CreateProcessAsUser win api 在非 win7 平台上不起作用 [英] CreateProcessAsUser win api is not working on non win7 platforms

问题描述

我正在使用 win-api 函数:登录用户加载配置文件CreateProcessAsUser

i am using the win-api functions: logonUser loadProfile CreateProcessAsUser

使用 java 和 jniwrapper.

using java and jniwrapper.

我将我的应用程序作为服务进程(本地系统帐户)运行.

i run my application as service process (local system account).

如果我使用 CreateProcessWithLogon - 只有当我没有从服务中运行时它才有效(只是常规的独立应用程序).

if i am using the CreateProcessWithLogon - it works only if i am not running from service (just regular stand alone application).

该进程在 windows 7 上创建成功，但在 win xp 和 win 2003 服务器上没有.

the process created successfully on windows 7, and doesn't on win xp and win 2003 server.

你有什么线索吗?win平台如何管理进程/用户权限?

do you have any clue? how do i manage the process / user privileges on win platform?

谢谢....

推荐答案

Windows 处理服务的方式以及它们交互的方式在 NT 6.0 (Vista, Server 2003 R2) 周围发生了变化.它通常是一个复杂的主题，因为它涉及从应该是非交互式的东西创建流程，尤其是 UI.理解它通常需要充分了解什么是 Windows 上的会话、Winsta 和桌面.

They way windows deals with services and how they can interact changed around NT 6.0 (Vista, Server 2003 R2). It is usually a complicated subject, because it involves the creation of processes and especially UI from a something that is supposed to be non interactive. Making sense out of it often involves good knowledge of what is a Session, a Winsta and a Desktop on Windows.

此处记录了更改(名为会话 0 隔离"):http://msdn.microsoft.com/en-us/windows/hardware/gg463353.它指出从服务中显示 UI 的正确方法是使用 CreateProcessAsUser 生成一个新进程，但您已经知道，因为您的 Windows 7 机器运行.

The change (named "Session 0 isolation") is documented here: http://msdn.microsoft.com/en-us/windows/hardware/gg463353. It states that the correct way to display UI from a service is spawn a new process using CreateProcessAsUser, but you already knew that since your Windows 7 machine runs.

如果我没记错的话，CreateProcessAsUser 的行为也发生了变化:在以前的版本中，它没有自动将用户添加到 winsta 和桌面(它们是安全对象，即具有 ACL 的对象，如文件):

If I remember correctly, the behaviour of CreateProcessAsUser changed too: in previous versions, it did NOT added automatically the user to the winsta and desktop (which are securable objects, i.e. objects with an ACL, like files):

"如果应用程序在 lpDesktop 成员中指定了一个桌面，它是应用程序负责为指定的用户帐户到指定的窗口站和桌面."

"If the application specifies a desktop in the lpDesktop member, it is the responsibility of the application to add permission for the specified user account to the specified window station and desktop."

此引文摘自此处:http://support.microsoft.com/kb/165194很有用的文章！包括有关如何执行所有 ACL 的代码示例东西(不幸的是，非托管代码...)

This quote is taken from here: http://support.microsoft.com/kb/165194 Very useful article! Includes code samples on how to do all the ACL stuff (unfortunately, unmanaged code...)

此外，您还可以在此处找到其他相同的信息:http://msdn.microsoft.com/en-us/library/aa379608%28v=vs.85%29.aspx

Also, you may find additional same info here: http://msdn.microsoft.com/en-us/library/aa379608%28v=vs.85%29.aspx

这篇关于CreateProcessAsUser win api 在非 win7 平台上不起作用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！