Question

I am trying to understand better how Windows sessions (TS sessions and log on sessions) works (currently in XP), so maybe my whole question or what I am trying to do is impossible.

I am running a Windows service (in XP), which runs in session 0, and I am trying to get the username attached to this session using WTSQueryUserToken().
Now, in session 0 there are several usernames: SYSTEM, theuser (logged on user),NETWORK SERVICE, LOCAL SERVICE.

When I use WTSQueryUserToken() I get “theuser” (which is the Active session), but I am trying to get the username of my service (which is SYSTEM).
Is that possible or did I simply get it all wrong?

Answer 1

I use the following code to get user token for my process

HANDLE GetProcessOwnerToken(DWORD pid)
{
    if (!pid) return NULL;

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (!hProcess) return NULL;

    HANDLE hToken = NULL;
    if(OpenProcessToken(hProcess, MAXIMUM_ALLOWED, &hToken))
    {
        HANDLE result = INVALID_HANDLE_VALUE;
        if(DuplicateTokenEx(hToken, TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &result))
        {
            if(result != INVALID_HANDLE_VALUE)
            {
                CloseHandle(hToken);
                CloseHandle(hProcess);
                return result;
            }
        }
        CloseHandle(hToken);
    }
    CloseHandle(hProcess);

    return NULL;
}

I have no idea if it works for services as well, I think it should.