title: How to get Windows SYSTEM user token
body: <p>Operating system is Windows 7 or higher with UAC enabled. Calling process has admin rights, already confirmed by the UAC box.</p>
  
  <p>I want to spawn a new Console window (cmd.exe) under user SYSTEM (don't ask why). I can do this interactively by using PsExec tool from Sysinternals or something similar, but I don't have the source code and I need to understand how this works.</p>
  
  <p>I understand that I have to call CreateProcessAsUser() and that works fine with the first parameter (hToken) set to NULL, but now I need to know how to get the hToken. I understand that I can get such a token by calling LogonUser() - but not for SYSTEM. How would I get the token for SYSTEM?</p>
  
  <p>I thought of using DuplicateTokenEx(), but that requires an original token, that I don't have.</p>
  
  <p>Would I have to query the process list, find any SYSTEM process and try to get that token duplicated or something? I don't want to reverse engineer the PsExec tool or one of the others doing exactly this.</p>