Fix runas function for System Account

[twangboy]

What does this PR do?

Use the elevated token if present when passing runas with an admin account. Only fixes when Salt is running under the LocalSystem account. Need to fix for debug mode under an admin account.

What issues does this PR fix or reference?

https://github.com/saltstack/zh/issues/766

Previous Behavior

When admin credentials were passed to Runas the restricted token was used instead of the full elevated privileges of the user.

New Behavior

Uses the elevated token.

Tests written?

No

[cachedout]

Since I don't understand how this works at all, I would at least like @UtahDave to take a look here so we can get more eyes on this.

[twangboy]

@cachedout When you login as an Administrator on Windows it gives you a restricted token so you're running like a normal user (without admin). When you do something that needs admin, Windows hits you with the UAC Dialog to remove the restrictions on your token. This is like sudo in linux, I believe.

In order to runas on Windows we have to log in (that happens a few lines above). We need to run with the elevated token if it's an admin account, so we get the unrestricted token using the GetTokenInformation command. Then we use that token to execute our command with elevated privileges.

[UtahDave]

@twangboy what happens if the user doesn't have an elevated security token? Will line 302 return the regular token? Or will it stacktrace?

[twangboy]

@UtahDave It will stacktrace

[UtahDave]

@twangboy, do we want that to stacktrace? Or should we catch that and do something else, like return an error message or try with the regular security token?

[twangboy]

Working on checking for admin before elevating... Of course I don't want it to stacktrace. I didn't check that scenario.

[twangboy]

@UtahDave ^^^

[UtahDave]

@twangboy looks like this needs to be rebased.

[twangboy]

Rebased

[twangboy]

@cachedout Is this OK now?