Immediate crash when trying to run as a different user

[conioh]

Describe the bug

App crashes during load when run as a different user than the one to whom the Terminal Services session belongs.

Steps to reproduce the bug

1. Install Visual Studio 2022 version 17.2.3.
2. Restart the computer.
3. On the Windows sign-in screen sign-in to User A.
4. Install Windows App SDK C++ VS2022 Templates extension version 1.1.0.76285337.
5. Install the Windows App SDK Runtime version 1.1.0 x64 (WindowsAppRuntimeInstall-1.1.0-x64.exe).
6. Start Visual Studio.
7. Create a new project using the instructions at the following page: https://docs.microsoft.com/en-us/windows/apps/winui/winui3/create-your-first-winui3-app#non-msix-packaged-create-a-new-project-for-a-non-msix-packaged-c-or-c-winui-3-desktop-app
   1. Use the Blank App, Packaged (WinUI 3 in Desktop) template.
   2. Add <WindowsPackageType>None</WindowsPackageType> to the .vcxproj.
   3. Modify <AppxPackage>true</AppxPackage> to <AppxPackage>false</AppxPackage>
   4. Run using the Unpackaged launch profile and make sure everything works.
8. Locate the EXE and launch it in a variety of other ways - double click in Windows Explorer, launch using full path in PowerShell, execute (F6) in WinDbg, etc. - and see that they all work.
9. Sign out of the TS session or lock it (🪟+L).
10. Back in the Windows sign-in screen sign-in to User B.
11. Install the same WindowsAppRuntimeInstall-1.1.0-x64.exe from above.
12. Launch the EXE in all the ways mentioned in section 8 and verify that they all work.
13. Sign out of the TS session or lock it.
14. Back again in the Windows sign-in screen sign-in to User A again.
15. From the TS session of User A run the EXE as User B in any of the following ways and note that it crashes in them all:
    1. From Windows Explorer, hold shift and right click on the EXE, select Run as a different user,
    2. If User A is not an administrator and User B is, right click and select Run as administrator.
    3. Launch PowerShell/cmd as a User B and launch the EXE from there.
    4. Run WinDbg as User B, and launch the EXE from there.

Microsoft (R) Windows Debugger Version 10.0.22621.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: D:\repos\App5\App5\x64\Debug\App5\App5.exe

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*D:\Symbols\Microsoft*http://msdl.microsoft.com/download/symbols
REDACTED

************* Path validation summary **************
Response                         Time (ms)     Location
REDACTED
Symbol search path is: REDACTED
Executable search path is: 
ModLoad: 00007ff7`87b50000 00007ff7`87cce000   App5.exe
ModLoad: 00007ffa`e0300000 00007ffa`e0509000   ntdll.dll
ModLoad: 00007ffa`dfd20000 00007ffa`dfddd000   C:\WINDOWS\System32\KERNEL32.DLL
ModLoad: 00007ffa`dd7f0000 00007ffa`ddb69000   C:\WINDOWS\System32\KERNELBASE.dll
ModLoad: 00007ffa`dfe20000 00007ffa`e0198000   C:\WINDOWS\System32\combase.dll
ModLoad: 00007ffa`ddec0000 00007ffa`ddfd1000   C:\WINDOWS\System32\ucrtbase.dll
ModLoad: 00007ffa`9cc90000 00007ffa`9ccbb000   C:\WINDOWS\SYSTEM32\VCRUNTIME140D.dll
ModLoad: 00007ffa`df590000 00007ffa`df6b0000   C:\WINDOWS\System32\RPCRT4.dll
ModLoad: 00007ffa`6daa0000 00007ffa`6db83000   C:\WINDOWS\SYSTEM32\MSVCP140D.dll
ModLoad: 00007ffa`ded20000 00007ffa`dedf6000   C:\WINDOWS\System32\OLEAUT32.dll
ModLoad: 00007ffa`c0f30000 00007ffa`c0f3f000   C:\WINDOWS\SYSTEM32\VCRUNTIME140_1D.dll
ModLoad: 00007ffa`ddfe0000 00007ffa`de07d000   C:\WINDOWS\System32\msvcp_win.dll
ModLoad: 00007ffa`6d050000 00007ffa`6d271000   C:\WINDOWS\SYSTEM32\ucrtbased.dll
ModLoad: 00007ffa`9cb10000 00007ffa`9cb44000   D:\repos\App5\App5\x64\Debug\App5\Microsoft.WindowsAppRuntime.Bootstrap.dll
ModLoad: 00007ffa`dfb80000 00007ffa`dfd1a000   C:\WINDOWS\System32\ole32.dll
ModLoad: 00007ffa`dea80000 00007ffa`deaa9000   C:\WINDOWS\System32\GDI32.dll
ModLoad: 00007ffa`ddc30000 00007ffa`ddc56000   C:\WINDOWS\System32\win32u.dll
ModLoad: 00007ffa`de080000 00007ffa`de192000   C:\WINDOWS\System32\gdi32full.dll
ModLoad: 00007ffa`def70000 00007ffa`df11c000   C:\WINDOWS\System32\USER32.dll
ModLoad: 00007ffa`de950000 00007ffa`de9fe000   C:\WINDOWS\System32\ADVAPI32.dll
ModLoad: 00007ffa`deec0000 00007ffa`def63000   C:\WINDOWS\System32\msvcrt.dll
ModLoad: 00007ffa`e0200000 00007ffa`e029e000   C:\WINDOWS\System32\sechost.dll
ModLoad: 00007ffa`de1a0000 00007ffa`de94f000   C:\WINDOWS\System32\SHELL32.dll
(8cb0.740c): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffa`e03dd114 cc              int     3
0:000> g
ModLoad: 00007ffa`dfde0000 00007ffa`dfe11000   C:\WINDOWS\System32\IMM32.DLL
ModLoad: 00007ffa`dde40000 00007ffa`ddebf000   C:\WINDOWS\System32\bcryptPrimitives.dll
D:\a\_work\1\s\BuildOutput\Release\x64\WindowsAppRuntime_DLL\WindowsAppRuntimeInsights.h(53)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB224DB: (caller: 00007FFA9CB1E1C6) LogHr(1) tid(740c) 8007007E The specified module could not be found.
    Msg:[Unable to load resource dll. Microsoft.WindowsAppRuntime.Insights.Resource.dll] 
ModLoad: 00007ffa`dc9a0000 00007ffa`dc9b8000   C:\WINDOWS\SYSTEM32\kernel.appcore.dll
ModLoad: 00007ffa`dee00000 00007ffa`deeaf000   C:\WINDOWS\System32\clbcatq.dll
ModLoad: 00007ffa`d3250000 00007ffa`d3384000   C:\Windows\System32\AppXDeploymentClient.dll
ModLoad: 00007ffa`d3d60000 00007ffa`d3f4f000   C:\WINDOWS\SYSTEM32\urlmon.dll
ModLoad: 00007ffa`d3d30000 00007ffa`d3d58000   C:\Windows\System32\srvcli.dll
ModLoad: 00007ffa`dc440000 00007ffa`dc44c000   C:\Windows\System32\netutils.dll
ModLoad: 00007ffa`d3a70000 00007ffa`d3d23000   C:\Windows\System32\iertutil.dll
ModLoad: 00007ffa`be890000 00007ffa`be980000   C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 00007ffa`db7b0000 00007ffa`db916000   C:\WINDOWS\SYSTEM32\wintypes.dll
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(776)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B0D9: (caller: 00007FFA9CB19C2F) LogHr(2) tid(740c) 80040010 Object is not in any of the inplace active states
    Msg:[Bootstrap.Intitialize: Scanning packages for Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0] CallContext:[\Initialize] 
ModLoad: 00007ffa`d3420000 00007ffa`d343b000   C:\WINDOWS\SYSTEM32\windows.staterepositorycore.dll
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(865)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B85C: (caller: 00007FFA9CB19C2F) LogHr(3) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.485.2229.0-x6-p3_1000.485.2229.0_x64__8wekyb3d8bbwe not applicable. Version doesn't match MinVersion criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(865)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B85C: (caller: 00007FFA9CB19C2F) LogHr(4) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.485.2229.0-x8-p3_1000.485.2229.0_x86__8wekyb3d8bbwe not applicable. Version doesn't match MinVersion criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(885)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1BB5E: (caller: 00007FFA9CB19C2F) LogHr(5) tid(740c) 80040012 Not able to perform the operation because object is not given storage yet
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x6_1000.516.2156.0_x64__8wekyb3d8bbwe is applicable (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(876)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B9F8: (caller: 00007FFA9CB19C2F) LogHr(6) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x8_1000.516.2156.0_x86__8wekyb3d8bbwe not applicable. Architecture doesn't match current architecture x64 (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(908)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1C486: (caller: 00007FFA9CB19C2F) LogHr(7) tid(740c) 80040013     Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x6_1000.516.2156.0_x64__8wekyb3d8bbwe best matches the criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0) of 118 packages scanned] CallContext:[\Initialize] 
ModLoad: 00007ffa`ac030000 00007ffa`ac0fa000   C:\WINDOWS\System32\twinui.appcore.dll
ModLoad: 00007ffa`db920000 00007ffa`dc188000   C:\WINDOWS\System32\Windows.Storage.dll
ModLoad: 00007ffa`cceb0000 00007ffa`cd6c6000   C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
ModLoad: 00007ffa`dec30000 00007ffa`ded1a000   C:\WINDOWS\System32\shcore.dll
ModLoad: 00007ffa`acca0000 00007ffa`acda4000   C:\WINDOWS\SYSTEM32\daxexec.dll
ModLoad: 00007ffa`dce60000 00007ffa`dce89000   C:\WINDOWS\System32\USERENV.dll
ModLoad: 00007ffa`c1ff0000 00007ffa`c2033000   C:\WINDOWS\System32\container.dll
ModLoad: 00007ffa`d84a0000 00007ffa`d84b7000   C:\WINDOWS\SYSTEM32\usermgrcli.dll
onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(332)\daxexec.dll!00007FFAACD41F38: (caller: 00007FFAACD4154D) Exception(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
(8cb0.740c): C++ EH exception - code e06d7363 (first chance)
(8cb0.740c): C++ EH exception - code e06d7363 (first chance)
onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(113)\daxexec.dll!00007FFAACD570E1: (caller: 00007FFAACD1D3FF) ReturnHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    Msg:[onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(332)\daxexec.dll!00007FFAACD41F38: (caller: 00007FFAACD4154D) Exception(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
] CallContext:[\TryActivateDesktopAppXApplication] 
onecore\base\appmodel\execmodel\desktopappx\desktoplib\desktopaamextensions.cpp(170)\daxexec.dll!00007FFAACD1D428: (caller: 00007FFAAC05C412) LogHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
onecore\base\appmodel\execmodel\desktopappx\desktoplib\desktopaamextensions.cpp(203)\daxexec.dll!00007FFAACD1D5CD: (caller: 00007FFAAC05C412) ReturnHr(2) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
onecoreuap\shell\twinui\activation\lib\applicationactivationmanagerproxy.cpp(90)\twinui.appcore.dll!00007FFAAC05C435: (caller: 00007FFA9CB19E34) ReturnHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
(8cb0.740c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrap_StopActivity+0x93:
00007ffa`9cb24403 88050d230100    mov     byte ptr [Microsoft_WindowsAppRuntime_Bootstrap!_tlgEvent+0xf (00007ffa`9cb36716)],al ds:00007ffa`9cb36716=00
0:000> k
 # Child-SP          RetAddr               Call Site
00 0000004f`a496d940 00007ffa`9cb248ff     Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrap_StopActivity+0x93 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrapTracelogging.cpp @ 15] 
01 0000004f`a496da10 00007ffa`9cb1d2d1     Microsoft_WindowsAppRuntime_Bootstrap!wilResultLoggingThreadCallback+0x20f [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrapTracelogging.cpp @ 143] 
02 0000004f`a496dad0 00007ffa`9cb26313     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ThreadFailureCallbackFn<bool (__cdecl&)(wil::FailureInfo const &) noexcept>::NotifyFailure+0x11 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1085] 
03 (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure+0xa0 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1040] 
04 0000004f`a496db00 00007ffa`9cb1428e     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::GetContextAndNotifyFailure+0xc3 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1100] 
05 (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::LogFailure+0xed [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3522] 
06 0000004f`a496db30 00007ffa`9cb14410     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_NoReturn<0>+0x12e [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3669] 
07 0000004f`a496f030 00007ffa`9cb1447f     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_Base<0,0>+0x30 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3705] 
08 0000004f`a496f090 00007ffa`9cb14498     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_Hr<0>+0x5f [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3866] 
09 0000004f`a496f110 00007ffa`9cb1a092     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::in1diag3::_Throw_Hr+0x18 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 5630] 
0a (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::in1diag3::Throw_IfFailed+0x257 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 5662] 
0b 0000004f`a496f160 00007ffa`9cb18ede     Microsoft_WindowsAppRuntime_Bootstrap!CreateLifetimeManagerViaEnumeration+0x4e2 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 616] 
0c (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!CreateLifetimeManager+0x13b [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 555] 
0d 0000004f`a496f430 00007ffa`9cb18453     Microsoft_WindowsAppRuntime_Bootstrap!FirstTimeInitialization+0x1fe [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 343] 
0e 0000004f`a496f5e0 00007ffa`9cb18128     Microsoft_WindowsAppRuntime_Bootstrap!_MddBootstrapInitialize+0x53 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 204] 
*** WARNING: Unable to verify checksum for App5.exe
0f 0000004f`a496f620 00007ff7`87c28e6c     Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrapInitialize2+0x2e8 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 129] 
10 0000004f`a496f860 00007ff7`87c28d94     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::AutoInitialize::Initialize+0x6c [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 75] 
11 0000004f`a496fa00 00007ff7`87babc07     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::AutoInitialize::AutoInitialize+0x24 [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 32] 
12 0000004f`a496fb00 00007ffa`6d1022a3     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::`dynamic initializer for 'g_autoInitialize''+0x27 [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 82] 
13 0000004f`a496fc00 00007ff7`87c44819     ucrtbased!_initterm+0x63 [minkernel\crts\ucrt\src\appcrt\startup\initterm.cpp @ 22] 
14 0000004f`a496fc40 00007ff7`87c4477e     App5!__scrt_common_main_seh+0x89 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 258] 
15 0000004f`a496fcb0 00007ff7`87c44aae     App5!__scrt_common_main+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 331] 
16 0000004f`a496fce0 00007ffa`dfd354e0     App5!wWinMainCRTStartup+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_wwinmain.cpp @ 17] 
17 0000004f`a496fd10 00007ffa`e030485b     KERNEL32!BaseThreadInitThunk+0x10
18 0000004f`a496fd40 00000000`00000000     ntdll!RtlUserThreadStart+0x2b

Expected behavior

Program running.

Screenshots

NuGet package version

1.1.0

Packaging type

Unpackaged

Windows version

Windows 11 version 21H2 (22000)

IDE

Visual Studio 2022

[riverar]

Howard Kapustein (@DrusTheAxe) Are runas scenarios supported? I can repro this and a similar issue (inability to find machine-wide runtime).

[conioh]

Howard Kapustein (@DrusTheAxe) Are runas scenarios supported? I can repro this and a similar issue (inability to find machine-wide runtime).

Note that I have installed the runtime for the other user too.

[DrusTheAxe]

Hmmm. I haven't seen the Run as another user feature before. Let me do some investigation to determine what it's actually doing.

As a general rule, you can run an app using WinAppSDK as long as the runtime is installed for that user e.g. the Microsoft.WindowsAppRuntime.1.1 MSIX package is registered for that user.

Alternatively, if the package is provisioned then it's made available to all users. At login a list of packages you should have but don't (and have but shouldn't) is built and processed, before you get to the desktop.

I doubt Run as another user is performing a full login. If it's just CreateProcessAsUser then results would depend on state of the machine and that user's profile. Will do some digging.

[conioh]

Hmmm. I haven't seen the Run as another user feature before. Let me do some investigation to determine what it's actually doing.

That's odd. It's been there at least since Windows XP, where it was called Run as..., and probably even before that, but my memory doesn't go that far.

As a general rule, you can run an app using WinAppSDK as long as the runtime is installed for that user e.g. the Microsoft.WindowsAppRuntime.1.1 MSIX package is registered for that user.

Right. Except it doesn't. Hence this issue.

Alternatively, if the package is provisioned then it's made available to all users. At login a list of packages you should have but don't (and have but shouldn't) is built and processed, before you get to the desktop.

That's interesting but not the situation here, since I've run the runtime installer from the second user, and when the TS session belongs to the second user the test program runs.

I doubt Run as another user is performing a full login. If it's just CreateProcessAsUser then results would depend on state of the machine and that user's profile. Will do some digging.

I don't know what that means. A call to CreateProcessAsUser requires a previous call to LogonUser or equivalent, and the flags passed to it are certainly not LOGON32_LOGON_BATCH or LOGON32_LOGON_SERVICE so that pretty much leaves only LOGON32_LOGON_INTERACTIVE. What's a "full login"?

Anyway, again, this doesn't really matter here since, again, I have installed the runtime for the second user, being logged on to the console as the second user, so there was no dependency on the provisioned package being auto-installed for the user.

[conioh]

I have updated the steps to reproduce above in hopes of making the situation more clear.

[Balkoth]

Is it relevant that this happens on a terminal session? I can see it crash when trying to run an unpackaged app from a normal desktop session as different user. It also crashes when trying to run as admin which is supposed to work with 1.1 onwards. So what is going on here?

[conioh]

Is it relevant that this happens on a terminal session? I can see it crash when trying to run an unpackaged app from a normal desktop session as different user. It also crashes when trying to run as admin which is supposed to work with 1.1 onwards. So what is going on here?

That's just the term. I never said it was a remote session.

In the context of users and programs run by those users there are two things called "a session".

One of them is logon sessions, which represent a login for the purposes of permissions (including by a service account, or a login for SMB), are the basis for tokens, are represented by the SEP_LOGON_SESSION_REFERENCES struct and can be enumerated with LsaEnumerateLogonSessions.

The other one is Terminal Services sessions which represent a physical connection a console†, local or remote, used by Remote Desktop Services and Fast User Switching. They can be enumerated by the WTSEnumerateSessions function, where WTS stands for Windows Terminal Services. Certain information about them is published via the WM_WTSSESSION_CHANGE windows message, where again WTS stands for the same thing.

Each token is linked to a specific Terminal Services session, and while the member of the TOKEN struct that identifies the session is called simply SessionId rather than the lengthy MicrosoftWindowsTerminalServicesSessionId (as is the member of the MM_SESSION_SPACE struct etc.), WinDbg's !token command does use the term "TS session". Once more "TS" stands for Terminal Services.

0: kd> !token ffffd50c6602a060
_TOKEN 0xffffd50c6602a060
TS Session ID: 0
User: S-1-5-18
User Groups:
 00 S-1-16-16384
    Attributes - GroupIntegrity GroupIntegrityEnabled
...

0: kd> dt nt!_TOKEN ffffd50c6602a060
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER 0x06207526`b64ceb90
   +0x030 TokenLock        : 0xffff8887`f1245210 _ERESOURCE
   +0x038 ModifiedId       : _LUID
   +0x040 Privileges       : _SEP_TOKEN_PRIVILEGES
   +0x058 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x078 SessionId        : 0
...

0: kd> !token ffffd50c75adb7f0
_TOKEN 0xffffd50c75adb7f0
TS Session ID: 0x1
User: S-1-5-21-3728847233-3017425221-756437700-1001
User Groups:
 00 S-1-16-0
    Attributes - GroupIntegrity GroupIntegrityEnabled
...

0: kd> dt nt!_TOKEN ffffd50c75adb7f0
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER 0x7fffff36`d5969fff
   +0x030 TokenLock        : 0xffff8887`f817be90 _ERESOURCE
   +0x038 ModifiedId       : _LUID
   +0x040 Privileges       : _SEP_TOKEN_PRIVILEGES
   +0x058 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x078 SessionId        : 1
...

This term is used throughout Windows.

Here, since the processes run under different users, using different logon sessions, but in the same TS session, it was appropriate to qualify the term so as to reduce confusion. "Two processes in different logon session running in the same session" is undoubtedly worse than "two processes in different logon sessions running in the same Terminal Services session."

"Normal desktop session" isn't a thing. It's unclear and suggests the question are there abnormal desktop sessions. There's an existing term and I simply used it.

It also crashes when trying to run as admin which is supposed to work with 1.1 onwards. So what is going on here?

Programming is hard and not everyone is equally qualified or able to do it adequately.

† Except in the special case of session 0 since Windows Vista. Vista leverages the security boundary formed by TS session (in the Object Manager etc.) to separate certain system processes from user processes and protect them. That Windows XP gave the first user that logs on to the machine access to the "global namespace" it just odd and that was fixed in Vista.

[Balkoth]

In my case on a normal dekstop session, with no terminal services involved, event viewer logs the following error:

<EventData>
  <Data>Windows App Runtime</Data>
  <Data>ERROR 0x80070520: Bootstrapper initialization failed while looking for version 1.1 (MSIX package version >= 1002.543.1943.0)</Data>
</EventData>

[Balkoth]

Further investigation shows that adding <WindowsAppSDKSelfContained>true</WindowsAppSDKSelfContained> to the project or publishing file lets the application run successfully with a different than the logged on user.

[DrusTheAxe]

Install the Windows App SDK Runtime version 1.1.0 x64

Does this repro with a recent servicing update (1.1.2+)? There were some fixes in 1.1.2 that may be significant here.

Is 1.1.2+ registered for the other user? Easiest way to tell is via an admin cmd prompt

powershell -c get-appxpackage -AllUsers micro*win*apprun*

and the PackageUserInformation property shows which users have the package registered e.g.

...
PackageUserInformation : {S-1-5-21-4071067175-473297690-1648030122-1003 [bob]: Installed}
...

[conioh]

Does this repro with a recent servicing update (1.1.2+)? There were some fixes in 1.1.2 that may be significant here.

As expected, the same crash still happens with:

• Windows 11 22000.795
• Visual Studio 2022 17.2.6
• Windows SDK 22621
• Windows App SDK C++ Templates extension 1.1.2.78612342
• Project NuGet packages (default):

  <?xml version="1.0" encoding="utf-8"?>
  <packages>
    <package id="Microsoft.Windows.CppWinRT" version="2.0.210806.1" targetFramework="native" />
    <package id="Microsoft.Windows.ImplementationLibrary" version="1.0.211019.2" targetFramework="native" />
    <package id="Microsoft.Windows.SDK.BuildTools" version="10.0.22000.194" targetFramework="native" />
    <package id="Microsoft.WindowsAppSDK" version="1.1.2" targetFramework="native" />
  </packages>

  or (updated):

  <?xml version="1.0" encoding="utf-8"?>
  <packages>
    <package id="Microsoft.Windows.CppWinRT" version="2.0.220608.4" targetFramework="native" />
    <package id="Microsoft.Windows.ImplementationLibrary" version="1.0.220201.1" targetFramework="native" />
    <package id="Microsoft.Windows.SDK.BuildTools" version="10.0.22621.1" targetFramework="native" />
    <package id="Microsoft.WindowsAppSDK" version="1.1.3" targetFramework="native" />
  </packages>

• Runtime packages:

  PS C:\> Get-AppxPackage -AllUsers Micro*Win*AppRun* | Select-Object PackageFullName, PackageUserInformation | fl
  
  PackageFullName        : Microsoft.WindowsAppRuntime.1.1_1003.565.600.0_x64__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}
  
  PackageFullName        : Microsoft.WindowsAppRuntime.1.1_1003.565.600.0_x86__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}
  
  PackageFullName        : MicrosoftCorporationII.WinAppRuntime.Main.1.1_1003.565.600.0_x64__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}
  
  PackageFullName        : MicrosoftCorporationII.WinAppRuntime.Singleton_1003.565.600.0_x64__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}
  
  PackageFullName        : Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_1003.565.600.0_x64__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}
  
  PackageFullName        : Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x8_1003.565.600.0_x86__8wekyb3d8bbwe
  PackageUserInformation : {S-1-5-21-RIDs-1002 [SomeUsername]: Installed,
                          S-1-5-21-RIDs-1001 [SomeUsernameA]: Installed}

CreateLifetimeManagerViaEnumeration make the following call:

WindowsAppSDK/dev/WindowsAppRuntime_BootstrapDLL/MddBootstrap.cpp

Line 654 in 097d220

THROW_IF_FAILED(aam->ActivateApplication(lifetimeManagerApplicationUserModelId, arguments, c_options, &processId));

with the following values:

      lifetimeManagerApplicationUserModelId = wchar_t [130] "Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_8wekyb3d8bbwe!DDLM"
                          packageFamilyName = "Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_8wekyb3d8bbwe"
                            packageFullName = "Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_1003.565.600.0_x64__8wekyb3d8bbwe"

The package indeed exists:

PS C:\> Get-AppxPackage | Where-Object -Property "PackageFullName" -EQ "Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_1003.565.600.0_x64__8wekyb3d8bbwe" | Select-Object Name, PackageFamilyName, PackageFullName | fl

Name              : Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6
PackageFamilyName : Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_8wekyb3d8bbwe
PackageFullName   : Microsoft.WinAppRuntime.DDLM.1003.565.600.0-x6_1003.565.600.0_x64__8wekyb3d8bbwe

And has the requested AUMID. (I'll skip dumping the manifest here.)

From there the call flow is the following:

Microsoft_WindowsAppRuntime_Bootstrap!CreateLifetimeManagerViaEnumeration;
|-- twinui_appcore!ApplicationActivationManagerProxy::ActivateApplication;
    |-- daxexec!TryActivateDesktopAppXApplication;
        |-- daxexec!EvaluateApplicationLaunch;
            |-- daxexec!GetActivationProperties;
                |-- daxexec!GetTargetUserTokenAndUserContext;
                    |-- daxexec!wil::open_current_access_token;
                    |-- usermgrcli!UMgrQueryUserContext;

daxexec!wil::open_current_access_token simply returns the process token and then usermgrcli!UMgrQueryUserContext does an RPC call that fails with error 0x80070520.

I don't see anything that was done in relation to this, which is why it makes sense that except for the version (the AUMID passed to aam->ActivateApplication) this is exactly the same flow and error as with the previous versions.

Regarding your previous comment:

I doubt Run as another user is performing a full login. If it's just CreateProcessAsUser then results would depend on state of the machine and that user's profile. Will do some digging.

runas.exe uses CreateProcessWithLogonW which does login as full as any other and is enough to run any other program I can think of and have tried.

I don't know if the fault is with Windows or the Windows App SDK, and without source code access I can't debug it any more than point the stack trace mentioned above, but even if the problem is with Windows such that everything in Windows works under such a login except for IApplicationActivationManager::ActivateApplication, maybe the newest application framework shouldn't depend on it?

[DrusTheAxe]

I don't know if the fault is with Windows or the Windows App SDK

That'll be Windows. From your info it's pretty clear CreateProcessWithLogonW and app activation aren't intersecting in expected/desired ways, and that's Windows and its support for MSIX.

WinAppSDK provides added functionality, in some cases working around Windows to achieve equivalent ends, but only so much you can work around.

Hunting up the activation experts...

+Jeff Whiteside (@jsidewhite) Brian Alker (@brialmsft) Darren Hoehna (@dhoehna)