Cross session activation. Session moniker ignored - c++

Question

There are two accounts on my windows pc: \A1 and \SYSTEM. My test project consists of three applications:
Server.exe - out-of-proc com server. implements object Q
Service.exe - out-of proc com service. implements object T
Client.exe - a client applications
My workflow is shown below:
I logged in the \A1. I launch 'Client.exe'.
Client creates an instance of the object 'T'
Client calls some method, say 'T.ActivateQ', which instantiates 'Q'.
My intention is to make Service.exe to create an instance of 'Q' in the account \A1, even though Service.exe resides under the \SYSTEM account.
As stated in this article, Windows has built in functionality to do this kind of activation called 'Session-to-Session activation'. It is implemented by means of Session Moniker ("Session:!clsid:").
Given that, I've configured 'Server.exe' to run as 'Interactive user' via dcomcnfg.
Then I've implemented the function 'CoGetClassObjectInSession':
void CoGetClassObjectInSession(DWORD sessionId, Guid const& clsid, void *pvReserved, Guid const& riid, void **ppv)
{
ATL::CComQIPtr<IBindCtx> bindCtxInst;
COMCHK(CreateBindCtx(NULL, &bindCtxInst));
CComQIPtr<IMoniker> classMonikerInst;
COMCHK(::CreateClassMoniker(clsid, &classMonikerInst));
std::wstringstream ss;
ss << L"Session:" << std::dec << sessionId;
ULONG parsed;
ATL::CComQIPtr<IMoniker> sessionMonikerInst;
COMCHK(::MkParseDisplayNameEx(bindCtxInst, ss.str().c_str(), &parsed, &sessionMonikerInst));
ATL::CComQIPtr<IMoniker> classObjectMoniker;
COMCHK(sessionMonikerInst->ComposeWith(classMonikerInst, FALSE, &classObjectMoniker));
ATL::CComPtr<IClassFactory> sessionFactoryInst;
COMCHK(classObjectMoniker->BindToObject(bindCtxInst, NULL, riid, ppv));
}
and I use it in the service:
HRESULT CMyActivator::Activate()
{
try
{
// Impersonate the client
CComQIPtr<IServerSecurity> ss;
COMCHK(::CoGetCallContext(__uuidof(IServerSecurity), reinterpret_cast<void**>(&ss)));
callctx_impersonation_handle _handle(ss);
ImpersonationScope _imp_scope(_handle);
CComQIPtr<IClassFactory> ppv;
CoGetClassObjectInSession(/*session id for \\A1*/ 1, Guid(__uuidof(Q)), nullptr, Guid(__uuidof(IClassFactory)), reinterpret_cast<void**>(&ppv));
ENSURE(NULL != ppv, "'ppv' should not be null");
return S_OK;
}
catch(std::exception const& ex)
{
return E_FAIL;
}
catch(...)
{
return E_FAIL;
}
}
But nothing happens. I mean the service always launches the server in the session 0 which corresponds to the \SYSTEM account.
Client's security settings:
COMCHK(::CoSetProxyBlanket(
activatorQ
, RPC_C_AUTHN_DEFAULT
, RPC_C_AUTHZ_DEFAULT
, NULL
, RPC_C_AUTHN_LEVEL_DEFAULT
, RPC_C_IMP_LEVEL_DELEGATE
, NULL
, EOAC_DYNAMIC_CLOAKING));
Server.rgs file:
HKLM
{
NoRemove Software
{
NoRemove Classes
{
NoRemove AppID
{
ForceRemove '%APPID%' = s 'Test Server'
{
val RunAs = s 'Interactive User'
}
}
}
}
}
Am I doing something wrong?
UPDATE
I've finally found a solution. The registration script for the class 'Q' was missing the AppID field:
HKCR
{
NoRemove CLSID
{
ForceRemove {6FDE856C-F1B2-4466-8435-20F4AEF2C2E1} = s 'SMonClass Class'
{
ForceRemove Programmable
LocalServer32 = s '%MODULE%'
{
val ServerExecutable = s '%MODULE_RAW%'
}
TypeLib = s '{4FA39B0F-5B24-43C6-A5B1-11D8F34277B7}'
Version = s '1.0'
--> val AppID = s '%APPID%'** <-- This line
}
}
}