Impersonate and Activator.CreateInstance

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Tomas K?llsen - 08 Jun 2005 21:35 GMT

Hi,

I'm creating a Powerpoint Application object for use in Powerpoint
automation (Powerpoint 2003) like this:

Type t = Type.GetTypeFromProgID("PowerPoint.Application");

object app = Activator.CreateInstance(anApplicationType);

..which works like it's supposed to, and I can use the object to
automate Powerpoint.

The problem is that I need to impersonate another user than the
process user, which I have also managed to do (with LogonUser /
DuplicateToken / WindowsIdentity). This works if I try for example to
read a file from the thread that runs the code above; I'm successfully
impersonating DOMAIN\SomeImpersonatedUser.

But when I use Activator.CreateInstance it starts PowerPoint as the
original process user, not DOMAIN\SomeImpersonatedUser. From what I've
read this might have something to with MTA/STA? I'm pretty lost right
now...

Regards,
Tomas

Reply to this Message

Willy Denoyette [MVP] - 08 Jun 2005 21:46 GMT

> Hi,
>
[quoted text clipped - 21 lines]
> Regards,
> Tomas

This is normal and by design.
When you read a file when impersonating it's the impersonating thread in
YOUR process that runs the code that reads the file. When you create an
instance of a out-proc COM server like power point, you start another
process (powerpoint.exe) and this one runs with the process identity of the
creating process (called the launching user).

Willy.

Reply to this Message

Tomas K?llsen - 09 Jun 2005 07:30 GMT

Inline.

> This is normal and by design.
> When you read a file when impersonating it's the impersonating thread in
> YOUR process that runs the code that reads the file. When you create an
> instance of a out-proc COM server like power point, you start another
> process (powerpoint.exe) and this one runs with the process identity of the
> creating process (called the launching user).

Hmm, I figured it was something like that. I know how to start an
impersonated process with CreateProcessWithLogonW, but how do I do
that when I need to use Activator.CreateInstance? Is it possible
without controlling the COM object?

Thanks,
Tomas

Reply to this Message

Willy Denoyette [MVP] - 09 Jun 2005 13:21 GMT

> Inline.
>
[quoted text clipped - 13 lines]
> Thanks,
> Tomas

No, it's not. Only thing you can do is create the process using
CreateProcessWithLogonW and connect to the running instance using
Marshal.GetActiveObject. Make sure however that the client has access
permission for the Server (see Dcomcnfg.msc).

Willy.

Reply to this Message

tomas.kallsen@endir.se - 10 Jun 2005 10:42 GMT

Hmm, thanks for the help. Unfortunately CreateProcessWithLogonW has a
bug in Windows XP (http://support.microsoft.com/?kbid=818858) so that
it ignores my attempts to start it as hidden. I guess I could use
FindWindow/ShowWindow to set it as hidden after the process is started
but I think I will change approach.

My real problem is actually this: I need to start a separate Powerpoint
process, one that does not conflict with the one started by the
"interactive" user (my program uses Powerpoint automation, but I would
like the user to be able to use Powerpoint at the same time as my
program does it's thing).

The problem is that the only way to do this in windows is to start
Powerpoint as a different user, otherwise it will just reuse the
existing process (Excel does not have this behaviour, here we can start
as many processes with the same username as we like).

Do you know of any way to accomplish this? To "fool" Windows/Powerpoint
into starting a second Powerpoint process with the same username?

Reply to this Message

Willy Denoyette [MVP] - 10 Jun 2005 12:58 GMT

> Hmm, thanks for the help. Unfortunately CreateProcessWithLogonW has a
> bug in Windows XP (http://support.microsoft.com/?kbid=818858) so that
[quoted text clipped - 15 lines]
> Do you know of any way to accomplish this? To "fool" Windows/Powerpoint
> into starting a second Powerpoint process with the same username?

Well in that case you could try to set the "identity" of powerpoint using
DCOMCNFG to run as "another user" than the interactive user, keep in mind
that doing so, you don't have the users profile loaded, that means you can't
access it's customized office environment (path, printers, etc...).
Note that I never tried this myself so I'm unaware of possible issues other
than the profile thing.

Willy.
PS The bug in CreateProcessWithLogonW was corrected in XP SP2 and W2K3 SP1,
so this should not be an issue.

Reply to this Message

Impersonate and Activator.CreateInstance

Free Magazines