Original Post
In Vista and later, services run in session 0 and logged in users in session 1. BlockInput(1) doesn't return any error when I run it in my watchdog service, but it doesn't have any effect since the service doesn't interact with the desktop. Changing the desktop interaction attribute in the services control panel doesn't help.
When I occasionally need to access the user's files and registry I was doing something like this in my watchdog service:
Now, I tried to add BlockInput(1);Sleep(5000); after the ImpersonateLoggedOnUser call but it still doesn't block...
Then I read somewhere that the BlockInput call requires high mandatory integrity level, which for example an administrator level process has but not a normal user. So I tried to modify the integrity level of my process with the following just before the ImpersonateLoggedOnUser call above:
I get no errors from any of those functions, but a BlockInput still doesn't work... Why? How do I solve this?
My last ditch attempt would be to try to raise the MIL of the user process that is being controlled by this watchdog service and have it run the BlockInput(), but that's an ugly ass solution and a weakness in the overall security.
I posted this a while ago on stackoverflow but have no answers this far
When I occasionally need to access the user's files and registry I was doing something like this in my watchdog service:
if (!WTSQueryUserToken(sid, &token)) throw "ERROR: Could not get logged on user token";if (!DuplicateTokenEx(token, TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ADJUST_DEFAULT | TOKEN_IMPERSONATE, 0, SecurityImpersonation, TokenPrimary, &userTok)){ CloseHandle(token); throw "ERROR: Could not duplicate user token";}CloseHandle(token);if (!ImpersonateLoggedOnUser(userTok)) throw "ERROR: Could not impersonate logged on user";... // Do stuff needing impersonationif (!RevertToSelf()) throw "ERROR: Could not revert to self";Now, I tried to add BlockInput(1);Sleep(5000); after the ImpersonateLoggedOnUser call but it still doesn't block...
Then I read somewhere that the BlockInput call requires high mandatory integrity level, which for example an administrator level process has but not a normal user. So I tried to modify the integrity level of my process with the following just before the ImpersonateLoggedOnUser call above:
PSID sid(0);if (!ConvertStringSidToSid(SDDL_ML_HIGH, &sid)) throw "ERROR: Could not convert string to SID";TOKEN_MANDATORY_LABEL tml;tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED;tml.Label.Sid = sid;if (!SetTokenInformation(userTok, TokenIntegrityLevel, &tml, sizeof(tml) + GetLengthSid(sid)))) throw "ERROR: Could not set token information";LocalFree(sid);I get no errors from any of those functions, but a BlockInput still doesn't work... Why? How do I solve this?
My last ditch attempt would be to try to raise the MIL of the user process that is being controlled by this watchdog service and have it run the BlockInput(), but that's an ugly ass solution and a weakness in the overall security.
I posted this a while ago on stackoverflow but have no answers this far