Starting a process in an AppContainer from a service (LOCAL_SYSTEM)

Hello,

I am trying to run a process in an AppContainer. This process is created from a service, so is in session 0 running as LOCAL_SYSTEM.

I have also tried CreateProcessAsUser to run it as LOCAL_SERVICE (also in session 0) and it doesn't work.

If I use WTSQueryUserToken to get the token of a logged in user, the process in the AppContainer does work. Also if I run my code as a logged in user rather than from a service, it works.

Finally, curiously running "cmd.exe" as the process in the AppContainer works in all cases. But "powershell.exe" does not and "java.exe --version" does not. With the latter I have ensured that the correct ACL (read/execute) is set on JAVA_HOME (and as mentioned, all of these cases work when run as a logged in user)

In the cases where the processes don't work the error code is 0xC0000142

What am I missing here? Do AppContainers not work with services by design? Is there any way I can get better debug on why the processes are failing to start? I'm presuming a file permission issue on a runtime dependency, but what it could be is beyond me

Thanks,
Alex

Appendix:
cmd.exe

• LOCAL_SYSTEM - yes
• LOCAL_SERVICE - yes
• logged in admin - yes

powershell.exe

• LOCAL_SYSTEM - no
• LOCAL_SERVICE - no
• logged in admin - yes

java.exe --version

• LOCAL_SYSTEM - no
• LOCAL_SERVICE - no
• logged in admin - yes