Prevent access to advapi32.dll RevertToSelf()

kevin.kenny_at_zygonia.net
Date: 09/27/05 

Date: 27 Sep 2005 06:06:58 -0700

Hi All,

Sorry to crosspost but it's a security and an ASP.NET problem I have.

We run each website site under it's own I_<user> account and ASP.NET is
configured to impersonate so requests run under the identity of the
I_<user> account.

In windows 2000 server how do I prevent a user from calling
RevertToSelf() in advapi32.dll and unwinding the impersonation? e.g.

[DllImport(@"C:\WINNT\system32\advapi32.dll")]
public static extern bool RevertToSelf();

void Page_Load(Object sender, EventArgs e) {
        // at this point the request is running under impersonation as
I_<user>
        RevertToSelf();
        // afterwards it undoes the impersonation and the request is
now running as <MACHINE>\ASPNET
}

I've looked into building a .NET security policy to do this but I'm a
bit stuck.

Thanks in advance.
Kevin

Relevant Pages

  • Re: Out of Process execution and .NET
    ... "charlie" expressed in the message known ... I will impersonate a Domain ... security weakness of the highest sort. ... than a blanket Domain Admin account), ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: How to use WindowsPrincipal properly??
    ... > If you want to check if the user is in the local computers security group ... > used by the general public you have to use Basic Authentication of course. ... You can logon a set account ... > WindowsIndentity which is then used to Impersonate. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Security
    ... web.config file to impersonate a domain user that has access to the database ... registry the domain user and password. ... have Windows Integrated Security set. ... user while running the code under the impersonated account. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Queryinterface Error
    ... AS for the problem you described, it is likely due to security issue. ... the current logon user account. ... IIS: Integrited windows? ... By default, if we didn't use impersonate, asp.net will run under the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: NTLM Win2000 and Impersonation
    ... > I am using NTLM in Win2000 to impersonate an Administrator ... > account which is part of Administrator group everything ... > returned security context is used to retrieve a token ...
    (microsoft.public.platformsdk.security)