XP SP2, SSPI, Bad Impersonation level Error

From: Jim Kane (jkane_at_prodoc.com)
Date: 09/08/04 

Date: 8 Sep 2004 11:52:32 -0700

Some time ago I wrote some code to allow end-users to type in an Admin
password which allowed me to use SSPI to impersonate the admin user
and update HKLM for them. It all worked.

Since installing XP SP2, the SSPI impersonation code works the same
but when I try to open a registry key I get and error 1346 - bad
impersonation level. I find that odd because in my
initializesecuritycontext call, I ask for ISC_REQ_Delegate and the
code succeeds. I do not understand why the error with xp sp2? Can
anyone explain or tell me how to avoid the error?

Jim Kane
ProDoc,Inc

Relevant Pages

  • Re: Read-only access to SPGlobalConfig without administrator rights
    ... back to the impersonation thing again. ... > admin user names and passwords in code, ... One way would be to use to application pool identity ... > credentials are stored safely in the IIS metabase), ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: Read-only access to SPGlobalConfig without administrator rights
    ... We agree you shouldn't hardcode admin user names and passwords in code, but you can have impersonation using other options. ... SPGlobalAdmin and SPGlobalConfig without impersonation? ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: Logging, Login API and SSPI
    ... Regarding your answer to SSPI. ... Apparently SSPI will allow you to impersonate for credentials validation but ... The requested impersonation level of the token is less than ... such as SecurityIdentification or SecurityAnonymous. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Logging, Login API and SSPI
    ... the log files would be created/written under his credentials. ... but the problem is that login API and SSPI can require ... work properly (The impersonation level does not allow resource access). ... SSPI doesn't require elevated privileges. ...
    (microsoft.public.win32.programmer.kernel)
  • RE: XP SP2, SSPI, Bad Impersonation level Error
    ... This seems to be related to a new security privilege introduced in XP SP2. ... logged on user at the Impersonation or Delegation level. ... privilege, the impersonation level is downgraded to Identify, which will ...
    (microsoft.public.platformsdk.security)