CreateProcessAsUser under Local System Admin returns "5: acces denied"

Question

I've been struggling to launch a process started under Local System Account (via remote deployment service) under another registered user account. I've followed these steps:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa379608%28v=vs.85%29.aspx

And it works on my local XP-machine. I.e. my process is started from the registered user account and executes everything in the right context. But one of the users (also on XP) has issues, getting error code 5 after CreateProcessAsUser. I cannot reproduce this and am trying to investigate why this is happening. Interestingly I even removed the permissions to Read/Execute for my registered admin on a specific folder I've got my exe in, but it still runs everything, so I'm not quite sure where to look to find the source of the problem. I would appreciate any advice in which direction to look in order to resolve this. Maybe you've had similar experience and managed to find a way how to resolve this?

Thanks!

PS I'm simulating local system admin via psexec /si cmd

Answer 1

In the end problem was to do with the local security policy restriction for Local System account + enabling all privileges on the token allowed to start the process. As for SCCM, once I completely followed MSDN example and interactions were enabled on SCCM-package, things worked fine.