title: Windows Vista/Windows 7 privilege: SeDebugPrivilege & OpenProcess
body: <p>Everything I've been able to find about escalating to the appropriate privileges for my needs has agreed with my current methods, but the problem exists. I'm hoping maybe someone has some Windows Vista/Windows 7 internals experience that might shine some light where there is only darkness. I'm sure this will get long, but please bear with me.</p>
  <h3>Context</h3>
  <p>I'm working on an application that requires accessing the memory of other processes on the current machine. This, obviously, requires administrator rights. It also requires <code>SeDebugPrivilege</code> (no, it is not a misspelling of <code>SetDebugPrivilege</code>), which I believe myself to be acquiring correctly, although I question if more privileges aren't necessary and thus the cause of my problems. Code has so far worked successfully on all versions of Windows XP, and on my test Vista 32 bit and Windows 7 64 bit environments.</p>
  <h3>Process</h3>
  <ul>
  <li>Program will <em>Always</em> be run with Administrator Rights. This can be assumed throughout this post.</li>
  <li>Escalating the current process's <code>Access Token</code> to include <code>SeDebugPrivilege</code> rights.</li>
  <li>Using <code>EnumProcesses</code> to create a list of current PIDs on the system</li>
  <li>Opening a handle using <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a> with <code>PROCESS_ALL_ACCESS</code> access rights</li>
  <li>Using <code>ReadProcessMemory</code> to read the memory of the other process.</li>
  </ul>
  <h3>Problem:</h3>
  <p>Everything has been working fine during development and my personal testing (including Windows XP 32 &amp; 64, Windows Vista 32, and Windows 7 x64). However, during a test deployment onto both Windows Vista (32-bit) and Windows 7 (64-bit) machines of a colleague, there seems to be a privilege/rights problem with <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a> failing with a generic <code>Access Denied</code> error. This occurs both when running as a limited User (as would be expected) and also when run explicitly as Administrator (Right-click → <em>Run as Administrator</em> and when run from an Administrator level command prompt).</p>
  <p>However, this problem has been unreproducible for myself in my test environment. I have witnessed the problem first hand, so I trust that the problem exists. The only difference that I can discern between the actual environment and my test environment is that the <em>actual</em> error is occurring when using a Domain Administrator account at the UAC prompt, whereas my tests (which work with no errors) use a local administrator account at the UAC prompt.</p>
  <p>It appears that although the credentials being used allow UAC to 'run as administrator', the process is still not obtaining the correct rights to be able to <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a> on another process. I am not familiar enough with the internals of Vista/Windows 7 to know what this might be, and I am hoping someone has an idea of what could be the cause.</p>
  <h3>The Kicker</h3>
  <p>The person who has reported this error, and who's environment can regularly reproduce this bug, has a small application named along the lines of <code>RunWithDebugEnabled</code> which is a small bootstrap program which appears to escalate its own privileges and then launch the executable passed to it (thus inheriting the escalated privileges). When run with this program, using the same Domain Administrator credentials at UAC prompt, the program works correctly and is able to successfully call <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a> and operates as intended.</p>
  <p>So this is definitely a problem with acquiring the correct privileges, and it is known that the Domain Administrator account <em>is</em> an administrator account that should be able to access the correct rights. (Obviously obtaining this source code would be great, but I wouldn't be here if that were possible).</p>
  <h3>Notes</h3>
  <p>As noted, the errors reported by the failed <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a> attempts are <code>Access Denied</code>. According to MSDN documentation of <a href="http://msdn.microsoft.com/en-us/library/ms684320%28VS.85%29.aspx" rel="noreferrer"><code>OpenProcess</code></a>:</p>
  <blockquote>
  <p><em>If the caller has enabled the SeDebugPrivilege privilege, the requested access is granted regardless of the contents of the security descriptor.</em></p>
  </blockquote>
  <p>This leads me to believe that perhaps there is a problem under these conditions either with (1) Obtaining <code>SeDebugPrivileges</code> or (2) Requiring other privileges which have not been mentioned in any MSDN documentation, and which might differ between a Domain Administrator account and a Local Administrator account</p>
  <h3>Sample Code:</h3>
  <pre><code>void sample()
  {
     /////////////////////////////////////////////////////////
     //   Note: Enabling SeDebugPrivilege adapted from sample
     //     MSDN @ http://msdn.microsoft.com/en-us/library/aa446619%28VS.85%29.aspx
     // Enable SeDebugPrivilege
     HANDLE hToken = NULL;
     TOKEN_PRIVILEGES tokenPriv;
     LUID luidDebug;
     if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &amp;hToken) != FALSE)
     {
        if(LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &amp;luidDebug) != FALSE)
        {
           tokenPriv.PrivilegeCount           = 1;
           tokenPriv.Privileges[0].Luid       = luidDebug;
           tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
           if(AdjustTokenPrivileges(hToken, FALSE, &amp;tokenPriv, 0, NULL, NULL) != FALSE)
           {
              // Always successful, even in the cases which lead to OpenProcess failure
              cout &lt;&lt; &quot;SUCCESSFULLY CHANGED TOKEN PRIVILEGES&quot; &lt;&lt; endl;
           }
           else
           {
              cout &lt;&lt; &quot;FAILED TO CHANGE TOKEN PRIVILEGES, CODE: &quot; &lt;&lt; GetLastError() &lt;&lt; endl;
           }
        }
     }
     CloseHandle(hToken);
     // Enable SeDebugPrivilege
     /////////////////////////////////////////////////////////
  
     vector&lt;DWORD&gt; pidList = getPIDs();  // Method that simply enumerates all current process IDs
  
     /////////////////////////////////////////////////////////
     // Attempt to open processes
     for(int i = 0; i &lt; pidList.size(); ++i)
     {
        HANDLE hProcess = NULL;
        hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pidList[i]);
        if(hProcess == NULL)
        {
           // Error is occurring here under the given conditions
           cout &lt;&lt; &quot;Error opening process PID(&quot; &lt;&lt; pidList[i] &lt;&lt; &quot;): &quot; &lt;&lt; GetLastError() &lt;&lt; endl;
        }
        CloseHandle(hProcess);
     }
     // Attempt to open processes
     /////////////////////////////////////////////////////////
  }
  </code></pre>
  <br/>
  <br/>
  <br/>
  <p><strong>Thanks!</strong></p>
  <p>If anyone has some insight into what possible permissions, privileges, rights, etc. that I may be missing to correctly open another process (assuming the executable has been properly &quot;Run as Administrator&quot;ed) on Windows Vista and Windows 7 under the above conditions, it would be most greatly appreciated.</p>
  <p>I wouldn't be here if I weren't absolutely stumped, but I'm hopeful that once again the experience and knowledge of the group shines bright. I thank you for taking the time to read this wall of text. The good intentions alone are appreciated, thanks for being the type of person that makes Stack Overflow so useful to all!</p>