The openprocesstoken function enables an access token associated with a process. Its prototype is as follows:
Bool openprocesstoken (
Handle processhandle,
DWORD desiredaccess,
Phandle tokenhandle
);
As mentioned in msdn, for Windows XP Professional, if a computer is added to a working group and the "Force network logons using local accounts to authenticate as guest" restriction is activated, this function will fail.
In addition, if the token_all_access request is used during the call, the function may also fail. This is because token_all_access may contain token_adjust_sessionid (defined in winnt. h ). Token_adjust_sessionid is a new access mask, which is added in Windows 2000 and Windows XP. In Windows NT 4.0, this value is not in the access control list of the access token. Therefore, if an application Program Is to use winnt in the new platform SDK. h. If token_all_access is specified when openprocesstoken () or openthreadtoken is called, the function fails to run in Windows NT 4.0 (error_access_denied is returned by getlasterror ).
You can request the access_system_security access right to a process object if you want to read or write the object's SACL. for more information, see access-control lists (ACLs) and SACL access right.
