AssignProcessToJobObject fails with "Access Denied" error when running under the debugger

Question

You do AssignProcessToJobObject and it fails with "access denied" but only when you are running in the debugger. Why is this?

Answer 1

This one puzzled me for for about 30 minutes.

First off, you probably need a UAC manifest embedded in your app (as suggested here). Something like this:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
  <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
    <!-- Identify the application security requirements. -->
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
      <security>
        <requestedPrivileges>
          <requestedExecutionLevel
            level="asInvoker"
            uiAccess="false"/>
        </requestedPrivileges>
      </security>
    </trustInfo>
  </assembly>

Secondly (and this is the bit I got stuck on), when you are running your app under the debugger, it creates your process in a job object. Which your child process needs to be able to breakaway from before you can assign it to your job. So (duh), you need to specify CREATE_BREAKAWAY_FROM_JOB in the flags for CreateProcess).

If you weren't running under the debugger, or your parent process were in the job, this wouldn't have happened.

Answer 2

This seems to bite me quite often, and while good, 1800INFORMATION's post doesn't seem to include a number of reasons and fixes that seem helpful, so it seem worthwhile to post a summary of why I've seen this happen.

1. When trying to solve this for yourself, note than this problem can occur for different reasons when running from CMD.EXE, Explorer, and Visual Studio. Trying to run the failing executable from the respective places can help identify the cause of the problem. You app may just work find from CMD.EXE in spite of failing from V.S. and Explorer.exe
2. In my case, under Win7, I seemed to need to un-comment the "supportedOS" element indicating Win7 compatibility from the app.manifest file. This seems to fix the problem when running from Explorer. To add a manifest, right click on the project, hit Add, and find 'Application Manifest File'.
3. To get Visual Studio 2010 working, I seemed to need to stop it from using the Program Compatibility Assistant, Tom Minka shares two ways to do this here: https://stackoverflow.com/a/4232259/86375, note, I had to restart VS2010 to take his suggested changes.