Description:
------------
I run php as fastcgi on Win2000 / IIS with Zend Enabler (FASTCGI-Handler). 

The Webserver uses impersonation for its virtual hosts, the worker process is running as user
IWAM_SERVERNAME the scripts (.asp/.php) impersonate to the security context of user IUSR_SERVERNAME.

In fastcgi.conf (for ZendEnabler) Impersonate="1" is set,
in php.ini fcgi.impersonate=1 is set.

So the php scripts now also use the impersonated security context. (As expected.)

But if I start a external process (Imagemagick) with exec(),passthru(),popen() or proc_open() this external process uses the default security context in my example the user IWAM_SERVERNAME.

So all the permissions set for the virtual host user (IUSR_SERVERNAME)
do not work for the external process because it runs as IWAM_SERVERNAME and so I get a permission denied.

As I understand this is the default behaviour in windows process modell when creating a new process with WinApi-function CreateProcess().
In my opinion it would be better to use CreateProcessAsUser() in php so the new Process will also use the impersonated SecurityContext.
(when php.ini fcgi.impersonate=1 is set)

I think this feature would be very useful to keep security in virtual hosting environments on IIS high (seperate permissions for virtual hosts), with the upcoming Microsoft-FCGI-ISAP-Handler the IIS installations with PHP will surely raise and this feature will become much more relevant.