在程序内如何以其他用户的身份启动一个进程？

[lihanbing]

在程序内如何以其他用户的身份启动一个进程？
已知其他用户的名称和口令

[sunyou]

gz

[oldworm]

BOOL CreateProcessAsUser(
HANDLE hToken, // handle to user token
LPCTSTR lpApplicationName, // name of executable module
LPTSTR lpCommandLine, // command-line string
LPSECURITY_ATTRIBUTES lpProcessAttributes, // SD
LPSECURITY_ATTRIBUTES lpThreadAttributes, // SD
BOOL bInheritHandles, // inheritance option
DWORD dwCreationFlags, // creation flags
LPVOID lpEnvironment, // new environment block
LPCTSTR lpCurrentDirectory, // current directory name
LPSTARTUPINFO lpStartupInfo, // startup information
LPPROCESS_INFORMATION lpProcessInformation // process information
);

[icansaymyabc]

LogonUser 可以吧

[lihanbing]

能不能详细解释一下 LPSECURITY_ATTRIBUTES

[masterz]

#define _UNICODE
#define _WIN32_WINNT 0x0500
#include <windows.h>
#include <stdio.h>
#include <stddef.h>
#include <ntsecapi.h>
int main()
{
SECURITY_ATTRIBUTES sa;
STARTUPINFOW si;
PROCESS_INFORMATION pi;
bool add_privilege =true;
ZeroMemory(&sa, sizeof(sa));
sa.nLength = sizeof(sa);
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
LPCWSTR UName;
LPCWSTR Domain;
LPCWSTR PW;
LPWSTR Command;
UName=L"masterz";
Domain=L"";//my computer is not in any domain
PW=L"*";
Command=L"notepad.EXE";
if (!CreateProcessWithLogonW(UName,Domain, PW ,
LOGON_WITH_PROFILE , NULL,Command,NULL,NULL,NULL,&si,&pi))
{
LPVOID lpMsgBuf;
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS, NULL, GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default languag=
(LPTSTR) &lpMsgBuf, 0, NULL);
MessageBox( NULL, (LPTSTR)lpMsgBuf, NULL, MB_OK |
MB_ICONINFORMATION );
// Free the buffer.
LocalFree( lpMsgBuf );
}
else
{
}
return 0;
}