IIS 6.0:CreateTimerQueueTimer failure 5 in ISAPI filter

I am developing an ISAPI filter in C++ (win32)
for IIS 6.0/Windows Server 2003

1) The thread used by IIS to call my filter is
running under account "NETWORK SERVICE".

2) my code impersonates with an NT Administrator account

3) then, creates a new thread to which it assign an
NT Administrator account with "SetThreadToken"

4) In the new thread it successfully call "CreateTimerQueue"

5) Then, in the new same thread, when it call
"CreateTimerQueueTimer" to add a timer, the function
fails with error code 5 ???


For test purpose, if the code do not assign an "NT Administrator"
to the new thread it works fine. "CreateTimerQueueTimer" is
executed successfully.


I am puzzled. Any help would be very appreciated. Thank you.

Phil Ten.

Hi Phil,

It appears this issue is not an IIS bug. Based on my experience on ISAPI,
one security article for ISAPI filter may help you some on this issue. You
can obtain it from Microsoft.com. Please go to:
Security Issues
http://msdn.microsoft.com/library/en-us/iisref/htm/SecurityIssues.asp?frame=
true

Furthermore, I'd also suggest you can ask the same issue to platformSDK
newsgroup. These SDK experts will give a lot of help on this issue. The
PlatformSDK is located at:
Microsoft.public.platformSDK.security

Thank you for using Microsoft NewsGroup!

Wei-Dong Xu
Microsoft Product Support Services
Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.