SwitchDesktop verhindern

[peanut]

Hallo Scorpion3000,

mit Desktop-Rechten habe ich auch mal gespielt ist ziemlich frustrierend gewesen, habe es aber schließlich geschafft. Vielleicht helfen Dir ja die folgenden Schnipsel weiter:

Delphi-Quellcode:

[...]

  TACE_HEADER = record
     AceType : Byte;
     AceFlags: Byte;
     AceSize : Word;
  end;
  PACE_HEADER = ^TACE_HEADER;

  TACCESS_MASK = DWORD;
  PACCESS_MASK = ^TACCESS_MASK;

  TACCESS_ALLOWED_ACE = record
     Header  : TACE_HEADER;
     Mask    : TACCESS_MASK;
     SidStart: DWORD;
  end;
  PACCESS_ALLOWED_ACE = ^TACCESS_ALLOWED_ACE;

[...]

function GetUserSID(szUsername: String): PSID;
var
  UserSID  : PSID;
  cbUserSID: Cardinal;
  sDomain  : String;
  cbsDomain: Cardinal;
  pNameUse : SID_NAME_USE;
begin
  Result := nil;
  cbUserSID := 0; UserSID := nil;
  sDomain := ''; cbsDomain := 0;
  LookupAccountName(PChar('\\.'), PChar(szUsername), UserSID, cbUserSID, @sDomain[1], cbsDomain, pNameUse);
  GetMem(UserSID, cbUserSID);
  ZeroMemory(UserSID, cbUserSID);
  SetLength(sDomain, cbsDomain);
  ZeroMemory(@sDomain[1], Length(sDomain));
  if (LookupAccountName(PChar('\\.'), PChar(szUsername), UserSID, cbUserSID, @sDomain[1], cbsDomain, pNameUse)) then
    Result := UserSID;
end;

function SecureUpDesktop(hDesktop: HDESK; dwAccessMask: DWORD): Boolean;
var
  si          : SECURITY_INFORMATION;
  UserSID     : PSID;
  pNewAcl     : PACL;
  cbACL       : Cardinal;
  psdNew      : PSECURITY_DESCRIPTOR;
begin
  Result := FALSE;
  if (hDesktop <> 0) then
  begin
    UserSID := GetUserSID('MyTestAccount');
    if (UserSID <> nil) and  (IsValidSid(@UserSID^)) then
    try
      // Neuen SecurityDescriptor erstellen und initialisieren...
      psdNew := PSECURITY_DESCRIPTOR(LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH));

      if not InitializeSecurityDescriptor(psdNew, SECURITY_DESCRIPTOR_REVISION) then
        Exit;

      // ACL erstellen und Initialisieren
      cbACL := SizeOf(ACL) + SizeOf(TACCESS_ALLOWED_ACE) + GetLengthSid(UserSID) - SizeOf(DWORD);
      pnewAcl := PACL(LocalAlloc(LPTR, cbACL)) ;
      if not InitializeAcl(pnewAcl^, cbACL, 2) then
        Exit;

      // Füge Rechte zu Acl hinzu
      if not(AddAccessAllowedAce(pnewAcl^, pnewAcl.AclRevision, dwAccessMask, UserSID)) then
        Exit;

      // Acl in den Security-Descriptor schreiben
      if not(SetSecurityDescriptorDacl(psdNew, True, pNewAcl, False)) then
        Exit;

      // Setze die neuen Rechte...
      si := DACL_SECURITY_INFORMATION;
      if not(SetUserObjectSecurity(hDesktop, si, psdNew)) then
        Exit;
    finally
      FreeMem(UserSID);
    end;
  end;
end;

[...]

      SecureUpDesktop(hNewDesktop, DESKTOP_READOBJECTS or DESKTOP_CREATEWINDOW or DESKTOP_CREATEMENU or DESKTOP_WRITEOBJECTS or DESKTOP_ENUMERATE);

[...]

Viele Grüße

peanut.