AdjustTokenPrivileges in W2K vs XP

From: Raśl (raultruco@flashmail.com)
Date: 11/13/02 

From: "Raśl" <raultruco@flashmail.com>
Date: Wed, 13 Nov 2002 11:46:15 +0100

hello, can anybody help me with this doubt?

I need to enable the privilege SeTcbPrivilege to call LogonUser in W2K. I
set this privilege for the user in (...)-->Local Policies-->User Rights
Assigment-->Act as part of SO,

i restart the session, and when I try to enable this privilege for the
process with AdjustTokenPrivileges, it return 1300 (ERROR_NOT_ALL_ASSIGNED).
This means that the user have not the privilege in User Rights Assigment,
but the user have it!!.

If i do all this in Windows XP, all is all right!!. AdjustTokenPrivileges
enables the privilege correctly and LogonUser validate the user correctly
(under xp, it isn't necessary to enable any privilege)

Do you know where is my error?

thanks very much,
raul

Relevant Pages

  • Re: posix capabilities inheritance
    ... >>I've been programming Windows for a long time, ... >>because everything enables them. ... Least privilege, and all that. ... Pretend that 'cap' is a bash builtin that did the obvious thing: ...
    (Linux-Kernel)
  • Re: Getting logged in user from a service?
    ... the service executes the service call, when WMI needs to "enable" a privilege, it' s up to the caller to ask the service to enable the required privilege, the user doesn't need to know the "privilege" required, WMI know which one as it's stored in it's metabase. ... All WMI's security levels are highly customizable, the namespaces are all protected by DACL's you can adjust, you can prevent certain user to access, read, write, execute etc...it's namespaces, if a user is allowed to execute a method, WMI will simply enable or add the privilege when needed on a per call basis. ... Some classes and methods need an impersonation token from the base client, if the token holds a needed privilege to execute or access a namespace class, WMI enables this privilege, when the token misses the privilege, the call fails. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Getting logged in user from a service?
    ... existing token since tokens are mostly immutable. ... class, WMI enables this privilege, when the token misses the privilege, ... the client, to run as an administrator, you are simply delegating the task ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Hibernate once - resume many
    ... Are you sure that it enables the SE_SHUTDOWN_NAME privilege? ... I think that this should work on principle if you have enough rights then ... Regards, ...
    (microsoft.public.windowsxp.embedded)
  • Translating from the C++
    ... HRESULT in that case? ... // also use this example to enable or disable the restore privilege ... // The main function in this example enables the backup privilege. ... IN LPCTSTR szPrivilege, ...
    (microsoft.public.dotnet.framework.interop)