E_ACCESSDENIED at CoCreateInstance, where he worked

Question

I have code that worked, but recently stopped. This is in the Adobe Reader plugin, and the latest version of Reader has “Protected Mode”, which causes my problem.

My plugin can load some of my regular DLLs that are loaded in the process:

MyNormalLib::IMyClassPtr foo; HRESULT hr = foo.CreateInstance(__uuidof(MyNormalLib::MyClass)); 

But when I try to get the com pointer to my service (works on the same computer):

 MyOtherLib::IMyServicePtr bar; HRESULT hr = bar.CreateInstance(__uuidof(MyOtherLib::MyService)); 

I get E_ACCESSDENIED for my HRESULT.

This worked fine until Adobe Reader X appeared. Without protected mode, Adobe works fine and everything works. In protected mode, Adobe starts another reading process with some restrictions on it. Having looked at it with the help of Process Explorer, I see that the Security tab for the parent reading process has almost all the settings required by the user; but the reading process with children has most of the groups configured to "Deny, mandatory," some "Required, limited," some only mandatory. If that matters, I can provide more details.

All processes (my service and both Readers) are executed as the same user - me. I have administrator rights if that matters.

What can cause an AccessDenied error when trying to reach my own service? What kind of protective hoops do I need to jump to get this to work?

Answer 1

A restricted process does not have administrator rights. This is largely the essence of the exercise - Reader X leaves as many rights as it can from its token, so if it is displayed on your computer, it is not.

(Basically, how UAC works, you need to go to the kernel to get permission to re-enable your Administrator group after you disabled it).

Basically, you need to look at the privileged users that Reader X has and make sure that your component can be used with these permissions. Process Monitor - your friend - just filter DENIED and problems will appear right at your place!