title: How does impersonating a user with NEW_CREDENTIALS work in C#?
body: <p>I'm working on a system where various Windows services run on different computers in a private network. Any of the computers in the network can run client applications that interact with these services remotely. As part of our package, we have functionality that lets users see whether any of the services in the network are experiencing problems and restart any of them that are downed.</p>
  
  <p>To get this to work, we used <a href="http://www.codeproject.com/Articles/21050/Security-User-Impersonation" rel="nofollow">user impersonation</a> and the <a href="http://msdn.microsoft.com/en-us/library/system.serviceprocess.servicecontroller.aspx" rel="nofollow">Service Controller class</a>: we ask users to provide the user name and password of an administrative account on the computer hosting the downed service, impersonate that administrator, and then restart the service with ServiceController. This works in most situations, but we can't impersonate the administrators on some of our servers. My understanding is that for user impersonation to work, the accounts being impersonated have to be on the local machine or part of an Active Directory group, but the servers in question only have accounts that are local to themselves.</p>
  
  <p>I noticed that there are lots of parameters for the <code>LogonUser</code> method that starts impersonation and started playing with them to see if any of them would fix my problem. When I tried setting the LogonType value to "New Credentials" (9), I saw some strange (but potentially useful) behavior:</p>
  
  <ul>
  <li>I can restart services on the servers that I couldn't work with previously</li>
  <li>If I attempt to restart a downed service and provide an incorrect password, the service is still restarted.</li>
  </ul>
  
  <p>Why am I seeing this behavior? If the reasons for this are good, I might use this set-up to completely get rid of asking users to log in altogether.</p>