One of our modules is an executable that will always be run as administrator (after getting permission from user). One of its screens allows the user to run a different executable, which the code currently does by CreateProcess. The problem is that since the first process is running as admin, CreateProcess has the second process run as admin also. This is undesirable because it is a security breach (the second process can open browse dialogs that should not have admin privileges in this scenario). How do I get the second to run without admin privileges? I do NOT want attach a manifest to the second exe that says it does not want admin privileges because under certain circumstances (not from the first exe), it SHOULD be run with admin privileges. I would have expected CreateProcess to allow control over the privileges to be given to the child process, but can not find any documentation for this. Help!
Well in that case CreateProcessAsUser is the exact API you want to use. By passing in a restricted token, you can limit the privilege of your spawn process. You can almost copy the code from the URL I gave above.
解决方案 »
免费领取超大流量手机卡，每月29元包185G流量+100分钟通话, 中国电信官方发货