShellExecute()?

If there is no solution with my configuration, is there any if I disable LUA (still need to run as another user)?

Thank you,
stringZ

[Jenda]

Win32::FileOp::ShellExecute( runasuser => 'theProgram.exe' );

It will not let you specify the user to run the program under, it just displays a dialog box asking you to enter the credentials.

There is no way to pass the username&password to the ShellExecute API function. There is no way even with the ShellExecuteEx.

Seems you would need to call the CreateProcessAsUser function. It used to be available via Win32::AdminMisc, but you could call it yourself using Win32::API. Another option is to run the process through the "runas" utility. Run "runas /?" in the command prompt.

[cavac]

As for the security problems of the windows service: Did you try to enable "Allow service to interact with desktop" in the services properties?

As long as the users are logged on, you could also run a system tray application on the users desktop which interacts with the service.

[afoken]

As long as the users are logged on, you could also run a system tray application on the users desktop which interacts with the service.

I think that's also the way officially proposed by Microsoft: Write a privileged background service and use a dedicated application running in the context of an ordinary user for the user interface. Windows offers serveral ways for IPC between the two processes. Named pipes and IP sockets (via localhost) are commonly used.

To start an unprivileged process running under the user account, the service process simply sends a message to the user interface process, containing all required information.

And to start the unprivileged user interface process, use one of the various autostart mechanisms. Creating a shortcut in the Autostart group of the start menu is a very simple way, other ways need some registry editing.

Alexander