Create process by system with delphi -

how create process system nt authority account in delphi ? there api such createprocessasuser function.

1. you need create service installed & starts @ run time itself.
2. on service execute procedure call createprocessasuserw token of winlogon.exe process.

notes

1. if want new proccess runs in same caller session call wtsqueryusertoken wtsgetactiveconsolesessionid current active user token call createenvironmentblock token, , assinge received pointer on createprocessasuserw.
2. set random name & displayname (such created time) service. if want run multiple system process same serevice.

here use

usysaccount.pas

unit usysaccount;  interface  uses   winsvc,   svcmgr,   winapi.windows,   system.sysutils,   tlhelp32,   system.classes;  type   tssysaccount = class(tservice)     procedure serviceexecute(sender: tservice);   private     lpapplicationname,     lpcommandline,     lpcurrentdirectory: pwidechar;   public     function getservicecontroller: tservicecontroller; override;   end;  procedure createprocessassystem(const lpapplicationname: pwidechar;                               const lpcommandline:pwidechar = nil;                               const lpcurrentdirectory: pwidechar  = nil); var    ssysaccount: tssysaccount;  implementation  {$r *.dfm}  function wtsqueryusertoken(sessionid: ulong; var phtoken: thandle): bool; stdcall; external 'wtsapi32.dll';   type     tserviceapplicationex = class(tserviceapplication)     end;     tserviceapplicationhelper = class helper tserviceapplication     public       procedure servicesregister(install, silent: boolean);     end;  function isuseranadmin: bool; stdcall; external 'shell32.dll' name 'isuseranadmin';  function createenvironmentblock(var lpenvironment: pointer; htoken: thandle;                                     binherit: bool): bool;                                     stdcall; external 'userenv.dll';  function destroyenvironmentblock(penvironment: pointer): bool; stdcall; external 'userenv.dll';   function _getintegritylevel() : dword; type     ptokenmandatorylabel = ^ttokenmandatorylabel;     ttokenmandatorylabel = packed record     label_ : tsidandattributes;   end; var    htoken : thandle;    cbsize: dword;    ptil : ptokenmandatorylabel;    dwtokenuserlength: dword; begin     result := 0;     dwtokenuserlength := maxchar;     if openprocesstoken(getcurrentprocess(), token_query, htoken) begin         ptil := pointer(localalloc(0, dwtokenuserlength));         if ptil = nil exit;         cbsize := sizeof(ttokenmandatorylabel);         if gettokeninformation(htoken, tokenintegritylevel,                                     ptil, dwtokenuserlength, cbsize)         if isvalidsid( (ptil.label_).sid )           result := getsidsubauthority((ptil.label_).sid, getsidsubauthoritycount((ptil.label_).sid )^ - 1)^;         if htoken <> invalid_handle_value         closehandle(htoken);         localfree(cardinal(ptil));     end; end;  function isuseransystem(): boolean; const      security_mandatory_system_rid = $00004000; begin      result := (_getintegritylevel = security_mandatory_system_rid); end;  function starttheservice(service:tservice): boolean; var    scm: sc_handle;    servicehandle: sc_handle; begin     result:= false;     scm:= openscmanager(nil, nil, sc_manager_all_access);     if (scm <> 0)     begin         try             servicehandle:= openservice(scm, pchar(service.name), service_all_access);             if (servicehandle <> 0)             begin                 result := startservice(servicehandle, 0, pchar(nil^));                 closeservicehandle(servicehandle);             end;                     closeservicehandle(scm);         end;     end; end;  procedure setservicename(service: tservice); begin      if assigned(service) begin         service.displayname := 'run system service created ' + datetimetostr(now);         service.name        := 'runassystem' + formatdatetime('ddmmyyyyhhnnss', now);      end; end;  procedure createprocessassystem(const lpapplicationname: pwidechar;                               const lpcommandline:pwidechar = nil;                               const lpcurrentdirectory: pwidechar  = nil); begin     if not ( isuseranadmin ) begin        setlasterror(error_access_denied);        exit();     end;      if not ( fileexists(lpapplicationname) ) begin        setlasterror(error_file_not_found);        exit();     end;      if ( isuseransystem )     begin          svcmgr.application.initialize;          svcmgr.application.createform(tssysaccount, ssysaccount);          ssysaccount.lpapplicationname  := lpapplicationname;          ssysaccount.lpcommandline      := lpcommandline;          ssysaccount.lpcurrentdirectory := lpcurrentdirectory;          setservicename(ssysaccount);          svcmgr.application.run;     end     else begin         svcmgr.application.free;         svcmgr.application := tserviceapplicationex.create(nil);         svcmgr.application.initialize;         svcmgr.application.createform(tssysaccount, ssysaccount);         setservicename(ssysaccount);         svcmgr.application.servicesregister(true, true);         try            starttheservice(ssysaccount);                    svcmgr.application.servicesregister(false, true);         end;     end; end;  procedure tserviceapplicationhelper.servicesregister(install, silent: boolean); begin      registerservices(install, silent); end;  procedure servicecontroller(ctrlcode: dword); stdcall; begin      ssysaccount.controller(ctrlcode); end;  function tssysaccount.getservicecontroller: tservicecontroller; begin      result := servicecontroller; end;  function processidfromappname32( szexefilename: string ): dword; var     snapshot: thandle;     processentry: tprocessentry32; begin        result := 0;        szexefilename := uppercase( szexefilename );        snapshot := createtoolhelp32snapshot(                   th32cs_snapprocess,                   0 );      if snapshot <> 0        try           processentry.dwsize := sizeof( processentry );           if process32first( snapshot, processentry )           repeat                   if pos( szexefilename,                       uppercase(extractfilename(                       strpas(processentry.szexefile)))                       ) > 0                   begin                        result:= processentry.th32processid;                    break;                   end;         until not process32next( snapshot, processentry );                    closehandle( snapshot );      end;   end;  function terminateprocessbyid(processid: cardinal): boolean; var    hprocess : thandle; begin      result := false;      hprocess := openprocess(process_terminate,false,processid);      if hprocess > 0      try         result := win32check(terminateprocess(hprocess,0));              closehandle(hprocess);      end; end;  procedure tssysaccount.serviceexecute(sender: tservice); var    htoken, husertoken: thandle;    startupinfo : tstartupinfow;    processinfo : tprocessinformation;    p : pointer; begin      if not wtsqueryusertoken(wtsgetactiveconsolesessionid, husertoken) exit;       if not openprocesstoken(                              openprocess(process_all_access, false,                              processidfromappname32('winlogon.exe'))                              ,                              maximum_allowed,                              htoken) exit;       if createenvironmentblock(p, husertoken, true)      begin           zeromemory(@startupinfo, sizeof(startupinfo));           startupinfo.lpdesktop := ('winsta0\default');           startupinfo.wshowwindow := sw_shownormal;           if createprocessasuserw(                 htoken,                 lpapplicationname,                 lpcommandline,                 nil,                 nil,                 false,                 create_unicode_environment,                 p,                 lpcurrentdirectory,                 startupinfo,                 processinfo)           begin            end;           closehandle(processinfo.hprocess);           closehandle(processinfo.hthread);           destroyenvironmentblock(p);      end;       closehandle(htoken);      closehandle(husertoken);       terminateprocessbyid(getcurrentprocessid); end;  end. 

usysaccount.dfm

object ssysaccount: tssysaccount   oldcreateorder = false   displayname = 'ssysaccount'   onexecute = serviceexecute   height = 150   width = 215 end 

usage follow ( must run administrator )

program project7;  uses   usysaccount; {$r *.res}  begin      createprocessassystem('c:\windows\system32\cmd.exe'); end.