Impersonating a user as LocalSystem on Windows

2
votes

I have a process that runs as LocalSystem on Windows XP and following. I am trying to find a way to have it start another process impersonating another user without having to provide the user password.

In principle this should be possible as LocalSystem has the privilege "Act as part of the operating system". But I am unable to find the correct API.

Can somebody tell me how to do this either:

  • with an API, or
  • from a batch file?
1
windowswinapiimpersonationprivileges

1 Answers

2
votes

You can do it by first getting the token of the user via WTSQueryUserToken, then calling CreateProcessAsUser to start the process. Note that you can only do this for a user who is currently logged-in in the system.