Can't disable SeDebugPrivilege of my own process

Question

I am trying to disable my own process's SE_DEBUG_NAME (SeDebugPrivilege) permissions to learn about adjusting tokens in processes.

Like I am doing with Process Hacker. I have an option to change this permissions to remote processes.

But for the beginning I want to be able to change my own process's token permissions.

I am running Visual Studio with Run As administrator and therefore my process has High integrity and SeDebugPrivilege is enabled.

I read here and took the code from here and made a little change, instead of enabling I changed it to disabling:

#include "stdafx.h"
#include <Windows.h>
#include <sddl.h>
#include <cstdio>
#include <tlhelp32.h>
#include <iostream>
#include <fstream>
using namespace std;
//#pragma comment(lib, "cmcfg32.lib")

BOOL SetPrivilege(
    HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
)
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if (!LookupPrivilegeValue(
        NULL,            // lookup privilege on local system
        lpszPrivilege,   // privilege to lookup 
        &luid))        // receives LUID of privilege
    {
        printf("LookupPrivilegeValue error: %u\n", GetLastError());
        return FALSE;
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if (!AdjustTokenPrivileges(
        hToken,
        FALSE,
        &tp,
        sizeof(TOKEN_PRIVILEGES),
        (PTOKEN_PRIVILEGES)NULL,
        (PDWORD)NULL))
    {
        printf("AdjustTokenPrivileges error: %u\n", GetLastError());
        return FALSE;
    }

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
        printf("The token does not have the specified privilege. \n");
        return FALSE;
    }

    return TRUE;
}


int main()
{
    HANDLE hToken;

    if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken))
    {
        if (GetLastError() == ERROR_NO_TOKEN)
        {
            if (!ImpersonateSelf(SecurityImpersonation))
                return RTN_ERROR;

            if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken)) {
                //DisplayError("OpenThreadToken");
                return RTN_ERROR;
            }
        }
        else
            return RTN_ERROR;
    }

    // disable SeDebugPrivilege
    if (!SetPrivilege(hToken, SE_DEBUG_NAME, FALSE))
    {
        // DisplayError("SetPrivilege");

        // close token handle
        CloseHandle(hToken);

        // indicate failure
        return RTN_ERROR;
    }

    return 0;
}

I am running it on debug mode but I don't see any changes on the process's token. The SeDebugPrivilege is still enabled.

I don't receive any errors.
Any idea what can be the problem ?

Answer 1

I understood what was my problem.
I needed to use OpenProcessToken.

So I only needed to change the beginning of the main:

HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, GetCurrentProcessId());

if (hProc == NULL)
{
    // error
}

HANDLE hToken;
if (!OpenProcessToken(hProc, TOKEN_ADJUST_PRIVILEGES, &hToken))
{
    // error
}