Do I need SE_SHUTDOWN_NAME privilege to log off a user?

Question

I need to log off a user from a C++ program. I use ExitWindowsEx API for that, but I'm not sure from the documentation if I need any special privileges for that?

Answer 1

You do. Here's an example

bool ShutdownWindows(void)
{
HANDLE hToken = NULL; 
TOKEN_PRIVILEGES tkp = {0};
bool bRet = false;

// Get a token for this process. 
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
    if (LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid)) {
        tkp.PrivilegeCount = 1;  // one privilege to set    
        tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

        // Get the shutdown privilege for this process. 
        if (AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, 0)) {
            ::CloseHandle(hToken);

            if (ERROR_SUCCESS == GetLastError()) {

                DWORD dwFlags = EWX_POWEROFF;
                DWORD dwReason = SHTDN_REASON_MAJOR_SYSTEM;

                if (ExitWindowsEx(dwFlags, dwReason)) {
                    bRet = true;
                }
            }
        }
    }
}

return bRet; 

} // ShutdownWindows