CreateProcessAsUser from service has security issues accessing a remote machine

Question

I'm trying to synchronize my local (remote) database with a centralized consolidated database on the server (using Sybase database). The synchronization has to happen at a scheduled time, and i am using "CreateProcessByUser". To initiate the synchronization process, i am using dbremote.exe provided by sybase.

The constructed commandLine argument is:
commandLine = dbremote.exe -l 512K -x -k -c "dsn=HOME**;uid=dba;pwd=***;cs=none;DBKEY=***" -os 10000000 -o "c:\data\test\dbremote.log" "c:\data\test"

BOOL startA_Process( HANDLE hToken, _TCHAR *commandLine, PROCESS_INFORMATION *pi, BOOL wait, _TCHAR *errBuf){

STARTUPINFO sStartupInfo;

DWORD   dwExitCode;
DWORD   dwStatus        = 0;
DWORD   dwCreationFlags = CREATE_NEW_CONSOLE;
int     iResult;
BOOL    bInheritHandles = FALSE;

LPCTSTR     pszApplicationName      = NULL;
LPCTSTR     pszCurrentDirectory     = NULL;
LPVOID      pvEnvironment           = NULL;

LPSECURITY_ATTRIBUTES psProcessAttributes   = NULL;
LPSECURITY_ATTRIBUTES psThreadAttributes    = NULL;

//
// Initilize STARTUPINFO structure
//
ZeroMemory( &sStartupInfo, sizeof( sStartupInfo ) );
sStartupInfo.cb = sizeof( sStartupInfo );
sStartupInfo.lpTitle = _T("AutoSychDBRemote");
sStartupInfo.lpDesktop = _T("winsta0\\default");
//
// Initilize PROCESS_INFORMATION structure
//
ZeroMemory( pi, sizeof( PROCESS_INFORMATION ) );

iResult = ::CreateProcessAsUser(
    hToken,                     // handle to a token representing the logged-on user
    pszApplicationName,             // name of executable module
    (LPTSTR)commandLine,            // command line string
    psProcessAttributes,            // process security attributes
    psThreadAttributes,             // thread security attributes
    bInheritHandles,                // whether new process inherits handles
    dwCreationFlags,                // creation flags
    pvEnvironment,                  // pointer to new environment block
    pszCurrentDirectory,            // pointer to current directory name
    &sStartupInfo,                  // pointer to STARTUPINFO
    pi                              // pointer to PROCESS_INFORMATION
);

The process is executed on the remote machine and when the synchronization happens the messages should be exchanged between remote and consolidated databases.

If i execute the above commandline from the windows command prompt, the synchronization work successfully. But when triggered by CreateProcessAsUser at a scheduled time i see the below error message in the log file:

Log file:

I. 2013-04-11 11:17:11. Sending message to "BTI"
I. 2013-04-11 11:17:11. sopen "\\IPaddress\Databases\Production\messages\consolid\Rem00005.g" failure 1326: Invalid argument
I. 2013-04-11 11:17:11. sopen "\\IPaddress\Databases\Production\messages\consolid\Rem00005.h" failure 1326: Invalid argument
I. 2013-04-11 11:17:13. sopen "\\IPaddress\Databases\Production\messages\consolid\Rem00005.i" failure 1326: Invalid argument
I. 2013-04-11 11:17:13. sopen "\\IPaddress\Databases\Production\messages\consolid\Rem00005.j" failure 1326: Invalid argument
I. 2013-04-11 11:17:13. sopen "\\IPaddress\Databases\Production\messages\consolid\Rem00005.k" failure 1326: Invalid argument
E. 2013-04-11 11:17:13. Error sending message
I. 2013-04-11 11:17:13. Resend requests are being queued
I. 2013-04-11 11:17:14. Execution completed

where "\\IP address\Databases\Production\messages\consolid" is the folder on the server where messages from remote machine are copied

I request your help on this. Why am i able to synchronize from the command prompt and why not from the 'CreateProcessAsUser'? Why does the process fails to send messages to the above path on the server.

Few things that i already tried:

1. I am logging-in to the app using my windows domain name and credentials and in the code using the ::LogonUser(). I have double checked that i am sending valid credentials.

2. Using explorer, I can successfully navigate to the above path on the server and can add/remove files.

3. I have added my user-id to the "Local security setting" under Administrative tools >> Local security policy.

Any suggestions are appreciated.

Answer 1

I was able to figure out the answer: My remote database and consolidated database were on two different machines which belonged to different domains. The user with which i was logging in to the remote database was not able to access the folders on the consolidated machine. Giving the user access rights to the consolidated machine resolved the issue.