Limited Rights IE and BHO problem

Posted: 06-01-2006, 01:15 AM

Pieter

Guest
Posts: n/a

Please point me to an appropriate (managed MSDN) newsgroup if this group is
inappropriate.

On Vista Beta 2:
We have an IE BHO implemented in an in-process DLL.
This BHO calls CoCreateInstance() to create an object implemented in an out
of process COM service.
The COM service is running under the local system account, and calls
CoInitializeSecurity() to allow anonymous local access.
In limited / protected mode IE CoCreateInstance() fails with an access
denied error, and the NT eventlog shows a DCOM error stating a problem with
the object launch permissions.

I tried to implement the "Elevating Broker Processes" section described in
http://msdn.microsoft.com/library/de...tectedMode.asp
but it still fails. The document is not clear (or I don't understand) so I
tried using the CLSID of the BHO in-proc object and of the out-of-proc COM
object, neither worked.

How can we modify our code to successfully create the out-of-process COM
object from within an in-process BHO in limited mode IE (examples would be
great)?

Btw., I also notice that OutputDebugString() fails to generate any debug
output.
How can we generate debug output from within an in-process BHO in limited
mode IE (other than writing to the \low disk folder)?

Regards
Pieter

Responses to "Limited Rights IE and BHO problem"

Josh

Guest
Posts: n/a

Re: Limited Rights IE and BHO problem

Posted: 06-02-2006, 01:26 AM

So is this something that worked with Windows XP and now does not work with
Internet Explorer 7's protected mode? It is unclear from your description.

What are you trying to do with the com object that you need to elevate for?

"Pieter" <msnews@nospam.nospam> wrote in message
news:u065DCRhGHA.2188@TK2MSFTNGP04.phx.gbl...

> Please point me to an appropriate (managed MSDN) newsgroup if this group
> is inappropriate.
>
> On Vista Beta 2:
> We have an IE BHO implemented in an in-process DLL.
> This BHO calls CoCreateInstance() to create an object implemented in an
> out of process COM service.
> The COM service is running under the local system account, and calls
> CoInitializeSecurity() to allow anonymous local access.
> In limited / protected mode IE CoCreateInstance() fails with an access
> denied error, and the NT eventlog shows a DCOM error stating a problem
> with the object launch permissions.
>
> I tried to implement the "Elevating Broker Processes" section described in
> http://msdn.microsoft.com/library/de...tectedMode.asp
> but it still fails. The document is not clear (or I don't understand) so I
> tried using the CLSID of the BHO in-proc object and of the out-of-proc COM
> object, neither worked.
>
> How can we modify our code to successfully create the out-of-process COM
> object from within an in-process BHO in limited mode IE (examples would be
> great)?
>
>
> Btw., I also notice that OutputDebugString() fails to generate any debug
> output.
> How can we generate debug output from within an in-process BHO in limited
> mode IE (other than writing to the \low disk folder)?
>
>
> Regards
> Pieter
>

Pieter

Guest
Posts: n/a

Re: Limited Rights IE and BHO problem

Posted: 06-02-2006, 04:48 AM

Josh

This setup works on XP, and it works on Vista in normal mode IE.

The BHO is a shim primarily responsible for UI and IE state control, and it
talks to an out-of-proc COM service that does all the "real" (can't tell)
work.
On Vista protected mode IE the CoCreateInstance() of the out-of-proc COM
object fails.
This is what I am trying to solve.

Regards
Pieter

"Josh" <josh@nospam-windowsconnected.com> wrote in message
news:elxBrtdhGHA.412@TK2MSFTNGP05.phx.gbl...

> So is this something that worked with Windows XP and now does not work
> with Internet Explorer 7's protected mode? It is unclear from your
> description.
>
> What are you trying to do with the com object that you need to elevate
> for?
>
>
>
> "Pieter" <msnews@nospam.nospam> wrote in message
> news:u065DCRhGHA.2188@TK2MSFTNGP04.phx.gbl...
>> Please point me to an appropriate (managed MSDN) newsgroup if this group
>> is inappropriate.
>>
>> On Vista Beta 2:
>> We have an IE BHO implemented in an in-process DLL.
>> This BHO calls CoCreateInstance() to create an object implemented in an
>> out of process COM service.
>> The COM service is running under the local system account, and calls
>> CoInitializeSecurity() to allow anonymous local access.
>> In limited / protected mode IE CoCreateInstance() fails with an access
>> denied error, and the NT eventlog shows a DCOM error stating a problem
>> with the object launch permissions.
>>
>> I tried to implement the "Elevating Broker Processes" section described
>> in
>> http://msdn.microsoft.com/library/de...tectedMode.asp
>> but it still fails. The document is not clear (or I don't understand) so
>> I tried using the CLSID of the BHO in-proc object and of the out-of-proc
>> COM object, neither worked.
>>
>> How can we modify our code to successfully create the out-of-process COM
>> object from within an in-process BHO in limited mode IE (examples would
>> be great)?
>>
>>
>> Btw., I also notice that OutputDebugString() fails to generate any debug
>> output.
>> How can we generate debug output from within an in-process BHO in limited
>> mode IE (other than writing to the \low disk folder)?
>>
>>
>> Regards
>> Pieter
>>
>
>

LinkBack

Thread Tools

Display Modes

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Forum Jump

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Administrator Rights	Chris	Windows Vista Administration	23	07-15-2008 01:17 PM
Limited connection	Don	Windows Vista Networking & Sharing	0	10-18-2006 06:09 PM
Administrator Rights?	Dave	Windows Vista Administration	2	08-04-2006 03:12 AM
Moving a file that required admin rights, it does it twice!	Jon Abbott	Windows Vista File Management	1	06-30-2006 08:15 PM
Admin Rights	Jeff	Windows Vista Administration	4	06-28-2006 02:43 PM