這裡主要是參考msdn上一篇文章，地址是https://msdn.microsoft.com/en-us/gg465093

我自己的程式碼如下

bool CATLdemoModule::LaunchSession1Process( LPTSTR lpCommand )
{
	BOOL bSuccess = FALSE;
	STARTUPINFO si = {0};
	PROCESS_INFORMATION pi = {0};
	si.cb = sizeof(si);

	DWORD dwSessionID = WTSGetActiveConsoleSessionId();

	HANDLE hToken = NULL;
	if (WTSQueryUserToken(dwSessionID, &hToken) == FALSE)
	{
		 LogEvent(L"讀取當前登入使用者的令牌資訊失敗");
	}
	HANDLE hDuplicatedToken = NULL;
	if (DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityIdentification, TokenPrimary, &hDuplicatedToken) == FALSE)
	{
	    LogEvent(L"複製當前登入使用者的令牌資訊失敗");
	}
	LPVOID lpEnvironment = NULL;
	if (CreateEnvironmentBlock(&lpEnvironment, hDuplicatedToken, FALSE) == FALSE)
	{
	    LogEvent(L"創造環境失敗");
	}
	WCHAR lpszClientPath[MAX_PATH];
	if (GetModuleFileName(NULL, lpszClientPath, MAX_PATH) == 0)
	{
	    LogEvent(L"獲取當前程序已載入模組的檔案的完整路徑失敗");
	}
	PathRemoveFileSpec(lpszClientPath);//刪除最後檔名
	wcscat_s(lpszClientPath, sizeof(lpszClientPath)/sizeof(WCHAR), L"\\NCexplorer.exe");
	if (CreateProcessAsUser(hDuplicatedToken, lpszClientPath, NULL, NULL, NULL, FALSE,
	NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT,
	lpEnvironment, NULL, &si, &pi) == FALSE)
	{
	    LogEvent(L"建立新程序失敗");
	}
	
	CloseHandle(pi.hProcess);
	CloseHandle(pi.hThread);
	bSuccess = TRUE;
	return bSuccess;
}