OpenProcessToken() gives "Access is denied"
<p>As part of a project which runs as a service that spawns a process in the login screen (for desktop control) we call OpenProcessToken(), which is then duplicated and a process created.  This works successfully as expected under LocalSystem, however this does not work under a domain account.  The code fragment is below...</p>

<pre><code>procedure LaunchProcess;
var dwPid, dwSessionId: DWord;
  hUserToken, hProcess: THANDLE;
begin
  dwPid := GetProcessID('winlogon.exe', WTSGetActiveConsoleSessionId);
  hProcess := OpenProcess(MAXIMUM_ALLOWED, FALSE, dwPid);
  if (not OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY or TOKEN_DUPLICATE or
    TOKEN_ASSIGN_PRIMARY or TOKEN_ADJUST_SESSIONID or TOKEN_READ or TOKEN_WRITE, hUserToken)) then
      raise Exception.Create('OpenProcessToken failed (' + SysErrorMessage(GetLastError) + ').');

  {...go on to duplicate token, create environment and launch process...}

end;
</code></pre>

<p>Full source of the surrounding supporting function can be found <a href="https://stackoverflow.com/questions/39665084/createprocessasuser-is-successful-but-no-process-is-created">here</a>.</p>

<p>This is where it gets a little vague.  I understand OpenProcessToken() requires privileges, which is ultimately why I am getting the error, however it wasn't clear what privilege I require, and how to effectively assign that against a domain account.</p>

<p><a href="https://technet.microsoft.com/en-us/library/cc976700.aspx" rel="nofollow noreferrer">This</a> would suggest that the required privilege is SeTcbPrivilege ("Act as part of the operating system").</p>

<p>I've read the Microsoft page (can't link, not enough reputation - sorry) on privileges which suggests that the SeTcbPrivilege can be assigned to a domain account using Local or Group Security Policy.  It has also been suggested that the destination process (i.e. winlogon.exe) may simply <strong>not allow</strong> anything other than LocalSystem to obtain its token.</p>

<p>I have tried to configure the domain account explicitly using account the service, but in the Local Security and Group Policy, have restarted and performed <code>gporesult</code> to ensure the policy has taken effect, but each time <code>whoami /priv</code> returns SeTcbPrivilege is disabled </p>

<p>My question is if this is even possible (can I obtain winlogon.exe token using a domain account) and if so can the privilege be set programmatically, or does this need to be through GPO?  (and if so, given my previous attempts at using GPO had no effect, how is it possible)</p>