问题是 NETWORK SERVICE 没有足够的权限来控制 Windows 服务。我需要切换到另一个用户上下文才能控制它。但我不想为整个应用程序这样做。相反，我正在搜索特定身份下的任意代码执行。
我已经检查了很多关于模仿的资源，包括 Malcolm Frexner 展示的资源。因为我使用的是 Windows 7（64 位）和 Windows Server 2008 R2（64 位），所以我发现它不适合我。我最终得到了这样的通用解决方案：
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Security.Principal;
namespace Thing.Namespace
{
public enum LogOnType
{
LogOn32LogOnInteractive = 2,
LogOn32LogOnNetwork = 3,
LogOn32LogOnBatch = 4,
LogOn32LogOnService = 5,
LogOn32LogOnUnlock = 7,
LogOn32LogOnNetworkCleartext = 8,
LogOn32LogOnNewCredentials = 9
}
public enum LogOnProvider
{
LogOn32ProviderDefault = 0,
LogOn32ProviderWinnt35 = 1,
LogOn32ProviderWinnt40 = 2,
LogOn32ProviderWinnt50 = 3
}
public enum ImpersonationLevel
{
SecurityAnonymous = 0,
SecurityIdentification = 1,
SecurityImpersonation = 2,
SecurityDelegation = 3
}
public static class IdentityBoss
{
private static WindowsImpersonationContext _impersonationContext;
private static readonly object _locker = new object();
private static class NativeMethods
{
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
public static extern int LogonUser(String lpszUserName,
String lpszDomain,
String lpszPassword,
int dwLogonType,
int dwLogonProvider,
ref IntPtr phToken);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern int DuplicateToken(IntPtr hToken,
int impersonationLevel,
ref IntPtr hNewToken);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool RevertToSelf();
[DllImport("kernel32.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool CloseHandle(IntPtr handle);
}
public static void Impersonate(Action action, string user, string domain, string password,
LogOnType logOnType, LogOnProvider logOnProvider,
ImpersonationLevel impersonationLevel)
{
try
{
ImpersonateValidUser(user, domain, password, logOnType, logOnProvider, impersonationLevel);
action();
}
finally
{
UndoImpersonation();
}
}
public static void ImpersonateHappily(Action action, string user, string domain, string password)
{
Impersonate(action, user, domain, password, LogOnType.LogOn32LogOnNetworkCleartext,
LogOnProvider.LogOn32ProviderDefault, ImpersonationLevel.SecurityImpersonation);
}
public static TResult Impersonate<TResult>(Func<TResult> action, string user, string domain, string password,
LogOnType logOnType, LogOnProvider logOnProvider,
ImpersonationLevel impersonationLevel)
{
try
{
ImpersonateValidUser(user, domain, password, logOnType, logOnProvider, impersonationLevel);
return action();
}
finally
{
UndoImpersonation();
}
}
public static TResult ImpersonateHappily<TResult>(Func<TResult> action, string user, string domain, string password)
{
return Impersonate(action, user, domain, password, LogOnType.LogOn32LogOnNetworkCleartext,
LogOnProvider.LogOn32ProviderDefault, ImpersonationLevel.SecurityImpersonation);
}
private static void ImpersonateValidUser(String userName, String domain, String password, LogOnType logonType, LogOnProvider logonProvider, ImpersonationLevel impersonationLevel)
{
lock (_locker)
{
var token = IntPtr.Zero;
var tokenDuplicate = IntPtr.Zero;
WindowsIdentity tempWindowsIdentity = null;
try
{
if (!NativeMethods.RevertToSelf())
throw new Win32Exception(Marshal.GetLastWin32Error());
if (NativeMethods.LogonUser(userName, domain, password, (int) logonType, (int) logonProvider,ref token) == 0)
throw new Win32Exception(Marshal.GetLastWin32Error());
if (NativeMethods.DuplicateToken(token, (int) impersonationLevel, ref tokenDuplicate) == 0)
throw new Win32Exception(Marshal.GetLastWin32Error());
tempWindowsIdentity = new WindowsIdentity(tokenDuplicate);
_impersonationContext = tempWindowsIdentity.Impersonate();
}
finally
{
if (token != IntPtr.Zero)
NativeMethods.CloseHandle(token);
if (tokenDuplicate != IntPtr.Zero)
NativeMethods.CloseHandle(tokenDuplicate);
if (tempWindowsIdentity != null)
tempWindowsIdentity.Dispose();
}
}
}
private static void UndoImpersonation()
{
lock (_locker)
{
if (_impersonationContext != null)
{
_impersonationContext.Undo();
}
}
}
}
}
此外，我需要在安装了服务的机器上创建新用户。用户必须具有控制 Windows 服务的权限 - 为此，可以将其添加到管理员组。
现在我可以启动/停止我的服务并以这种方式获取它们的当前状态：
private const string user = "MyUser";
private const string domain = ".";
private const string password = "MyPa$$w0rd";
public string StartService(string machine, string service)
{
IdentityBoss.ImpersonateHappily(
() =>
{
Controller.Instance.StartService(machine, service);
}, user, domain, password
);
}
public string GetServiceStatus(string machine, string service)
{
return IdentityBoss.ImpersonateHappily(
() =>
{
return Controller.Instance.GetServiceStatus(machine, service);
}, user, domain, password
);
}
ImpersonateHappily只是一个函数，它接受与我的操作系统一起工作的参数。来自网络的其他类似解决方案使用dwLogonType参数传递给 win 32 api 函数LogonUserA，值为 2 或 9，而在我的系统下，值 8 是正确的。
顺便说一句：Impersonate是一个包装函数，它设置模拟，然后传递给它一个执行实际工作的 lambda。这种编写代码风格的计算机科学术语是高阶编程。