Submit My Question - Recent Questions - Recent Answer
Msdn Tech >> Software Development for Windows Vista >> Security for Applications in Windows Vista

ScardAccessStartedEvent does not signal in Vista services - service hardening?

Dear all,

Migrating our core development platform to Windows Vista, one of our
Windows services using smartcards is failing.

We have debugged the problem and found that the event provided by the
function ScardAccessStartedEvent does not receive notification. This
event is supposed to signal when the SmartCard Resource Manager starts.
As we have a WaitForSingleObject(event,INFINITE), the service hungs.

Testing the same service as an ordinary executable ( registering with
-regserver ) I can see it works properly. In XP it works properly both
as an executable and service.

I have read something about Service Hardening in Vista and I guess it
may be caused by privilege reduction. So, I've created some code to
enumerate the existing privileges when the application is launched as
an executable and as a service. These are the results:

COMSERVER registered with -REGSERVER

-

PrivilegeName[SeIncreaseQuotaPrivilege]=Disabled

PrivilegeName[SeSecurityPrivilege]=Disabled

PrivilegeName[SeTakeOwnershipPrivilege]=Disabled

PrivilegeName[SeLoadDriverPrivilege]=Disabled

PrivilegeName[SeSystemProfilePrivilege]=Disabled

PrivilegeName[SeSystemtimePrivilege]=Disabled

PrivilegeName[SeProfileSingleProcessPrivilege]=Disabled

PrivilegeName[SeIncreaseBasePriorityPrivilege]=Disabled

PrivilegeName[SeCreatePagefilePrivilege]=Disabled

PrivilegeName[SeBackupPrivilege]=Disabled

PrivilegeName[SeRestorePrivilege]=Disabled

PrivilegeName[SeShutdownPrivilege]=Disabled

PrivilegeName[SeDebugPrivilege]=Disabled

PrivilegeName[SeSystemEnvironmentPrivilege]=Disabled

PrivilegeName[SeChangeNotifyPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_EN-ABLED_BY_DEFAULT

PrivilegeName[SeRemoteShutdownPrivilege]=Disabled

PrivilegeName[SeUndockPrivilege]=Disabled

PrivilegeName[SeManageVolumePrivilege]=Disabled

PrivilegeName[SeImpersonatePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENA-BLED_BY_DEFAULT

PrivilegeName[SeCreateGlobalPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_EN-ABLED_BY_DEFAULT

PrivilegeName[SeIncreaseWorkingSetPrivilege]=Disabled

PrivilegeName[SeTimeZonePrivilege]=Disabled

PrivilegeName[SeCreateSymbolicLinkPrivilege]=Disabled

COMSERVER registered with -SERVICE

--

PrivilegeName[SeAssignPrimaryTokenPrivilege]=Disabled

PrivilegeName[SeLockMemoryPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENAB-LED_BY_DEFAULT

PrivilegeName[SeIncreaseQuotaPrivilege]=Disabled

PrivilegeName[SeTcbPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_BY_-DEFAULT

PrivilegeName[SeSecurityPrivilege]=Disabled

PrivilegeName[SeTakeOwnershipPrivilege]=Disabled

PrivilegeName[SeLoadDriverPrivilege]=Disabled

PrivilegeName[SeSystemProfilePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_E-NABLED_BY_DEFAULT

PrivilegeName[SeSystemtimePrivilege]=Disabled

PrivilegeName[SeProfileSingleProcessPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIV-ILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeIncreaseBasePriorityPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIV-ILEGE_ENABLED_BY_DEFAULT

PrivilegeName[SeCreatePagefilePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_-ENABLED_BY_DEFAULT

PrivilegeName[SeCreatePermanentPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE-_ENABLED_BY_DEFAULT

PrivilegeName[SeBackupPrivilege]=Disabled

PrivilegeName[SeRestorePrivilege]=Disabled

PrivilegeName[SeShutdownPrivilege]=Disabled

PrivilegeName[SeDebugPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_B-Y_DEFAULT

PrivilegeName[SeAuditPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLED_B-Y_DEFAULT

PrivilegeName[SeSystemEnvironmentPrivilege]=Disabled

PrivilegeName[SeChangeNotifyPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_EN-ABLED_BY_DEFAULT

PrivilegeName[SeUndockPrivilege]=Disabled

PrivilegeName[SeManageVolumePrivilege]=Disabled

PrivilegeName[SeImpersonatePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENA-BLED_BY_DEFAULT

PrivilegeName[SeCreateGlobalPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_EN-ABLED_BY_DEFAULT

PrivilegeName[SeIncreaseWorkingSetPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVIL-EGE_ENABLED_BY_DEFAULT

PrivilegeName[SeTimeZonePrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVILEGE_ENABLE-D_BY_DEFAULT

PrivilegeName[SeCreateSymbolicLinkPrivilege]=SE_PRIVILEGE_ENABLED+SE_PRIVIL-EGE_ENABLED_BY_DEFAULT

Do you have any idea about this strange behaviour of
ScardAccessStartedEvent function?

Thanks in advance

[4524 byte] By [SergioOrtiz] at [2007-12-25]
«« one package running with different connection strings?
»» xp_cmdshell and activation
# 1

Hi all,

I've been working on the issue and I almost discard anything to do with Privileges.

Using SysInternals Process Explorer to explore event handles received by our application in return for ScardAccessStartedEvent in both XP and Vista, I've noticed relevant differences.

In XP case, our application receives a '\BaseNamedObjects\Microsoft Smart Card Resource Manager Started' while in Vista, we receive a '\BaseNamedObjects\TermSrvReadyEvent'. Therefore, it is normal that our application gets hunged while waiting for the event as it is a DIFFERENT event!

I've also noticed that, in Vista, Windows smartcard component is hosted ( loaded in svchost.exe ) instead of the being deployed in scardsvr.exe.

Does anyone know what's happening here? I can do a workaround waiting for the new event by its name to solve the problem but I would expect a "documented solution" for the issue.

Thanks in advance

SergioOrtiz at 2007-9-3 > top of Msdn Tech,Software Development for Windows Vista,Security for Applications in Windows Vista...
# 2

hi,

i have the same question, i can not get data from a hid device in my service, after readfile(), the ov.hEvevt always in non signal even if data comming. :(, i think the session of service must be changed to activeconsolesession id. but i don not know how to do it. if i success i would tell u.:)

houyun at 2007-9-3 > top of Msdn Tech,Software Development for Windows Vista,Security for Applications in Windows Vista...
# 3

If there is any type of comminication using messages (SendMessage, PostMessage etc) between Service and Application then it won't work on Vista. You need to use interprocess communication.

Refer to Session0_Vista.doc from

http://www.microsoft.com/whdc/system/vista/services.mspx

may this help you.

Thanks

Ganeshm at 2007-9-3 > top of Msdn Tech,Software Development for Windows Vista,Security for Applications in Windows Vista...
# 4

In case you've missed the answer from Dan on platformsdk.security:

The handle returned by SCardAccessStartedEvent in Vista should not be named.
Please wait on this handle. Also be sure to call SCardReleaseStartedEvent
when you're done with it.

In Beta 2, there was a bug that prevented services from accessing the local
smart card resource manager if they weren't impersonating a user. This was
fixed in RC1 so you might want to upgrade. This sounds like what you're
hitting.

It is recommended that if you do actions on behalf of the user that you
impersonate so you can take full advantage of ts redirection. Otherwise
you'll be restricted to the local smart card resource manager.

EricPerlin at 2007-9-3 > top of Msdn Tech,Software Development for Windows Vista,Security for Applications in Windows Vista...
# 5

Hi Erin,

We'll do tests under RC1. It's very likely that we have an issue with Beta 2 because, in addition, we got a SCARD_E_NO_SERVICE when accessing the smartcard resource managers if not impersonating a user.

Indeed, we decided to impersonate the "Terminal Service User" and everything went ok...but got no idea of what was happening. Now, we'll test under RC1 and let the code as it was.

Thanks for your support.

SergioOrtiz at 2007-9-3 > top of Msdn Tech,Software Development for Windows Vista,Security for Applications in Windows Vista...
Software Development for Windows Vista
Security for Applications in Windows Vista

Software Development for Windows Vista Hot Topic

Software Development for Windows Vista New Topic

Software Development for Windows Vista

Java / MSDN / Linux Tech / PHP Tech / MSDN DotNet / MSDN TECH / Health Library / Programmers Tech / visual basic Tech / Developer Tech / Ipod faqs / Msdn China Tech

Site Classified