Hi all,
I register an elevation policy and restart IEUser for it to take
effect. If this is done from an administrator account, all works fine:
the policy is registered, the IEUser is shutdown (RmShutdown) and
restarted (RmRestart), so the policy is considered. However, if this
is done from a standard account, it only works from a medium integrity
level but not from a high integrity level.

Maybe this happens because the user of the high integrity level
process restarting the IEUser is an administrator (after the prompt
from consent.exe) which differs from the standard user running the
original IEUser. My experimentgs show that in this case RmShutdown
succeds, but not RmRestart.

The code I am using is this:

// Restart IEUser.
DWORD RestartIEUser()
{ DWORD dwVal=ERROR_SUCCESS;
DWORD dwSessionHandle=(DWORD)-1;
WCHAR wszSessionKey[CCH_RM_SESSION_KEY+1];
UINT nProcInfo=100;
UINT nProcInfoNeeded;
DWORD lpdwRebootReason=0;

LPWSTR rgsFiles[] = { L"c:\\program files\\internet explorer\
\ieuser.exe", };

// Allocate structures.
RM_PROCESS_INFO *rgProcs=new RM_PROCESS_INFO[nProcInfo];
if (rgProcs==0)
{ dwVal=ERROR_NOT_ENOUGH_MEMORY;
goto RM_END;
}

// Starting Session.
dwVal=RmStartSession(&dwSessionHandle, 0, wszSessionKey);
if (dwVal!=ERROR_SUCCESS) goto RM_END;

// Register items.
dwVal=RmRegisterResources(dwSessionHandle, 1, (LPCWSTR*) rgsFiles, 0,
NULL, 0, NULL);
if (dwVal!=ERROR_SUCCESS) goto RM_END;

// Getting affected apps.
dwVal=RmGetList(dwSessionHandle, &nProcInfoNeeded, &nProcInfo,
rgProcs, &lpdwRebootReason);
if (dwVal!=ERROR_SUCCESS) goto RM_END;

// Shutdown ieuser process.
dwVal=RmShutdown(dwSessionHandle, 0, NULL);
if (dwVal!=ERROR_SUCCESS) goto RM_END;

// Restart ieuser.
dwVal=RmRestart(dwSessionHandle, NULL, NULL);
if (dwVal!=ERROR_SUCCESS) goto RM_END;

RM_END:

// Release structures.
if (rgProcs!=NULL) delete[] rgProcs;

// Clean up session.
if (dwSessionHandle!=-1)
RmEndSession(dwSessionHandle);

return dwVal;
}

int main(int argc, char* argv[])
{ RestartIEUser();
return 0;
}

I have tried creating a thread that impersonates the user and does the
call to RestartIEUser(), but it doesn't works. Anyone has any clue? Do
I need to create a process as the user to perform only this operation?

Thanks in advance,

Kodit