Why does PSEXEC -i -s work in Windows 7 as services can no longer interact with the desktop?

Question

According to this MSDN article:

Important Services cannot directly interact with a user as of Windows Vista. Therefore, the techniques mentioned in the section titled Using an Interactive Service should not be used in new code.

Why does psexec \\REMOTEPCNAME -i -s cmd still actually work properly and launch a command prompt in the NT AUTHORITY\SYSTEM context? Does SysInternals have Windows cheat codes?

Answer 1

The psexec service has sufficient privileges (SeTcbPrivilege) to obtain tokens for other sessions with WTSQueryUserToken (which it then gives to CreateProcessAsUser or something similar).

See also: http://www.remkoweijnen.nl/blog/2007/10/20/how-to-launch-a-process-in-a-terminal-session/