title: How do I verify a COM object can be instantiated from under another user?
body: <p>I have the following setup. There's a Azure web role process (WaIISHost.exe) running elevated and there's IIS7 application pool running under a local user. The local user is being created by the elevated WaIISHost.exe when it first runs. There's also an out-proc COM object registered with DCOM.</p>
  
  <p>I want to be sure that the IIS process will be able to instantiate the COM object. So I need to somehow login under the local user and try to instantiate the COM object.</p>
  
  <p>My current approach is to call <code>LogonUser()</code> (requesting interactive logon) via P/Invoke, obtain a logon token, then start a new thread and from that thread call <code>ImpersonateLoggedOnUser()</code> to switch to the other user and once that is done the other thread tries to instantiate the COM object.</p>
  
  <p>All great, except <a href="http://support.microsoft.com/kb/2859054/en-us" rel="nofollow">the interactive logon is only for Administrators by default now</a> so my approach no longer works - I get</p>
  
  <blockquote>
    <p>Logon failure: the user has not been granted the requested logon type at this computer</p>
  </blockquote>
  
  <p>yet if I just skip the check the IIS later instantiates the COM object just fine.</p>
  
  <p>So I need to change my validation code.</p>
  
  <p>One option is to try add the required privilege (interactive logon) to the user, but that's lots of P/Invoke code plus there's a chance that at come point Microsoft changes something else and I'm disallowed to adjust privileges altogether.</p>
  
  <p>Is there another way to verify that a COM object can be successfully instantiated from under another user account?</p>