title: How to have service ImpersonateLoggedOnUser but with high mandatory integrity level?
body: <p>According to <a href="https://stackoverflow.com/questions/651708/blocking-mouse-input-from-a-service-in-vista">Blocking mouse input from a service in Vista</a> BlockInput() requires a high mandatory integrity level.  Also, a service cannot make use of the function since it doesn't run on the desktop.  Whenever the occasional interaction with the desktop is required, I have the service temporarily ImpersonateLoggedOnUser() and then RevertToSelf()
  However, the logged on user is not Administrator.  So how do I set the integrity level to high during some impersonations so I can BlockInput()?  I could not figure out from the MSDN documentation about modifying the token that ImpersonateLoggedOnUser() takes.  Any help?</p>
  
  <p>Thanks</p>
  
  <p>[Edit:] Tried modifying my impersonation code as follows:</p>
  
  <p>Previously, I had code like this that impersonates a user to access the user's registry and files (and at a later point start a user program with CreateProcessAsUser()):</p>
  
  <pre><code>if (!WTSQueryUserToken(sid, &amp;token))  throw "ERROR: Could not get logged on user token";
  if (!DuplicateTokenEx(token, TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ADJUST_DEFAULT | TOKEN_IMPERSONATE, 0, SecurityImpersonation, TokenPrimary, &amp;userTok))
  {
      CloseHandle(token);
      throw "ERROR: Could not duplicate user token";
  }
  CloseHandle(token);
  if (!ImpersonateLoggedOnUser(userTok)) throw "ERROR: Could not impersonate logged on user";
  ... // Do stuff needing impersonation
  if (!RevertToSelf()) throw "ERROR: Could not revert to self";
  </code></pre>
  
  <p>Doing BlockInput(1); Sleep(5000); right after ImpersonateLoggedOnUser() doesn't block input.  So I tried adding the following right before ImpersonateLoggedOnUser():</p>
  
  <pre><code>PSID sid(0);
  if (!ConvertStringSidToSid(SDDL_ML_HIGH, &amp;sid)) throw "ERROR: Could not convert string to SID";
  TOKEN_MANDATORY_LABEL tml;
  tml.Label.Attributes = SE_GROUP_INTEGRITY | SE_GROUP_INTEGRITY_ENABLED;
  tml.Label.Sid = sid;
  if (!SetTokenInformation(userTok, TokenIntegrityLevel, &amp;tml, sizeof(tml) + GetLengthSid(sid)))) throw "ERROR: Could not set token information";
  LocalFree(sid);
  </code></pre>
  
  <p>I get no errors during execution, indicating it should be setting it right.  But input still doesn't get blocked!</p>