How to run an application under active session account from a Windows service using Delphi

To run an application from a service impersonating an user account, first we need to install "JEDI API Library & Security Code Library" as it contains different interesting OS callings which are really useful in order to achieve our purposes. Once the library has been unzipped, create your own service where the library is located and add the following paths to your search path in your project options:

	.\JEDI API 2.3 and JEDI WSCL 0.9.3\jwa\branches\2.3\Common
	.\JEDI API 2.3 and JEDI WSCL 0.9.3\jwa\branches\2.3\Win32API

view raw file.config hosted with ❤ by GitHub

Then instead of using CreateProcess function to execute an application, we need to use CreateProcessAsUser function. The new process runs in the security context of the user represented by the specified token. The service must be run by the  LocalSystem account which is a predefined local account used by the service control manager. To be able to use the function from jedi-apilib which retrieves the token from the current user we need to use WTSQueryUserToken ( WtsGetActiveConsoleSessionID, hToken ) function. This function will only work under LocalSystem account which has SE_TCB_NAME property enabled, otherwise the query will be false.

Use the following example within your service:

	uses
	ComObj, ActiveX, JwaWinbase, JwaWtsApi32;
	{$R *.DFM}
	procedure ServiceController(CtrlCode: DWORD); stdcall;
	begin
	ServiceExample.Controller(CtrlCode);
	end;
	function TServiceExample.GetServiceController: TServiceController;
	begin
	Result := ServiceController;
	end;
	procedure TServiceExample.ServiceExecute(Sender: TService);
	begin
	Timer1.Enabled := True;
	while not Terminated do
	ServiceThread.ProcessRequests(True); // wait for termination
	Timer1.Enabled := False;
	end;
	procedure TServiceExample.Timer1Timer(Sender: TObject);
	const
	ProgramName = 'C:\myTestproject1.exe';
	var
	hToken: THandle;
	StartupInfo: Windows.TStartupInfo;
	ProcessInfo: Windows.TProcessInformation;
	res: boolean;
	begin
	Windows.GetStartupInfo(StartupInfo);
	if WTSQueryUserToken(WtsGetActiveConsoleSessionID, hToken) then
	begin
	res := Windows.CreateProcessAsUser(hToken, ProgramName, nil, nil, nil, False, CREATE_NEW_CONSOLE, nil, nil, StartupInfo, ProcessInfo);
	if res then
	WaitForSingleObject(ProcessInfo.hProcess,INFINITE);
	end;
	end;

view raw ServiceController.pas hosted with ❤ by GitHub

Related links:

• JclMiscel.pas.
• CreateProcessAsUser fast switching.
• Run process from different credentials.
• How to launch a process in a terminal session.
• Calling CreateProcessAsUser from a Service.
• Delphi Services and Local System account.
• Local system account.
• WTSQueryUserToken.