Why do common privilege reduction methods like runas and lsrunas fail when starting from SYSTEM privileges?
Methods that work from administrator to normal user (e.g., `runas`, `lsrunas`, `CPAU`, PowerShell `Start-Process -Credential`) often fail from SYSTEM because the new process is created with SYSTEM as its parent, and the token does not properly inherit the desktop or interactive session. In testing, `runas` with SYSTEM privileges reported success but the launched process (e.g., calc.exe) failed to start. `CPAU` explicitly does not support SYSTEM-level launch. The root cause is the lack of a proper logon session for the target user. A reliable workaround is using SelectMyParent to set the parent process to an ordinary user's process.
runaslsrunasCPAUprivilege reduction failureSYSTEM tokenSelectMyParent