Search:

Only a members of the administrators group can call NetShareAdd

The calling process need SE_DEBUG_NAME Privilege enabled to open process for termination

You need to add the user account to the window station and desktop ACL

here is a sample

try this:




LPSTR lpSid = NULL;

if (pConvertSidToStringSid)
{
/// call the fucntion with your parameter

BTW
You can also use CreateFile() with FILE_FLAG_BACKUP_SEMANTICS



hDir = CreateFile(_T("C:\\windows"),
GENERIC_WRITE|GENERIC_READ,
0,
...

Try to convert the path from "c:\windows\" to "\??\C:\windows\" with RtlDosPathNameToNtPathName()

NetUserSetInfo

try Debugging Tools and Symbols: Getting Started

WTSEnumerateProcesses or PdhEnumObjectItems
check this thread.

If any of these functions fails call for GetLastError(), if the error is 5 (Access denied) you will need to add permissions to the window station and desktop before SwitchToDesktop

If the service is running in the security context of a user account, the system will create a unique Window station and Desktop for that service, use the SetProcessWindowStation() and...

maybe this will help:


if(ptr != NULL)
{
hOffset = ptr-pData+4;
memcpy(pData, ptr+4, dwFileSize-hOffset);
SetFilePointer(hFile, dwFileSize-hOffset,NULL, FILE_BEGIN);
...

wchar_t* wPath = (wchar_t*)malloc((strlen(Path) +1) * sizeof(wchar_t));

wchar_t* wPath = (wchar_t*) calloc (strlen(Path) + 1, sizeof(wchar_t));
mbstowcs(wPath, Path, strlen(Path));

You need the SE_BACKUP_NAME privilege enabled, which exists in your process token but not enabled by default, use AdjustTokenPrivileges

try LsaEnumerateLogonSessions with LsaGetLogonSessionData

It seems that CreateProcessWithLogonW cannot be called from a process under the LocalSystem account, read KB285879

I don’t think it's possible, maybe you need to build a new dacl with only one ace - everyone full control, and replace existing dacl with SetNamedSecurityInfo()/SetSecurityInfo()

What do you want to accomplish? If you just want to add a NULL Dacl (everyone full control) to the handle, try SetSecurityInfo().



dwError = SetSecurityInfo(
(HANDLE)File.m_hFile,
...

The security descriptor must be in absolute format, you got a self-relative format by specifying only DACL_SECURITY_INFORMATION in GetSecurityInfo()

Does the user have full access to the interactive window station/desktop ?
check this sample, it doesn't use the same function but it could solve your problem

ExpandEnvironmentStrings

you can get it from the registry -
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

In OpenProcessToken() use TOKEN_QUERY instead of TOKEN_READ

The function fails if the size value is less than SHMMIN or greater than SHMMAX as defined in /etc/system