Why does Windows not allow WinSock to be started while impersonating another user

Question

Using my own program or others I can't get winsock to run when calling if the process is created with CreateProcessWithLogonW or CreateProcessAsUserW. It returns this error when I create the socket:

WSAEPROVIDERFAILEDINIT 10106

Service provider failed to initialize.

The requested service provider could not be loaded or initialized.

This error is returned if either a service provider's DLL could not be loaded (LoadLibrary failed) or the provider's WSPStartup or NSPStartup function failed

.

However, WSAStartup seems to go w/o an error. Just creating the socket with WSASocket returns this.

UPDATE:

Errors:

LoadUserProfile: Error Code 2. Can't find file specified

AdjustTokenPrivs: Error Code 5. Access Denied

Answer 1

You have to have the Act As Operating Priv

Answer 2

I encountered exactly the same problem and it was due to the environment (!): Apparently WinSock expects a valid SystemRoot environment variable to be set. In my case I was calling CreateProcess() by specifying only one environment variable specific to my app (without inheriting the caller's environment), and it was failing.

Check that you created your process by either passing NULL to lpEnvironment to inherit the caller's environment, or specify a valid SystemRoot environment variable.

Completely undocumented AFAIK, but it worked for me.

Answer 3

Perhaps the user you executed the process with isn't allowed to use the TCP/IP stack?

Try to start the application with an administrator user that is not your own account.

Answer 4

Run Process Monitor on it and see if it is failing to find a file or registry key. Perhaps the impersonated user's profile is not loaded and Winsock (or a service provider it is trying to load) is looking for something there.

Answer 5

Always start WinSock near the top of main and leave it running. The need to start winsock is an accident of architecture and not germain to any problem domain anymore.

Answer 6

May be you lack the required privileges to run the process as another user. Try getting the handle to the access token by a call to OpenProcessToken and add SE_IMPERSONATE_NAME by a call to AdjustTokenPrivileges and then call CreateProcessAsUserW. I have not tried this myself though.
Code snippet in Python to do something similar with win32 calls