HPCMSL 1.9.0 – User proxy not detected due to WTSQueryUserToken failure (Error 1314)

[andre_steden]

Hello,

I believe I have found a proxy detection issue in HP Client Management Script Library (HPCMSL) 1.9.0, specifically in HPNetworkProxy.dll.

Problem

HPCMSL does not use the proxy configured in the current user's Windows Internet Settings. Instead, it eventually attempts a direct HTTPS connection, which fails in an environment where direct Internet access is blocked.

Example:

Test-HPPrivateIsDownloadNeeded `
    -url "https://hpia.hpcloud.hp.com/ref/platformList.cab" `
    -file "C:\Temp\platformList.cab"

This fails with an exception similar to:

Error executing http request:
System.AggregateException:
All Proxy Types and retry attempts failed

The underlying connection attempts are made directly to the destination server on TCP/443 instead of through the configured proxy.

Windows user proxy configuration

The current user has a static proxy configured:

HKU\<User-SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings

ProxyEnable = 1
ProxyServer = http://proxy.example.com:8080

Windows/.NET correctly detects this proxy:

[System.Net.WebRequest]::DefaultWebProxy.GetProxy(
    [Uri]'https://hpia.hpcloud.hp.com/ref/platformList.cab')

Result:

http://proxy.example.com:8080/

A test using HttpClient with the standard Windows/.NET proxy configuration also succeeds.

Therefore, the proxy itself and the connection through the proxy are working correctly.

Investigation of HPNetworkProxy.dll

I investigated the behavior of HPNetworkProxy.dll.

UserIEEnabledProxyHelper obtains the user SID using:

_currentUserSid = CurrentUserUtils.UserSid();

UserSid() delegates to:

public static string UserSid()
{
    return UserSidForWin32App();
}

UserSidForWin32App() first determines an active session and then calls:

uint activeSessionId = GetActiveSessionId();

if (WTSQueryUserToken(activeSessionId, out IntPtr Token))
{
    // retrieve SID from token}

return string.Empty;

I reproduced this part independently on the affected system. The result is:

Active Session ID : 1
WTSQueryUserToken : False
Win32 Error       : 1314
SID from Token    :

Win32 error 1314 (ERROR_PRIVILEGE_NOT_HELD) indicates that the calling process does not hold the required privilege for WTSQueryUserToken.

As a result, UserSidForWin32App() returns an empty string and UserIEEnabledProxyHelper cannot read the current user's proxy configuration from:

HKU\<User-SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings

There is another potentially relevant observation: GetActiveSessionId() returned Session 1, while the PowerShell process executing HPCMSL was running in Session 2.

GetActiveSessionId() appears to enumerate WTS sessions and return the first session whose state is WTSActive, rather than necessarily using the session of the calling process.

Workaround / confirmation

I tested the same proxy through the HP-specific machine-wide proxy configurations.

First, using the GPO proxy configuration:

HKLM\SOFTWARE\Policies\Hewlett-Packard\HP Touchpoint Manager\GPO\ProxyPath

StaticProxy = http://proxy.example.com:8080

With this value present, the HPCMSL request works successfully.

I then removed this value and tested the DAAS proxy configuration:

HKLM\SOFTWARE\Hewlett-Packard\HP Touchpoint Manager\Agent

StaticProxy = http://proxy.example.com:8080

The HPCMSL request also works successfully with this configuration.

Removing the machine-wide proxy configuration causes the original problem to return.

This appears to isolate the issue to the per-user proxy detection path (UserIEEnabledProxyHelper), rather than the HTTP connection or proxy implementation itself.

In summary:

Windows/.NET user proxy          -> works
HP GPO StaticProxy               -> works
HP DAAS StaticProxy              -> works
HP UserIEEnabledProxyHelper      -> fails
WTSQueryUserToken                -> fails with Win32 error 1314
Direct connection fallback       -> fails because direct Internet access is blocked

Possible cause / suggested fix

CurrentUserUtils.UserSid() currently depends on WTSQueryUserToken() succeeding.

If this API call fails, there does not appear to be a fallback for obtaining the SID of the current process user.

A possible fallback could be conceptually similar to:

public static string UserSid()
{
    string sid = UserSidForWin32App();

    if (string.IsNullOrEmpty(sid))
    {
        sid = System.Security.Principal.WindowsIdentity            .GetCurrent()
            .User            .Value;
    }

    return sid;
}

It may also be worth reviewing whether selecting the first WTSActive session is appropriate when multiple Windows sessions exist.

Expected behavior

HPCMSL should detect and use the proxy configured for the current user when ProxyEnable=1 and a valid ProxyServer is present.

Actual behavior

The user SID cannot be obtained because WTSQueryUserToken() fails with error 1314. The configured user proxy is therefore not detected, and HPCMSL eventually attempts a direct connection.

Could HP please confirm whether this is a known issue in HPCMSL 1.9.0 / HPNetworkProxy.dll and whether a fix is planned?

Thank you.