title: Impersonate standard user
body: <p>I am trying to make a running process of mine which is elevated to restart explorer using the standard user token.</p>
  
  <p>What I'm doing is first I run the main process as an administrator, then I take a snapshot of the running:</p>
  
  <pre><code>if (Process32First(hSnapshot,&amp;pe32))
      {
          do
          {
              if (!wcsicmp(pe32.szExeFile, L"explorer.exe"))
              {
                  DWORD dwExplorerSessId = 0;
                  if (ProcessIdToSessionId(pe32.th32ProcessID, &amp;dwExplorerSessId) &amp;&amp; dwExplorerSessId == dwSessionId)
                  {
                      dwExplorerLogonPid = pe32.th32ProcessID;
                      break;
                  }
              }
  
          } while (Process32Next(hSnapshot, &amp;pe32));
      }
  
      CloseHandle(hSnapshot);
  </code></pre>
  
  <p>then once I get the PID of explorer which is running under the standard user account, I call:</p>
  
  <pre><code>OpenProcessToken(hProcess,TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_IMPERSONATE
              ,&amp;hPToken))
  </code></pre>
  
  <p>then I call:</p>
  
  <pre><code>ImpersonateLoggedOnUser(hPToken);
  </code></pre>
  
  <p>and finally I taskkill explorer.exe and shell execute it again but its running under the administrators privileges.</p>
  
  <p>Its as if the impersonateLoggedonUser is not working. Although its returning true and GetLastError() returns 0;</p>
  
  <p>I have also tried using CreateProcessAsUser() but this always gives an ERROR_FILE_NOT_FOUND:</p>
  
  <pre><code>    STARTUPINFO si;
      GetStartupInfo(&amp;si);                
      PROCESS_INFORMATION pi;
      ZeroMemory(&amp;pi, sizeof(PROCESS_INFORMATION));
  
      TCHAR tchcmd[MAX_PATH];
      _tcscpy(tchcmd, _T("explorer.exe"));
      PVOID penv;
      CreateEnvironmentBlock(&amp;penv, hToken, FALSE);
  HANDLE hNewToken;
  DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, SecurityIdentification, TokenImpersonation, &amp;hNewToken);
      CreateProcessAsUser(, NULL, tchcmd, 0, 0, 0, CREATE_DEFAULT_ERROR_MODE, penv, 0, &amp;si, &amp;pi );
  </code></pre>
  
  <p>Any Ideas or suggestions.</p>