CreateDesktop() with vista and UAC on (C, windows)

by

The correct solution is given as a short comment by ChristianWimmer above:

The desktop must have a security descriptor that allows access to lower integrity level like IE has. Otherwise the GUI cannot access the desktop. – ChristianWimmer Jul 22 ’10 at 17:00

Since the answer is a little bit hidden and there’s no source code example, let me state it clearly here:

If IE runs in protected mode then the browser tabs are created as low integrity processes. The low integrity tab process will fail to initialize if the desktop does not have a low integrity mandatory label.

As a consequence, the main IE process terminates, too. An interesting observation is that if you start IE providing a command line URL from the secure zone, then IE will succeed to start, because protected mode is disabled by default for the secure zone.

I checked the integrity level of the default desktop, and indeed I was able to verify that the default desktop has a low integrity level! So the easiest solution to the problem is to (1) create the new desktop, (2) get the mandatory label from the default desktop, and (3) copy it into the new desktop. For (2) and (3), you can use the following code

PACL pSacl;
PSECURITY_DESCRIPTOR pSecurityDescriptor;
DWORD dwResult;

dwResult = GetSecurityInfo(hDefaultDesktop, SE_WINDOW_OBJECT, LABEL_SECURITY_INFORMATION, NULL, NULL, NULL, &pSacl, &pSecurityDescriptor);

if (dwResult == ERROR_SUCCESS) {
    if (pSacl != NULL) {
        dwResult = SetSecurityInfo(hNewDesktop, SE_WINDOW_OBJECT, LABEL_SECURITY_INFORMATION, NULL, NULL, NULL, pSacl);

        if (dwResult != ERROR_SUCCESS)
            _tprintf(_T("SetSecurityInfo(hNewDesktop) failed, error = %d"), dwResult);
    }

    LocalFree(pSecurityDescriptor);
} else {
    _tprintf(_T("GetSecurityInfo(hDefaultDesktop) failed, error = %d"), dwResult);
}

@CristianWimmer: Thanks for providing the hint to the correct solution. This saved my a lot of time!!

More Related Contents:

  1. How to Raise SIGTERM in Windows [closed]
  2. How to elevate privileges only when required?
  3. Requesting administrator privileges at run time
  4. How do you clear the console screen in C?
  5. How to request administrator permissions when the program starts?
  6. How to list physical disks?
  7. Launch Failed Binary not found Eclipse for C in Windows
  8. Windows 7 and Vista UAC – Programmatically requesting elevation in C#
  9. Reading a character with scanf_s
  10. How to get 100% CPU usage from a C program
  11. How to get name associated with open HANDLE
  12. What is the simplest way to write to stdout in binary mode?
  13. Hide console in C system() function, Win
  14. windows C system call with spaces in command
  15. How to copy string to clipboard in C?
  16. Save HBITMAP to *.bmp file using only Win32
  17. How to use kbhit and getch (C programming) [closed]
  18. C compiler for Windows? [closed]
  19. R from C — Simplest Possible Helloworld
  20. How to obtain the correct physical size of the monitor?
  21. How do I measure time in C?
  22. Building a shared library using gcc on Linux and MinGW on Windows
  23. How do I build OpenSSL statically linked against Windows runtime?
  24. Winapi: Get the process which has specific handle of a file
  25. Process.Start with different credentials with UAC on
  26. How to get the %AppData% folder in C?
  27. How can I access netstat-like Ethernet statistics from a Windows program
  28. How to make win32 console recognize ANSI/VT100 escape sequences in `c`?
  29. Standard data structure library in C? [closed]
  30. Execute program capturing screenshots from windows service

Leave a Comment