Run in Sandbox

Sample C++ project for launching executables and out-of-process COM servers in a sandboxed low integrity level (IL) or AppContainer process on the same machine. There's no need to create any additional user accounts.

Executable sandboxing

Run RunInSandbox.exe [ac|li|mi|hi] ExePath [-b] to launch the ExePath application in an AppContainer, low IL, medium IL or high IL process. This works for STARTUPINFOEX-based process creation. The -b option is used to break execution immediately after process creation to enable debugging of startup problems.

COM sandboxing

Run RunInSandbox.exe [ac|li|mi|hi] ProgID [-g][-b] to launch the ProgID COM server in an AppContainer, low IL, medium IL or high IL process. The -g option is used to grant AppContainer permissions for the COM server, which only need to be done once.

Example usage:

• RunInSandbox.exe ac TestControl.TestControl -g to start the TestControl project in a AppContainer process and test its COM API.
• RunInSandbox.exe li PowerPoint.Application to start Microsoft PowerPoint in a low IL process connected using COM automation.

Client-side impersonation

This approach performs client-side user impersonation with ImpersonateLoggedOnUser for the current thread. Then the COM server is created with CLSCTX_ENABLE_CLOAKING to allow the COM server to be created with the current thread credentials.

Outstanding challenges

• How to apply removableStorage capability to enable USB stick access for the AppContainer.
• Why is SetCursorPos failing at medium IL if the host is elevated (high IL). Impersonating the shell process (explorer.exe) to escape elevation doesn't seem to help. The problem appear to be caused by UIPI limitations tied to the foreground window.

GrantAccess

Command-line tool to make a file or path writable by AppContainers and low IL process. Useful for whitelisting specific folders that should not be subject to application sandboxing.

RunElevatedNet

C#/.Net sample code for launching an executable or COM class in an "elevated" process with admin privileges. The same functionality is also included in the RunInSandbox project.

COM elevation

Instructions for how to configure COM servers to always run elevated, either with or without UAC.