Re: Get a process owner username...

You might be Administrator but there's probably some right you need that you don't actually currently have, maybe SE_DEBUG_NAME, so you'd need to do something like an AdjustTokenPrivileges on yourself first. 

Phil Wilson 

-----Original Message-----
From: Discussion of advanced .NET topics. [mailto:[email protected]] On Behalf Of Mike Andrews
Sent: Wednesday, May 20, 2009 8:52 AM
To: [email protected]
Subject: Re: [ADVANCED-DOTNET] Get a process owner username...

Hi Alex.

Thanks for the help.  However I'm still having the same problem.  Here's my
code that I'm using.  Some of it I got on pinvoke.net for the flags and api
signatures and some of it was on CodeProject.

[DllImport("kernel32")]
static extern IntPtr OpenProcess(
    ProcessAccessFlags dwDesiredAccess,
    int inheritHandle,
    int dwProcessId
);
[DllImport("advapi32", SetLastError = true)]
static extern int OpenProcessToken(
    IntPtr ProcessHandle,
    DesiredAccess DesiredAccess,
    out IntPtr TokenHandle
);
public enum DesiredAccess : uint {
    STANDARD_RIGHTS_REQUIRED = 0x000F0000,
    STANDARD_RIGHTS_READ = 0x00020000,
    TOKEN_ASSIGN_PRIMARY = 0x0001,
    TOKEN_DUPLICATE = 0x0002,
    TOKEN_IMPERSONATE = 0x0004,
    TOKEN_QUERY = 0x0008,
    TOKEN_QUERY_SOURCE = 0x0010,
    TOKEN_ADJUST_PRIVILEGES = 0x0020,
    TOKEN_ADJUST_GROUPS = 0x0040,
    TOKEN_ADJUST_DEFAULT = 0x0080,
    TOKEN_ADJUST_SESSIONID = 0x0100,
    TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY),
    TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
        TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY |
TOKEN_QUERY_SOURCE |
        TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT
|
        TOKEN_ADJUST_SESSIONID)
}
[Flags]
public enum ProcessAccessFlags : uint {
    All = 0x001F0FFF,
    Terminate = 0x00000001,
    CreateThread = 0x00000002,
    VMOperation = 0x00000008,
    VMRead = 0x00000010,
    VMWrite = 0x00000020,
    DupHandle = 0x00000040,
    SetInformation = 0x00000200,
    QueryInformation = 0x00000400,
    Synchronize = 0x00100000
}

public static string GetProcessUser(Process p) {
    IntPtr k = IntPtr.Zero;
    IntPtr process = OpenProcess(ProcessAccessFlags.QueryInformation, 0,
p.Id);
    var t = OpenProcessToken(process, DesiredAccess.TOKEN_QUERY, out k);
    var lastError = Marshal.GetLastWin32Error();
    var exception = new Win32Exception(lastError);
    return null;
}
It still returns "Access is Denied" or error 5 for the call to
OpenProcessToken.  However the OpenProcess method returns the correct
process handle that



On Wed, May 20, 2009 at 10:31 AM, Alex Ivanoff <[email protected]>wrote:

> 1. Call OpenProcess with PROCESS_QUERY_INFORMATION.
> 2. Call OpenProcessToken with TOKEN_QUERY.
> 3. Call GetTokenInformation with TokenOwner.
>
>
> -----Original Message-----
> From: Discussion of advanced .NET topics.
> [mailto:[email protected]] On Behalf Of Mike Andrews
> Sent: Wednesday, May 20, 2009 10:28
> To: [email protected]
> Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
>
> Hi Peter.
> Yes, I figured as much.
> I do have plans for this to be run by another user but for now I'm
> running
> it under my own account.  My OS is Windows XP Pro and my account is an
> Administrator.  I've tried the various flags but each one gives me the
> same
> Access Denied message.  I must be doing something wrong since I can use
> Process Explorer from sysinternals and it shows the Domain\Username just
> fine.
>
>
>
> On Wed, May 20, 2009 at 10:19 AM, Peter Ritchie <
> [email protected]> wrote:
>
> > One thing to keep in mind when calling this method is that the current
> user
> > needs to have permission to request that information.  I believe if
> the user
> > is not an administrator they will not have that permission; which
> would
> > result in the Access Denied error.
> >
> > -- Peter
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
> >
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives