running an application with assumed local admin privileges / Shell Execute question

Have a look at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/client_impersonation.asp

The avvount you want to call 'LogonUser()' from needs to hold the the SE_TCB_NAME (aka "SeTcbPrivilege" or "Act as part of the operating system") privilege. You will have to assign that, or it won't work. The docs on 'LogonUser()' mention that explicitly:

"The process that calls LogonUser must have the SE_TCB_NAME privilege. The privilege does not need to be enabled. The LogonUser function enables the privilege as necessary. If the calling process does not have this privilege, LogonUser fails and GetLastError returns ERROR_PRIVILEGE_NOT_HELD.

In some cases, the process that calls LogonUser must also have the SE_CHANGE_NOTIFY_NAME privilege enabled; otherwise, LogonUser fails and GetLastError returns ERROR_ACCESS_DENIED. This privilege is not required for the local system account or accounts that are members of the administrators group. By default, SE_CHANGE_NOTIFY_NAME is enabled for all users, but some administrators may disable it for everyone."

jkr:

Seems you are the one that usually saves me :)

I tried the SE_TCB_NAME susgestion, here is the error from console:
GetUserName(jploettner)
calling OpenProcessToken...
OpenProcessToken worked...
calling LogonUser...
LogonUser worked...
calling ImpersonateLoggedOnUser...
ImpersonateLoggedOnUser worked...
GetUserName(snowman)
calling CreateProcessAsUser...
==================================
Error Source: CreateProcessAsUser
Error       : A required privilege is not held by the client.
==================================
Press any key to continue

I tried with and with out the ImpersonateLoggedOnUser :(  I'de give you 1000 points for this one if i could, work is torturing me over it and stuck in the mud :P

here is the lastest source:
            CString sLogin, sPwd, tmp;
            LPVOID lpMsgBuf= NULL;
            LPTSTR lpBuffer;
            lpBuffer = new char[MAX_PATH];
            DWORD dwSize = MAX_PATH + 1;      
            
            STARTUPINFO startup_info;
            PROCESS_INFORMATION process_information;
            TOKEN_PRIVILEGES tkp;
            HANDLE hToken;

            sLogin = "snowman"; // local admin account
            sPwd = "mypassword";

            GetUserName(lpBuffer, &dwSize);
            cout << "GetUserName(" << lpBuffer << ")" << endl;

            cout << "calling OpenProcessToken..." << endl;
            if(OpenProcessToken(GetCurrentProcess(),
                  TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
            {
                  if (!LookupPrivilegeValue(NULL, SE_TCB_NAME, &tkp.Privileges[0].Luid))
                  {
                        showerror("LookUpPrivilegeValue");
                        return nRetCode;
                  }

                  tkp.PrivilegeCount = 1;
                  tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
                  if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, 0))
                  {
                        showerror("AdjustTokenPrivileges");
                        return nRetCode;
                  }

                  cout << "OpenProcessToken worked..." << endl;
            }
            else
            {
                  showerror("OpenProcessToken");
                  return nRetCode;
            }

            cout << "calling LogonUser..." << endl;
            if (!LogonUser((char*)(LPCTSTR)sLogin, NULL, (char*)(LPCTSTR)sPwd,
                  LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, &hToken))
            {
                  showerror("LogonUser");
                  return nRetCode;
            }
            else
                  cout << "LogonUser worked..." << endl;

            cout << "calling ImpersonateLoggedOnUser..." << endl;
            if (!ImpersonateLoggedOnUser(hToken))
            {
                  showerror("ImpersonateLoggedOnUser");
                  return nRetCode;
            }
            else
                  cout << "ImpersonateLoggedOnUser worked..." << endl;
            
            GetUserName(lpBuffer, &dwSize);
            cout << "GetUserName(" << lpBuffer << ")" << endl;

            ZeroMemory(&process_information,sizeof(process_information));
            GetStartupInfo(&startup_info);
            startup_info.cb=sizeof(STARTUPINFO);

          char app[] = "calc.exe";
            cout << "calling CreateProcessAsUser..." << endl;
            if (!CreateProcessAsUser(hToken, app, "", NULL, NULL, TRUE, NULL, NULL,
                  "c:\\windows\\system32\\", &startup_info, &process_information))
            {  
                  showerror("CreateProcessAsUser");
                  return nRetCode;
            }
            else
            {
                  cout << "CreateProcessAsUser worked..." << endl;
                  
                  CloseHandle(process_information.hProcess);
                  CloseHandle(process_information.hThread);
            }