Windows Service启动时运行EXE失败问题求助（C#编写）

核心原因 #

LocalSystem身份的服务默认运行在会话0（隔离的服务专用会话），而登录用户的桌面处于会话1及以上。直接用Process.Start()启动EXE会在会话0执行，用户看不到也无法交互，同时还可能缺少用户环境变量支持。

具体解决步骤 #

1. 获取当前活跃用户的会话ID #

通过Windows API枚举系统会话，找到处于活跃状态的用户会话ID：

[DllImport("wtsapi32.dll")]
private static extern bool WTSEnumerateSessions(IntPtr hServer, int Reserved, int Version, out IntPtr ppSessionInfo, out int pCount);

[DllImport("wtsapi32.dll")]
private static extern void WTSFreeMemory(IntPtr pMemory);

[StructLayout(LayoutKind.Sequential)]
private struct WTS_SESSION_INFO
{
    public int SessionId;
    [MarshalAs(UnmanagedType.LPStr)]
    public string pWinStationName;
    public WTS_CONNECTSTATE_CLASS State;
}

private enum WTS_CONNECTSTATE_CLASS
{
    WTSActive,
    WTSConnected,
    WTSConnectQuery,
    WTSShadow,
    WTSDisconnected,
    WTSIdle,
    WTSListen,
    WTSReset,
    WTSDown,
    WTSInit
}

private static int GetActiveSessionId()
{
    IntPtr serverHandle = IntPtr.Zero;
    IntPtr sessionInfoPtr = IntPtr.Zero;
    int sessionCount = 0;

    try
    {
        if (WTSEnumerateSessions(serverHandle, 0, 1, out sessionInfoPtr, out sessionCount))
        {
            for (int i = 0; i < sessionCount; i++)
            {
                IntPtr currentSessionPtr = IntPtr.Add(sessionInfoPtr, i * Marshal.SizeOf(typeof(WTS_SESSION_INFO)));
                WTS_SESSION_INFO sessionInfo = (WTS_SESSION_INFO)Marshal.PtrToStructure(currentSessionPtr, typeof(WTS_SESSION_INFO));
                
                if (sessionInfo.State == WTS_CONNECTSTATE_CLASS.WTSActive)
                {
                    return sessionInfo.SessionId;
                }
            }
        }
    }
    finally
    {
        if (sessionInfoPtr != IntPtr.Zero)
        {
            WTSFreeMemory(sessionInfoPtr);
        }
    }
    return -1;
}

2. 用用户令牌在目标会话启动EXE #

拿到会话ID后，获取用户令牌，调用CreateProcessAsUser在用户桌面环境启动EXE：

[DllImport("wtsapi32.dll", SetLastError = true)]
private static extern bool WTSQueryUserToken(int sessionId, out IntPtr phToken);

[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
private static extern bool CreateProcessAsUser(
    IntPtr hToken,
    string lpApplicationName,
    string lpCommandLine,
    IntPtr lpProcessAttributes,
    IntPtr lpThreadAttributes,
    bool bInheritHandles,
    uint dwCreationFlags,
    IntPtr lpEnvironment,
    string lpCurrentDirectory,
    [In] ref STARTUPINFO lpStartupInfo,
    out PROCESS_INFORMATION lpProcessInformation);

[StructLayout(LayoutKind.Sequential)]
private struct STARTUPINFO
{
    public int cb;
    public string lpReserved;
    public string lpDesktop;
    public string lpTitle;
    public int dwX;
    public int dwY;
    public int dwXSize;
    public int dwYSize;
    public int dwXCountChars;
    public int dwYCountChars;
    public int dwFillAttribute;
    public int dwFlags;
    public short wShowWindow;
    public short cbReserved2;
    public IntPtr lpReserved2;
    public IntPtr hStdInput;
    public IntPtr hStdOutput;
    public IntPtr hStdError;
}

[StructLayout(LayoutKind.Sequential)]
private struct PROCESS_INFORMATION
{
    public IntPtr hProcess;
    public IntPtr hThread;
    public int dwProcessId;
    public int dwThreadId;
}

[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);

private void StartExeInUserSession(string exePath)
{
    int sessionId = GetActiveSessionId();
    if (sessionId == -1)
    {
        // 记录日志：未找到活跃用户会话
        return;
    }

    IntPtr userToken = IntPtr.Zero;
    if (!WTSQueryUserToken(sessionId, out userToken))
    {
        // 记录日志：获取用户令牌失败，错误码：Marshal.GetLastWin32Error()
        return;
    }

    try
    {
        STARTUPINFO startupInfo = new STARTUPINFO();
        startupInfo.cb = Marshal.SizeOf(startupInfo);
        startupInfo.lpDesktop = "winsta0\\default"; // 指定用户桌面环境

        PROCESS_INFORMATION processInfo = new PROCESS_INFORMATION();

        bool success = CreateProcessAsUser(
            userToken,
            exePath,
            null,
            IntPtr.Zero,
            IntPtr.Zero,
            false,
            0,
            IntPtr.Zero,
            Path.GetDirectoryName(exePath),
            ref startupInfo,
            out processInfo);

        if (!success)
        {
            // 记录日志：启动进程失败，错误码：Marshal.GetLastWin32Error()
        }
        else
        {
            // 关闭句柄避免资源泄漏
            CloseHandle(processInfo.hProcess);
            CloseHandle(processInfo.hThread);
        }
    }
    finally
    {
        CloseHandle(userToken);
    }
}

3. 权限与环境检查 #

• 确认LocalSystem账户拥有SeIncreaseQuotaPrivilege和SeAssignPrimaryTokenPrivilege权限（默认已具备，可通过本地安全策略验证）。
• 如果目标EXE需要管理员权限，可在CreateProcessAsUser的dwCreationFlags参数中添加CREATE_NEW_CONSOLE，同时确保登录用户有运行该EXE的权限。

4. 调试技巧 #

• 在服务中记录Marshal.GetLastWin32Error()返回的错误码，根据错误码定位问题（比如错误5=权限不足，错误1326=令牌无效）。
• 用Process Monitor跟踪服务启动EXE的过程，查看是否存在文件访问被拒绝或环境变量缺失的情况。

内容的提问来源于stack exchange，提问作者ahad