Win10下VB.NET使用本地管理员凭据启动提权进程故障排查

你之前遇到的所有报错，本质上和域参数的误传、接口必选参数缺失直接相关，没有涉及接口本身的兼容性问题：

• 所有触发“目录名无效”（Win32错误码267）的场景，核心原因不是域参数传值错误，而是CreateProcessWithLogonW接口要求调用方必须手动指定子进程的有效工作目录——跨用户启动进程时，系统不会自动继承主进程的目录权限，若工作目录留空或指定的路径对启动用户不可访问，就会直接抛出目录无效的错误。
• 触发“存根接收到坏数据”（Win32错误码1783）的场景，是因为给用户名添加了.\前缀：该接口的lpUsername参数仅接受纯账号名，所有计算机/域标识必须单独通过lpDomain参数传递，不支持将域前缀拼接在用户名内。
• 你之前用域普通账号可以成功启动进程、但提示无管理员权限，说明代码的凭据传递链路是完全正常的，问题仅出在账号本身的权限级别上。

按以下规则传参，即可消除所有现有报错：

• 用户名：传纯本地管理员账号名，不带任何前导反斜杠、不带.\前缀（例如账号为LocalCleanAdmin，就直接传该字符串，不要加任何前缀修饰）
• 域参数：传. 代表本地计算机，不要留空字符串——你之前尝试填本机计算机名仍报错，是因为当时没配置正确的工作目录，不是域参数传错了
• 子进程路径：填DeviceCleanupCmd.exe的绝对全路径，不要仅传文件名
• 工作目录：填DeviceCleanupCmd.exe所在文件夹的绝对路径（例如工具存放在C:\Tools目录下，就将工作目录设为C:\Tools）
• 启动标志：必须添加LOGON_WITH_PROFILE标志，否则启动的进程会加载系统临时配置，无法正常访问HKLM注册表下的冗余驱动项，就算权限充足也会操作失败

Imports System.Runtime.InteropServices
Imports System.Text

Module ElevatedProcessLauncher
    ' Windows API 常量定义
    Private Const LOGON_WITH_PROFILE As UInteger = &H1
    Private Const CREATE_NEW_CONSOLE As UInteger = &H10
    Private Const STARTF_USESHOWWINDOW As UInteger = &H1

    <StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
    Private Structure STARTUPINFO
        Public cb As UInteger
        Public lpReserved As String
        Public lpDesktop As String
        Public lpTitle As String
        Public dwX As UInteger
        Public dwY As UInteger
        Public dwXSize As UInteger
        Public dwYSize As UInteger
        Public dwXCountChars As UInteger
        Public dwYCountChars As UInteger
        Public dwFillAttribute As UInteger
        Public dwFlags As UInteger
        Public wShowWindow As Short
        Public cbReserved2 As Short
        Public lpReserved2 As IntPtr
        Public hStdInput As IntPtr
        Public hStdOutput As IntPtr
        Public hStdError As IntPtr
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Private Structure PROCESS_INFORMATION
        Public hProcess As IntPtr
        Public hThread As IntPtr
        Public dwProcessId As UInteger
        Public dwThreadId As UInteger
    End Structure

    <DllImport("advapi32.dll", SetLastError:=True, CharSet:=CharSet.Unicode)>
    Private Function CreateProcessWithLogonW(
        lpUsername As String,
        lpDomain As String,
        lpPassword As String,
        dwLogonFlags As UInteger,
        lpApplicationName As String,
        lpCommandLine As StringBuilder,
        dwCreationFlags As UInteger,
        lpEnvironment As IntPtr,
        lpCurrentDirectory As String,
        <Out> ByRef lpStartupInfo As STARTUPINFO,
        <Out> ByRef lpProcessInformation As PROCESS_INFORMATION
    ) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Function WaitForSingleObject(hHandle As IntPtr, dwMilliseconds As UInteger) As UInteger
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Function CloseHandle(hObject As IntPtr) As Boolean
    End Function

    ''' <summary>
    ''' 提权启动DeviceCleanupCmd完成注册表驱动清理
    ''' </summary>
    ''' <param name="adminUser">本地管理员纯账号名</param>
    ''' <param name="adminPwd">管理员账号密码</param>
    ''' <param name="toolFullPath">DeviceCleanupCmd.exe的绝对全路径</param>
    ''' <returns>执行结果</returns>
    Public Function RunElevatedDeviceCleanup(adminUser As String, adminPwd As String, toolFullPath As String) As (Success As Boolean, Message As String)
        Dim startupInfo As New STARTUPINFO With {
            .cb = CType(Marshal.SizeOf(GetType(STARTUPINFO)), UInteger),
            .dwFlags = STARTF_USESHOWWINDOW,
            .wShowWindow = 0 ' 隐藏子进程窗口
        }
        Dim processInfo As New PROCESS_INFORMATION()
        Dim toolDirectory As String = IO.Path.GetDirectoryName(toolFullPath)
        Dim commandLine As New StringBuilder(toolFullPath)

        ' 核心参数配置：域参数传.代表本地计算机，工作目录指向工具所在路径，带完整配置加载标志
        Dim launchSuccess = CreateProcessWithLogonW(
            lpUsername:=adminUser,
            lpDomain:=".",
            lpPassword:=adminPwd,
            dwLogonFlags:=LOGON_WITH_PROFILE,
            lpApplicationName:=toolFullPath,
            lpCommandLine:=commandLine,
            dwCreationFlags:=CREATE_NEW_CONSOLE,
            lpEnvironment:=IntPtr.Zero,
            lpCurrentDirectory:=toolDirectory,
            lpStartupInfo:=startupInfo,
            lpProcessInformation:=processInfo
        )

        If Not launchSuccess Then
            Dim win32Err = Marshal.GetLastWin32Error()
            Return (False, $"启动失败，Win32错误码: {win32Err}")
        End If

        ' 等待子进程执行完成，超时时间可根据工具实际运行时长调整
        WaitForSingleObject(processInfo.hProcess, 15000)
        CloseHandle(processInfo.hProcess)
        CloseHandle(processInfo.hThread)
        Return (True, "清理进程已启动完成")
    End Function
End Module

• 确认传入的本地管理员账号确实属于目标机器的本地管理员组：若账号仅为普通用户权限，就算凭据验证通过，启动的子进程也不会具备管理员操作权限
• 无需调整工具存放路径，你之前将工具放在非系统保护目录的配置完全符合接口的访问要求
• 凭据传递链路已通过你之前的测试验证：输入错误密码时会触发“用户名或密码不正确”的报错，说明接口的凭据解析逻辑没有问题，不需要额外调整

内容的提问来源于stack exchange，提问作者jtreubig