Windows Impersonation from C#

c# windows impersonation
user53794 picture user53794 · Feb 18, 2009 · Viewed 56.7k times · Source

How can a C# program running as LocalSystem impersonate the login identity of another user temporarily? Roughly speaking I have a Windows Service that I'd like to run as LocalSystem but at times impersonate user XYZ (when connecting to a db using windows integrated security).

Most important of all: Is there a way to do this without knowing the other user's password?

Note: if a password is mandatory is there a recommended strategy for storing a password securely (c# and/or vbscript).

Answer

wj32 picture wj32 · Feb 22, 2009

It's possible, although it requires you to do a lot of code. See NtCreateToken and CreateToken. You need SeCreateTokenPrivilege, although that won't be a problem since you're running under NT AUTHORITY\SYSTEM. You can then use the created token to impersonate inside a thread.

Related questions

Impersonating a Windows user

I am using the code to impersonate a user account to get access to a file share. public class Impersonator : IDisposable { #region Public methods. // ------------------------------------------------------------------ /// <summary> /// Constructor. Starts the impersonation with the given credentials. /// Please note that the …

Read More
Impersonate user in Windows Service

I am trying to impersonate a domain user in a windows service with the service logged in as the Local System Account. So far, I am only able to get this to work by logging the service and set the …

Read More
How can I get elevated permissions (UAC) via impersonation under a non-interactive login?

I have a class library that keeps system-wide configuration data in the registry (HKLM\Software\XXX). This library is used in various applications (services, windows forms, web apps, console apps) on various versions of Windows (XP, 2003, 7, 2008 R2). Because of this, …

Read More