LOGON32_LOGON_NETWORK_CLEARTEXT, ImpersonateLoggedOnUser and access HKLM

From: Sergei (smzinovyev_at_validio.com.ua)
Date: 05/31/05

  • Next message: Garfield Lewis: "Delegation and Trusts" 
    Date: 31 May 2005 11:13:45 -0700

    Hi,

    I have the problem with accessing
    "HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook" from
    impersonated thread.

    RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Clients\\Mail\\Microsoft
    Outlook"), STANDARD_RIGHTS_READ | KEY_QUERY_VALUE)
    returns "Either a required impersonation level was not provided, or the
    provided impersonation level is invalid.".

    I test my code on Win2000 Server SP4, WinXP SP2 and Win2003 SP1. My
    code does LogonUser(.., LOGON32_LOGON_NETWORK_CLEARTEXT,
    LOGON32_PROVIDER_WINNT50) for a domain user and then calls
    ImpersonateLoggedOnUser. After these calls it reads HKLM.

    If interactively logged on user is from "LocalMachine\Administrators"
    groups then RegOpenKeyEx(HKEY_LOCAL_MACHINE,...) returns ERROR_SUCCESS.
    But if interactively logged on user is NOT from
    "LocalMachine\Administrators" (for ex. from ""LocalMachine\Power
    Users"") then RegOpenKeyEx(HKEY_LOCAL_MACHINE,...) returns "Either a
    required impersonation level was not provided, or the provided
    impersonation level is invalid.".

    In both cases impersonation level of token is SecurityImpersonation.

    What is the difference between two ways?

    Thank you.

    Sergei M. Zinovyev

  • Next message: Garfield Lewis: "Delegation and Trusts"

    Relevant Pages

    • RE: WINS MMC Error
      ... Either a required impersonation level was not provided, ... Based on my experience, if the problematic server is a Win2003, you may ... or the provided impersonation level is invalid. ...
      (microsoft.public.windows.server.networking)
    • Re: WMI Methods in C++
      ... You have to set your impersonation level before you can make calls to WMI. ... Either a required impersonation level was not provided, ... or the provided impersonation level is invalid. ...
      (microsoft.public.win32.programmer.wmi)
    • Re: WINS MMC Error
      ... Either a required impersonation level was not ... connection, either press F5, or on the Action menu, click Refresh. ... "The WINS server you specified cannot be located. ...
      (microsoft.public.windows.server.networking)
    • Impersonation Level Errors
      ... Whenever we try to look at the dial-in properties of a ... error of "Either a required impersonation level was not ... server that is running on a 2000 server machine. ...
      (microsoft.public.windows.server.migration)
    • Re: 2003 Server R2 - Network Connections Service fails after dcpromo
      ... When I attempt to remotely manage a new DC and view the event log, ... get "required impersonation level was not provided or the provided ... Tom W. ...
      (microsoft.public.windows.server.migration)
    • Quantcast