Protected mode and COM activation hosted in service

[Guest]

From reading the working with protected mode paper it seems that it is
possible to elevate a COM extension at the medium level by registering in IE.
Would that be supported if the COM server is a singleton COM server hosted
under LocalService account service on the local machine ?
I understand that the other option is to change the LaunchPermission key to
allow the low IE process to bind the COM object but I'd prefer using medium
elevation only to avoid lowering the security on the service.

thanks

 

[Alex Chmut]

Protected-mode IE run in Low Integrity Level
Services run in System Integrity Level (which is higher than even
admin-elevated Integrity Level).
In short you cannot get your service run in other than System IL, but you
can impersonate a calling client.