Question about privileges required to call LoadUserProfile from ASP.NET webservice

[Shawn Anderson]

I am trying to call LoadUserProfile from within an ASP.NET webservice. I
have set the process to run under an impersonated account that is an
administrator -- however, everytime I try to execute the LoadUserProfile
call, I get a message saying that a "Required privlege is not help by
client" or something very close to that message.

I have tried adding to the process and user handle the SeTcbPrivilege,
SeChangeNotifyPrivilege, as well as just about every other privilege that I
can think of. But still keep getting the same error.

Can anyone offer anything thoughts or suggestions?

Thanks
Shawn Anderson

[Ivan Brugiolo [MSFT]]

If you enable auditing for privilege usage in secpol.msc,
you should have the name of the missing privilege in the Security Event Log
file.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


"Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
news:OfDTTpKhEHA.596@TK2MSFTNGP11.phx.gbl...

> I am trying to call LoadUserProfile from within an ASP.NET webservice. I
> have set the process to run under an impersonated account that is an
> administrator -- however, everytime I try to execute the LoadUserProfile
> call, I get a message saying that a "Required privlege is not help by
> client" or something very close to that message.
>
> I have tried adding to the process and user handle the SeTcbPrivilege,
> SeChangeNotifyPrivilege, as well as just about every other privilege that

I

> can think of. But still keep getting the same error.
>
> Can anyone offer anything thoughts or suggestions?
>
> Thanks
> Shawn Anderson
>
>

[Shawn Anderson]

The suggestion was a good one, however for some reason no error/failure is
displayed on any of the systems I am testing on.


"Ivan Brugiolo [MSFT]" <ivanbrug@online.microsoft.com> wrote in message
news:eEJm$APhEHA.3548@TK2MSFTNGP09.phx.gbl...

> If you enable auditing for privilege usage in secpol.msc,
> you should have the name of the missing privilege in the Security Event
> Log
> file.
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> Use of any included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
>
>
> "Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
> news:OfDTTpKhEHA.596@TK2MSFTNGP11.phx.gbl...

>> I am trying to call LoadUserProfile from within an ASP.NET webservice. I
>> have set the process to run under an impersonated account that is an
>> administrator -- however, everytime I try to execute the LoadUserProfile
>> call, I get a message saying that a "Required privlege is not help by
>> client" or something very close to that message.
>>
>> I have tried adding to the process and user handle the SeTcbPrivilege,
>> SeChangeNotifyPrivilege, as well as just about every other privilege that

> I

>> can think of. But still keep getting the same error.
>>
>> Can anyone offer anything thoughts or suggestions?
>>
>> Thanks
>> Shawn Anderson
>>
>>

>
>

[Richard Ward]

From MSDN
(http://msdn.microsoft.com/library/de...serprofile.asp)
The calling process must have the SE_RESTORE_NAME and SE_BACKUP_NAME
privileges. For more information, see Running with Special Privileges.

It doesn't matter what your client has for privileges, this operation
requires
that your process have these privileges, which are not typically granted to
a web service.



"Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
news:%234TATEZhEHA.3916@TK2MSFTNGP11.phx.gbl...

> The suggestion was a good one, however for some reason no error/failure is
> displayed on any of the systems I am testing on.
>
>
> "Ivan Brugiolo [MSFT]" <ivanbrug@online.microsoft.com> wrote in message
> news:eEJm$APhEHA.3548@TK2MSFTNGP09.phx.gbl...

>> If you enable auditing for privilege usage in secpol.msc,
>> you should have the name of the missing privilege in the Security Event
>> Log
>> file.
>>
>> --
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> Use of any included script samples are subject to the terms specified at
>> http://www.microsoft.com/info/cpyright.htm
>>
>>
>> "Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
>> news:OfDTTpKhEHA.596@TK2MSFTNGP11.phx.gbl...

>>> I am trying to call LoadUserProfile from within an ASP.NET webservice. I
>>> have set the process to run under an impersonated account that is an
>>> administrator -- however, everytime I try to execute the LoadUserProfile
>>> call, I get a message saying that a "Required privlege is not help by
>>> client" or something very close to that message.
>>>
>>> I have tried adding to the process and user handle the SeTcbPrivilege,
>>> SeChangeNotifyPrivilege, as well as just about every other privilege
>>> that

>> I

>>> can think of. But still keep getting the same error.
>>>
>>> Can anyone offer anything thoughts or suggestions?
>>>
>>> Thanks
>>> Shawn Anderson
>>>
>>>

>>
>>

>
>

[Shawn Anderson]

Thanks but I saw that already :)

I have verifiied that both the calling process and calling thread have the
privilege.

Shawn

"Richard Ward" <richardw@delete-yellow-dogs.com> wrote in message
news:10igjevclj410b7@corp.supernews.com...

> From MSDN
> (http://msdn.microsoft.com/library/de...serprofile.asp)
> The calling process must have the SE_RESTORE_NAME and SE_BACKUP_NAME
> privileges. For more information, see Running with Special Privileges.
>
> It doesn't matter what your client has for privileges, this operation
> requires
> that your process have these privileges, which are not typically granted
> to
> a web service.
>
>
>
> "Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
> news:%234TATEZhEHA.3916@TK2MSFTNGP11.phx.gbl...

>> The suggestion was a good one, however for some reason no error/failure
>> is displayed on any of the systems I am testing on.
>>
>>
>> "Ivan Brugiolo [MSFT]" <ivanbrug@online.microsoft.com> wrote in message
>> news:eEJm$APhEHA.3548@TK2MSFTNGP09.phx.gbl...

>>> If you enable auditing for privilege usage in secpol.msc,
>>> you should have the name of the missing privilege in the Security Event
>>> Log
>>> file.
>>>
>>> --
>>> This posting is provided "AS IS" with no warranties, and confers no
>>> rights.
>>> Use of any included script samples are subject to the terms specified at
>>> http://www.microsoft.com/info/cpyright.htm
>>>
>>>
>>> "Shawn Anderson" <sanderson@eye-catcher.com> wrote in message
>>> news:OfDTTpKhEHA.596@TK2MSFTNGP11.phx.gbl...
>>>> I am trying to call LoadUserProfile from within an ASP.NET webservice.
>>>> I
>>>> have set the process to run under an impersonated account that is an
>>>> administrator -- however, everytime I try to execute the
>>>> LoadUserProfile
>>>> call, I get a message saying that a "Required privlege is not help by
>>>> client" or something very close to that message.
>>>>
>>>> I have tried adding to the process and user handle the SeTcbPrivilege,
>>>> SeChangeNotifyPrivilege, as well as just about every other privilege
>>>> that
>>> I
>>>> can think of. But still keep getting the same error.
>>>>
>>>> Can anyone offer anything thoughts or suggestions?
>>>>
>>>> Thanks
>>>> Shawn Anderson
>>>>
>>>>
>>>
>>>

>>
>>

>
>