Running an interactive application with elevated privileges within a Standard User - c++

Question

I am trying to open an interactive application running under the SYSTEM account within the desktop of a standard user(The interactive application has Administrative Privileges). I know this is generally not possible due to session isolation etc. However, I have witnessed applications which does so.
#pragma comment(lib, "advapi32.lib")
using namespace std;
STARTUPINFO GetStartupInfo()
{
STARTUPINFO startupInfo;
ZeroMemory(&startupInfo, sizeof(startupInfo));
startupInfo.cb = sizeof(startupInfo);
startupInfo.lpDesktop = const_cast<LPWSTR>(_T("Winsta0\\default"));
startupInfo.dwFlags = STARTF_USESHOWWINDOW;
startupInfo.wShowWindow = SW_SHOW;
return startupInfo;
}
HANDLE SetInfoOnToken(HANDLE existingToken)
{
HANDLE duplicateToken;
DWORD TokenSessionId = 1;
DuplicateTokenEx(existingToken, MAXIMUM_ALLOWED, nullptr, SECURITY_IMPERSONATION_LEVEL::SecurityIdentification, TOKEN_TYPE::TokenPrimary, &duplicateToken);
SetTokenInformation(duplicateToken, TOKEN_INFORMATION_CLASS::TokenSessionId, &TokenSessionId, sizeof(TokenSessionId));
return duplicateToken;
}
bool SetTcbPrivilege(HANDLE hToken)
{
TOKEN_PRIVILEGES tp;
LUID luid;
bool success = LookupPrivilegeValue(NULL, _T("SeTcbPrivilege"), &luid);
if (!success) {
wcout << GetLastError();
return false;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(&hToken,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,(PDWORD)NULL))
{
printf("AdjustTokenPrivileges error: %u\n", GetLastError());
return false;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) return false;
}
int _tmain(int argc, TCHAR *argv[], TCHAR *envp[])
{
wstring processName = _T("notepad.exe");
TCHAR* name = (wchar_t*)processName.c_str();
DWORD sessionId = 0;
STARTUPINFO startupInfo = GetStartupInfo();
PROCESS_INFORMATION processInformation;
HANDLE processHandle = nullptr;
ZeroMemory(&processInformation, sizeof(processInformation));
HANDLE hToken = GetCurrentProcessToken();
SetTcbPrivilege(hToken);
hToken = SetInfoOnToken(hToken);
bool success = false;
success = CreateProcessAsUser(hToken, nullptr, name, nullptr, nullptr, false, 0, nullptr, nullptr, &startupInfo, &processInformation);
if (success)
{
wcout << "Process started.\n";
}
else
{
wcout << "There was a problem starting the process.\n";
wcout << GetLastError();
return 0;
}
CloseHandle(processInformation.hProcess);
CloseHandle(processInformation.hThread);
return 0;
}
This code works perfectly when started normally. But when run under the SYSTEM account, it does not show the notepad window (I am aware it generally shouldn't, but that is the limitation I am trying to overcome and have seen certain apps doing so). There is however a process for notepad listed in the Task Manager.
What am I missing in the code which returns this unexpected behavior ? I am left with less samples of such scenario, so please provide any suggestions on this.
EDIT:
At this point the process does not run an leaves an ERROR_INVALID_HANDLE error. What am I doing incorrect ? Please suggest.