title: Odd behavior of windows Impersonation
body: <p>My windows application may require administrative privileges for some of it's sections. 
  For those cases, I'd like to ask the user for an administrator credentials, and use the following code to impersonate the administrator:</p>
  
  <pre><code>BOOL impersonate(LPTSTR lpszUsername, LPTSTR lpszDomain, LPTSTR lpszPassword) {
  
      BOOL ret = LogonUser(lpszUsername,
                           lpszDomain,
                           lpszPassword,
                           LOGON32_LOGON_INTERACTIVE,
                           LOGON32_PROVIDER_DEFAULT,
                           &amp;hToken);
      if (ret != TRUE) return FALSE;
  
      OutputDebugString (L"step 1");
  
      ret = ImpersonateLoggedOnUser(hToken);
      if (ret != TRUE) return FALSE;
  
      OutputDebugString(L"step 2");
  
      return IsUserAdmin()
  }
  </code></pre>
  
  <p>where the function <code>IsUserAdmin()</code> <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa376389%28v=vs.85%29.aspx" rel="nofollow">has been taken from MSDN</a> , and goes as follow:</p>
  
  <pre><code>BOOL IsUserAdmin(VOID) {
      BOOL b;
      SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
      PSID AdministratorsGroup; 
      b = AllocateAndInitializeSid( &amp;NtAuthority,
                                    2,
                                    SECURITY_BUILTIN_DOMAIN_RID,
                                    DOMAIN_ALIAS_RID_ADMINS,
                                    0, 0, 0, 0, 0, 0,
                                    &amp;AdministratorsGroup); 
      if (b)  {
          if (!CheckTokenMembership(NULL, AdministratorsGroup, &amp;b)) {
              b = FALSE;
          }
          FreeSid(AdministratorsGroup); 
      }
  
      return(b);
  }
  </code></pre>
  
  <p><strong>Scenario 1:</strong><br>
  Running the application from an administrator account.</p>
  
  <ol>
  <li><p>calling IsUserAdmin() => returns <code>TRUE</code> (good)</p></li>
  <li><p>calling impersonate ("non-admin-user" , "domain", "password" ) => returns <code>FALSE</code> (good!) </p></li>
  </ol>
  
  <p><strong>Scenario 2:</strong><br>
  Running the application from a non-administrator account, using <code>runas.exe</code> from an administrator account.  </p>
  
  <ol>
  <li><p>calling IsUserAdmin() => returns <code>FALSE</code> (good)</p></li>
  <li><p>calling impersonate ("administrator" , "domain", "password" ) => returns <code>FALSE</code> (not good!) </p></li>
  </ol>
  
  <p><strong>Scenario 3:</strong><br>
  Running the application <em>directly</em> from a non-administrator account.</p>
  
  <ol>
  <li><p>calling IsUserAdmin() => returns <code>FALSE</code> (good) </p></li>
  <li><p>calling impersonate ("administrator" , "domain", "password" ) => returns <code>FALSE</code> (not good!) </p></li>
  </ol>
  
  <p><strong>All scenarios print both <code>step 1</code> and <code>step 2</code>.</strong>  </p>
  
  <p>As far as I can tell, the above should have assure impersonation, given the a legitimate credentials. what am I missing here?</p>