Re: Calling CreateProcessWithLogonW from a Windows Service

From: Pavel Lebedinsky [MSFT] (pavel_at_online.microsoft.com)
Date: 06/17/05 

Date: Fri, 17 Jun 2005 00:20:55 -0700

0xc0000142 is STATUS_DLL_INIT_FAILED (from ntstatus.h). Since
it's an NTSTATUS, not a win32 error, you can't feed it to net helpmsg.

This error often happens when a process doesn't have access to its
windowstation or desktop, which causes user32 initialization to fail.

You can check if this is what's happening in your case by creating a
simple program that doesn't link to user32.dll and launching it instead. 

-- 
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Joe Richards [MVP]" wrote:
> The 0x142 doesn't map to any Windows Error messages, that is 322 which 
> gets you this
>
> F:\DEV\cpp\SvcUtil>net helpmsg 322
> 322 is not a valid Windows network message number.
>
>
> It could be an issue with the application it is trying to launch. I have a 
> tool that works with that same API and occasionally I hear about apps that 
> it just can't start up for whatever reason. LocalSystem is an obvious 
> problem but you say the service isn't running as localsystem so that 
> shouldn't be involved.
>
> You might consider using localsystem and using logonuser to see if that 
> works.
>
>> The security context of the service is any domain user. No local system 
>> account is in the picture.

Relevant Pages

  • Re: Calling CreateProcessWithLogonW from a Windows Service
    ... The 0x142 doesn't map to any Windows Error messages, that is 322 which gets you this ... say the service isn't running as localsystem so that shouldn't be involved. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.platformsdk.security)
  • Re: How to protect from LocalSystem privilege escaltion
    ... > code used in the alleged VirusScan exploit. ... > you describe against the Windows Services you describe as an ordinary User ... > The third prerequisite is a buggy service running as LocalSystem. ...
    (microsoft.public.win2000.security)
  • Re: Win32 vulnerability? Or application vulnerability?
    ... The firewall only "trusts" Internet Explorer to access the ... some malicious code gets onto the system. ... I agree that localsystem windows running on the desktop are not ...
    (NT-Bugtraq)
  • Re: ActiveDirctory security questions
    ... Don't even think about changing the context of the services that come with Windows, ... If DAs are not in the administators group of the DCs you will find things that don't work exactly as expected. ... I really don't understand what you think you are going to accomplish by trying to lock down the admin groups and localsystem. ...
    (microsoft.public.win2000.active_directory)
  • Re: How to protect from LocalSystem privilege escaltion
    ... An executable file built to attack VirusScan that gained wide distribution ... you describe against the Windows Services you describe as an ordinary User running on ... The third prerequisite is a buggy service running as LocalSystem. ... >> Disabling the services or setting the reg key is not necessary for the ...
    (microsoft.public.win2000.security)
Quantcast