Why does CreateProcessAsUser require an interactive window station in Vista / Windows 7?

Question

I had to delve into this because code that worked perfectly in Windows 2003 / XP does not work in Windows 7. An application running using CreateProcessAsUser with error 0xc0000142. The difference between my old code and one of the available MSDNs in Starting an Interactive Client Process in C ++ is that I did not set privileges for both Window Station and the desktop. I updated my code in accordance with the example, but I would really like to understand what change in the new Windows led to what the processes in the interactive Window-station required?

Answer 1

At least part of the requirements arises from a change to start interactive processes in another session from services. This was done so that applications could not launch attacks such as "break" into privileged services. Further information is available here .