One of the little problems that crop up more often than I'd ever have guessed is this: Given a service, launch a GUI program under another user account and give it access to the interactive desktop.
The steps this involves are roughly:
 | LogonUser(), or get an impersonation token and DuplicateTokenEx() to get a primary token |
| Locate the interactive window station, add the user to its DACL |
| Same for the default desktop in that window station |
| Call CreateProcessAsUser() |
lu_cpau_gui.cpp, 14 KB