Agfdhyk

I implemented a console application which can access the UFEI by using the API AdjustTokenPrivilages and GetFirmwareEnvironmentVariable. This app works from a command line opened as administrator.

EDIT: adding portion of the code which is working for console app. Same APIs are used in service too.

//function to update privilages

int privilageUpdate ()

{

  TOKEN_PRIVILEGES tp;

  HANDLE hToken;

  LUID luid;

  DWORD err;



  if (!OpenProcessToken(GetCurrentProcess(),

    TOKEN_ADJUST_PRIVILEGES,

    &hToken)) {

    err = GetLastError();

    return (-1 * err);

 }



 if (!LookupPrivilegeValue(NULL, SE_SYSTEM_ENVIRONMENT_NAME, &luid)) {

    err = GetLastError();

    return (-1*err);

 }



 tp.PrivilegeCount = 1;

 tp.Privileges[0].Luid = luid;

 tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

 AdjustTokenPrivileges(hToken, FALSE/*TRUE*/, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);

 if (GetLastError() != ERROR_SUCCESS) {

    err = GetLastError();

    return (-1*err);

 }

 return ERROR_SUCCESS;

}



INT readUFEI () {

  //Reading

  INT32 data;

  INT success = GetFirmwareEnvironmentVariable(L"VAR"

          , L"{xxyyzzaa-xxyy-xxyy-aabb-bbccddeeffgg}"

          , &data

          , sizeof(data));

   if (0 == success) {

      err = GetLastError();

      return (-1 * err)

   }

   return data;

 }

I am working on a C++ service (since, I've to make use of the C++ API & .dlls and other Windows APIs which are available as C++ APIs) which needs to access the UFEI. The service runs but the API AdjustTokenPrivilages is failing with 1300 ERROR_NOT_ALL_ASSIGNED, GetFirmwareEnvironmentVariable is failing with error code 1314 ERROR_PRIVILEGE_NOT_HELD (A required privilege is not held by the client).

I am currently logged in with username xyz and I have admin access rights.
As I understand the services are run differently from the users.

I've tried the following but did not work

1. running with command line with sc start servicename in administrator mode


2. running the services app as admin and then right clicking to start service.

So my question is

1. Is AdjustTokenPrivilages has any effect on services ? If not, how to achieve this ?


2. Is this something which can be solved by changing the Log On tab ?

Please note that the service is not used by any apps.
I am new to the Windows development and any help would be appriciated.