My goal is to start a child process from a system service for a distinct user which has access to network drives (mapped or UNC).
To simplify the testing scenario, I have created an application for the account which has access to the network drive and I’m creating a child process via CreateProcessWithLogonW with the credentials for this account.

For the login flags I’m using LOGON_WITH_PROFILE, for the creation flags CREATE_NO_WINDOW | NORMAL_PRIORITY_CLASS | CREATE_UNICODE_ENVIRONMENT and for environment and current directory NULL.

The subordinate process starts, but the FindFirstFileEx fails with code 1326 – ERROR_LOGON_FAILURE which is also the information I see by the Process Monitor from sysinternals.

However, if I steal away the token from the user session by WTSQueryUserToken the CreateProcessAsUser works like a charm and the subsequent process has access to a mapped network drive by FindFirstFileEx. Unfortunately this is not a valid solution, since this is supposed to working without anybody being logged into the system.

I would be grateful for any advice how to solve the problem with CreateProcessWithLogonW or a combination for LogonUser and CreateProcessAsUser.

Thanks in advance,

Achim