🚀 go-pugleaf

OK, got it working, creating the user was the easy part, adding "Log on 
as Service" rights was tricky - so I place the code here for anyone 
interested.....

//---------------------------------------------------------------------------

void AnsiStringToLsaStr(LPSTR AValue,PLSA_UNICODE_STRING lsa)
{
   lsa->Length=(USHORT)(lstrlen(AValue)*2);
   lsa->MaximumLength=(USHORT)(lsa->Length+2);
   lsa->Buffer=(PWSTR)malloc(lsa->MaximumLength);

 
MultiByteToWideChar(NULL,NULL,(LPCSTR)AValue,lstrlen(AValue),lsa->Buffer,lsa->MaximumLength);
}

//---------------------------------------------------------------------------

int AddRunAsSERVICEPrev(char *user)
{
    String usr =  user;
    TCHAR szName[256]; ULONG sz=256;
    GetComputerName  (szName, &sz);
    String pc =  szName;
    DWORD cch_referenced_domain = 0;
    // zero so we can get the needed size

    PSID psid = NULL;
    LPTSTR referenced_domain = NULL;
    DWORD cb_sid = 0;
    SID_NAME_USE pe_use;
    LSA_HANDLE lsah;
    ErrorText = "";

    LookupAccountName(pc.c_str(),
		usr.c_str(),
		 psid,   // SID of interest
		 &cb_sid, // size of SID
                  referenced_domain,   // domain account was found on
                 &cch_referenced_domain,
                 &pe_use );

    psid = (PSID)HeapAlloc(GetProcessHeap(), 0, cb_sid);
    referenced_domain = (LPTSTR)HeapAlloc( GetProcessHeap(), 0, 
cch_referenced_domain * sizeof(TCHAR));

    ULONG ret = LookupAccountName(pc.c_str(),
                 usr.c_str(),
     		psid,                // SID of interest
		&cb_sid,             // size of SID
                 referenced_domain,   // domain account was found on
                 &cch_referenced_domain,
                 &pe_use );

    LSA_UNICODE_STRING lsaPCName;
    AnsiString asPCName = szName;
    AnsiStringToLsaStr(asPCName.c_str(), &lsaPCName);

    LSA_OBJECT_ATTRIBUTES lsaOA = { 0 };
    lsaOA.Length = sizeof(lsaOA);
    NTSTATUS ntStatus = LsaOpenPolicy(&lsaPCName,
                        &lsaOA,
                        POLICY_ALL_ACCESS, &lsah);

    ULONG LastError = LsaNtStatusToWinError(ntStatus);
    if (LastError != ERROR_SUCCESS)
    {
    char *lpMsgBuf;
    FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
                   FORMAT_MESSAGE_FROM_SYSTEM,
                   NULL, LastError,
                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                   // Default language
                   (LPTSTR) &lpMsgBuf, 0, NULL );

    ErrorText = lpMsgBuf;
    free(lsaPCName.Buffer);
    free(lpMsgBuf);
    }

    LSA_UNICODE_STRING lsaUserRights;
// Could be used as a parameter to make function generic...
    AnsiString asUserRights = SE_SERVICE_LOGON_NAME;
    AnsiStringToLsaStr(asUserRights.c_str(), &lsaUserRights);

    ntStatus = LsaAddAccountRights(lsah, psid, &lsaUserRights, 1);
    LastError = LsaNtStatusToWinError(ntStatus);
    if (LastError != ERROR_SUCCESS)
    {
    char *lpMsgBuf;
    FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
                   FORMAT_MESSAGE_FROM_SYSTEM,
                   NULL, LastError,
                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                   // Default language
                   (LPTSTR) &lpMsgBuf, 0, NULL );

    ErrorText = lpMsgBuf;
    free(lsaPCName.Buffer);
    free(lsaUserRights.Buffer);
    free(lpMsgBuf);
    }

    LsaClose(lsah);
    free(lsaPCName.Buffer);
    free(lsaUserRights.Buffer);
    return ret;
}



Remy Lebeau (TeamB) wrote:
> "Colin B Maharaj" <noreply@myhost.com> wrote in message
> news:43d636c5@newsgroups.borland.com...
> 
> 
>>Hi all, I need to programatically create an admin
>>account with 'Run as Service' privileges.
> 
> 
> Look at the Net...() functions, such as NetUserAdd() and NetUserSetGroups().
> Have a look at #Q140165 (http://support.microsoft.com/kb/140165/en-us) for
> considerations regarding creating new accounts programmably.
> 
> 
>>I want to install a service but not run it in the LOCAL SYSTEM
>>account but another account with fewer privileges.
> 
> 
> There are pre-installed accounts for that, such as LOCALSERVICE and
> NETWORKSERVICE.
> 
> 
> Gambit
> 
>