{"id":93555,"date":"2016-06-01T07:00:00","date_gmt":"2016-06-01T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=93555"},"modified":"2019-03-13T11:50:30","modified_gmt":"2019-03-13T18:50:30","slug":"20160601-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20160601-00\/?p=93555","title":{"rendered":"Why does SHGetKnownFolderPath fail when impersonating?"},"content":{"rendered":"

A customer was having trouble with the SHGet­Known­Folder­Path<\/code> function. <\/p>\n

\n

We are calling the SHGet­Known­Folder­Path<\/code> function. from a service while impersonating a user, but it returns E_ACCESS­DENIED<\/code>. It’s failing both for FOLDERID_Program­Data<\/code> and FOLDERID_Roaming­App­Data<\/code>: <\/p>\n

\nhr = SHGetKnownFolderPath(\n        FOLDERID_ProgramData, \/\/ folder ID\n        0,                    \/\/ flags\n        nullptr,              \/\/ token\n        &path);           \/\/ result\n<\/pre>\n<\/blockquote>\n
Before we could reply, the customer followed up: <\/p>\n
\n
We found that if we save the token that is being used for impersonation and pass it to the SHGet­Known­Folder­Path<\/code> function. then it works. But we are not sure why is it working now since the call was already being made while impersonating, and the documentation for the SHGet­Known­Folder­Path<\/code> function says that if you want to get the known folder path for the current user, then you pass NULL<\/code> as the token. <\/p>\n<\/blockquote>\n
Remember that the default answer to “Does this work while impersonating?” is No<\/a>. When the SHGet­Known­Folder­Path<\/code> function says “the current user”, it roughly means “the user under whose identity the process is running”, but more importantly, it means the user whose registry is mapped as HKEY_CURRENT_USER<\/code>, which, as we saw earlier, is a very tricky proposition for a service that impersonates<\/a>. <\/p>\n
In this case, what’s probably happening is that the service is running as something like SYSTEM, and HKEY_CURRENT_USER<\/code> points to SYSTEM’s registry, and the impersonated user does not have access to SYSTEM’s registry, hence E_ACCESS­DENIED<\/code>. <\/p>\n
The backstory is that the SHGet­Known­Folder­Path<\/code> function (and its close relatives like SHGet­Special­Folder­Path<\/code>) are overwhelmingly used by normal applications that do no impersonation, so that’s the use case they are optimized for. if you pass NULL<\/code> as the token, then the functions will read from HKEY_CURRENT_USER<\/code> and cache the results. If the thread is impersonating, but you fail to pass the impersonation token to the SHGet­Known­Folder­Path<\/code> function, then it might return the (wrong) cached value, or it might try to read the value from the (wrong) HKEY_CURRENT_USER<\/code> hive. Whatever happens, it’s probably going to be wrong. To say, “No, don’t use any of your fancy optimizations for normal applications, because I’m not a normal application. Get the known folder path for this specific user by reading from that user’s registry.” <\/p>\n
You might say, “Well, the SHGet­Known­Folder­Path<\/code> function should auto-detect whether it is being called when impersonating and compensate accordingly.” Maybe, but that means introducing an expensive test to a hot code path to cover a rare case. that people shouldn’t expect to work anyway because the default answer to “Does this work while impersonating?” is No<\/a>. Instead, the extra work of dealing with impersonation is transferred to the people who want to get this information while impersonating. <\/p>\n
Bonus chatter<\/b>: Even if you pass the correct token to the SHGet­Known­Folder­Path<\/code> function, you may still run afoul of other requirements. In particularly, note the sentence <\/p>\n
In addition to passing the user’s hToken<\/i>, the registry hive of that specific user must be mounted. <\/p><\/blockquote>\n
If the registry hive is not mounted, then there is no way to look up the information in the registry because, well, it’s not in the registry. You can use the Load­User­Profile<\/code> function to load the profile into the registry. Just remember to call Unload­User­Profile<\/code> when you’re done. (See the documentation for details.) <\/p>\n","protected":false},"excerpt":{"rendered":"
Because there’s a special way to call it for impersonation.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-93555","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
Because there’s a special way to call it for impersonation.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=93555"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/93555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=93555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=93555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=93555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}