测试出来了第一版代码--可以得到用户token啦

#include <windows.h>
#include <stdio.h>
#include <process.h>
#include <Tlhelp32.h>
#include <tchar.h>
#include <psapi.h>
#include <stdio.h>
#include <STDLIB.H>
#include <tlhelp32.h>
#include <WtsApi32.h>
#include <windows.h>
#include <stdio.h>
#include <Userenv.h>
#include <Wtsapi32.h>
#pragma comment(lib, "WtsApi32.lib")
#pragma  comment (lib,"psapi")
#pragma  comment (lib,"user32.lib")
#pragma  comment (lib,"advapi32.lib")
#pragma comment(lib,"ws2_32.lib")


//Function to run a process as active user from windows service
void ImpersonateActiveUserAndRun()
{


    DWORD session_id = -1;
    DWORD session_count = 0;
    WTS_SESSION_INFOA *pSession = NULL;


    if (WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, &pSession, &session_count))
    {
        printf("pSession=====%d\n", pSession);
        printf("session_count=====%d\n", session_count);
    }
    else
    {
        printf("WTSEnumerateSessions ===============failed \n");
        printf("ERROR: %d", GetLastError());
        return;
    }
    for (DWORD i = 0; i < session_count; i++)
    {
        session_id = pSession[i].SessionId;
        printf("session_id=====%d\n", session_id);

        WTS_CONNECTSTATE_CLASS wts_connect_state = WTSDisconnected;
        WTS_CONNECTSTATE_CLASS* ptr_wts_connect_state = NULL;

        DWORD bytes_returned = 0;
        if (::WTSQuerySessionInformation(
            WTS_CURRENT_SERVER_HANDLE,
            session_id,
            WTSConnectState,
            reinterpret_cast<LPTSTR*>(&ptr_wts_connect_state),
            &bytes_returned))
        {
            wts_connect_state = *ptr_wts_connect_state;
            ::WTSFreeMemory(ptr_wts_connect_state);
            //printf("wts_connect_state=====%d\n", wts_connect_state);
            if (wts_connect_state != WTSActive) continue;
        }
        else
        {
            printf("WTSQuerySessionInformation ===============failed \n");
            printf("ERROR: %d", GetLastError());
            return;
        }

        HANDLE hImpersonationToken = 0;
        BOOL bRet = WTSQueryUserToken(session_id, &hImpersonationToken);
        if (bRet == false)
        {
            printf(" WTSQueryUserToken ERROR: %d\n", GetLastError());
        }
        printf("hImpersonationToken=====%d\n", hImpersonationToken);


        //Get real token from impersonation token
        DWORD neededSize1 = 0;
        HANDLE *realToken = new HANDLE;
        //TOKEN_USER tkUser;
        TOKEN_USER *pTokenUser = NULL;
        PTOKEN_GROUPS pGroups = NULL;
        //if (GetTokenInformation(hImpersonationToken, TokenGroups, NULL, neededSize1, &neededSize1))
        if (GetTokenInformation(hImpersonationToken, TokenUser, NULL, 0, &neededSize1))
        //if (GetTokenInformation(hImpersonationToken, TokenUser, &tkUser, sizeof(tkUser), &neededSize1))
        //if (GetTokenInformation(hImpersonationToken, (::TOKEN_INFORMATION_CLASS) TokenLinkedToken, realToken, sizeof(HANDLE), &neededSize1))
        {
            CloseHandle(hImpersonationToken);
            hImpersonationToken = pTokenUser;
        }
        else
        {
            printf(" neededSize1: %d\n", neededSize1);
            if (GetLastError() == ERROR_INSUFFICIENT_BUFFER && neededSize1 > 0)
            {
                printf(" ERROR_INSUFFICIENT_BUFFER.\n");
                //pGroups = (PTOKEN_GROUPS)HeapAlloc(GetProcessHeap(), 0, neededSize1);
                pTokenUser = (TOKEN_USER*)new BYTE[neededSize1];
                printf("pTokenUser=====%d\n", pTokenUser);
                if (!GetTokenInformation(hImpersonationToken, TokenUser, pTokenUser, neededSize1, &neededSize1))
                //if (!GetTokenInformation(hImpersonationToken, TokenGroups, pGroups, neededSize1, &neededSize1))
                {
                    HeapFree(GetProcessHeap(), 0, pTokenUser);
                    pTokenUser = NULL;
                }

            }
            printf(" pTokenUser: %d\n", pTokenUser);
            continue;
        }
        printf("hImpersonationToken=====%d\n", hImpersonationToken);

    }

}



void Usage(void)
{
    fprintf(stderr,"==============================\n"
            "\tname:run programe at any session ,need system permission\n"
            "\tsession 1 D:\\callsession\\bin\\callsession.exe \n"
            "==================================\n");
}


int main(int argc, char **argv)
{
    ImpersonateActiveUserAndRun();


    return 0;
}