note 50049 added to ref.exec

You may have issues with RUNAS or CPAU using the exec function on win2k server (Fully patched as of 2005 in my case), Windows 2k3, Windows XP SP2 may require special consideration if your services use the local system account. It seems Microsoft changed the CreateProcessWithLogonW API call in the backend that makes it incompatible with localsystem account. This means that some applications WILL NOT RUN, the process will not be created, it will be denied. At first i thought this was a permissions issue, however after looking into it, its clear that it is not. A solution to the issue is to modify the system service that your web server uses to run from the local system account. In my case this was not an option as the WWW (iss) services on win2k server are integrated with other services which will cause problems. Microsoft have come up with a solution in a vbs script. The following is a quote from a Microsoft support e-mail, it was aimed at winXP sp2. I have no idea if it will resolve the issue on win2k / win2k3 machines at the moment. "Thank You for contacting Microsoft Support in regards to your question with CreateProcessWithLogonW() not working on XP SP2 from the localsystem account. In our internal support database I’ve found the following answer from an American colleague to exactly the same question: “The code for CreateProcessWithLogonW() was changed in SP2 to have the same behavior as Windows Server 2003. One of the things CreateProcessWithLogonW() will do ensure that the child process has access to the windowstation/desktop if lpDesktop member is specified to NULL or empty string. On Windows XP SP1, the operating system would grant explicit access to the child process for the windowstation/desktop of the parent process. On Windows XP SP2, the API determines the logon SID of the parent process and adds this to the token of the child process so the API doesn't need to modify the DACLs for the windowstation/desktop. This will not work with the localsystem account since it doesn't have a Logon SID. If you would like to launch the process interactively (ie winsta0\default) with XP SP2, you'll need to do the following: 1. set lpDesktop to "winsta0\\default". 2. grant the user in the CreateProcessWithLogonW() call access to "winsta0\\default". The following KB article has sample code on modifying the security using VB: 316440 How To Use Low-Level Access Control APIs from Visual Basic http://kb/article.asp?id=Q316440 The function you need to look at is: UpdatePermissionsOfUserObject() To determine what type of permissions should be granted. Please take a look at the following article: 165194 INFO: CreateProcessAsUser() Windowstations and Desktops http://kb/article.asp?id=Q165194 #define WINSTA_ALL (WINSTA_ACCESSCLIPBOARD | WINSTA_ACCESSGLOBALATOMS | WINSTA_CREATEDESKTOP | WINSTA_ENUMDESKTOPS | WINSTA_ENUMERATE | WINSTA_EXITWINDOWS | WINSTA_READATTRIBUTES | WINSTA_READSCREEN | WINSTA_WRITEATTRIBUTES | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER) #define DESKTOP_ALL (DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_ENUMERATE | DESKTOP_HOOKCONTROL | DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | DESKTOP_READOBJECTS | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER) The values for the above defines are in winuser.h. I have tested this from localsystem account with XPSP2 and it works using the code from the above article, 165194.” ---- Manual Page -- http://www.php.net/manual/en/ref.exec.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+50049 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+50049&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+50049&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+50049&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+50049&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+50049&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+50049&report=yes Search -- http://master.php.net/manage/user-notes.php