Using ImpersonateLoggedOnUser

From: D (anonymous_at_discussions.microsoft.com)
Date: 02/28/05 

Date: Sun, 27 Feb 2005 15:21:36 -0800

We have a .NET application implemented as a Windows
service in order to perform impersonation for the purposes
of gaining access to various resources. We are using
ImpersonateLoggedOnUser() instead of the .NET
impersonation API.

Everything works fine except when we call an external COM
component that is supposed to print a report using its
internal API calls. We can access file resources, etc.

We perform impersonation to a valid administrator account,
yet the application fails to print (we wrote debugging
information to make sure that we are impersonating
properly).

The problem appears to be that the external process is
still using the local SYSTEM account, which by default
does not have access to printers (unless the registry is
modified - see http://support.microsoft.com/default.aspx?
scid=kb;en-us;184291). If the registry is modified to
allow printer access to the SYSTEM account, printing works
fine.

We do not want to have to modify the registry to allow
access to printers. Any idea why impersonation is failing
here?

Thanks in advance.

Relevant Pages

  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... permissions are checked, and not in IIS. ... account - regardless of the impersonation settings. ... You have aspx pages..and you have the resources this page wants to get at. ... When anonymous authentication is disabled, yes the page itself MUST have ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... After they have access to the page, if impersonation is disabled, this is when the aspnet user takes over the process, and access to other resourses is granted based on that, not the original user. ... > Client Requested Resources. ... It uses the original caller's access token and ACL ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Using ImpersonateLoggedOnUser
    ... service in order to perform impersonation for the purposes ... We can access file resources, ... does not have access to printers (unless the registry is ... If the registry is modified to ...
    (microsoft.public.dotnet.framework)
  • Re: Using ImpersonateLoggedOnUser
    ... that process will run under the worker process account. ... > service in order to perform impersonation for the purposes ... > does not have access to printers (unless the registry is ... If the registry is modified to ...
    (microsoft.public.dotnet.framework)
  • Re: Multiple Users with impersonation using one account
    ... you don't need impersonation to check for user identity - Context.User.Identity.Name is populated with the clients name ... some applications use resources such as the file system for ... or for opening files on other network ...
    (microsoft.public.dotnet.framework.aspnet.security)