Re: Get a process owner username...

This will not solve your problem but can you get this via WMI? If that can
be done perhaps it suggests another avenue.


John Warner

-----Original Message-----
From: Discussion of advanced .NET topics.
[mailto:[email protected]] On Behalf Of Mike Andrews
Sent: Wednesday, May 20, 2009 2:07 PM
To: [email protected]
Subject: Re: [ADVANCED-DOTNET] Get a process owner username...

I'm trying to get this working but still not having any luck.
I found a posting at MSDN
Forums<http://social.msdn.microsoft.com/Forums/en-US/windowssdk/thread/6878
3a59-c553-4c1b-8697-d78c5a4ca8af>where
someone has a similar issue.  Instead he uses GetUserObjectSecurity.
This code is in C++ so I've been trying to convert it to C# but haven't had
much luck.  The method call GetUserObjectSecurity also fails.

Does any know if the Local Security Policy Setting called "Create a token
object" the security setting that will allow access for the
OpenProcessToken?  I tried it by adding administrators (of which I am one)
and just myself and neither affected the method call returning "Access is
Denied."

I also looked up the AdjustTokenPrivileges method and it requires a valid
Token Handle which wouldn't work since I can't acquire one.


On Wed, May 20, 2009 at 12:10 PM, Wilson, Phil
<[email protected]>wrote:

> You might be Administrator but there's probably some right you need
> that you don't actually currently have, maybe SE_DEBUG_NAME, so you'd
> need to do something like an AdjustTokenPrivileges on yourself first.
>
> Phil Wilson
>
> -----Original Message-----
> From: Discussion of advanced .NET topics. [mailto:
> [email protected]] On Behalf Of Mike Andrews
>  Sent: Wednesday, May 20, 2009 8:52 AM
> To: [email protected]
> Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
>
> Hi Alex.
>
> Thanks for the help.  However I'm still having the same problem.
> Here's my code that I'm using.  Some of it I got on pinvoke.net for
> the flags and api signatures and some of it was on CodeProject.
>
> [DllImport("kernel32")]
> static extern IntPtr OpenProcess(
>    ProcessAccessFlags dwDesiredAccess,
>    int inheritHandle,
>    int dwProcessId
> );
> [DllImport("advapi32", SetLastError = true)] static extern int
> OpenProcessToken(
>    IntPtr ProcessHandle,
>    DesiredAccess DesiredAccess,
>    out IntPtr TokenHandle
> );
> public enum DesiredAccess : uint {
>    STANDARD_RIGHTS_REQUIRED = 0x000F0000,
>    STANDARD_RIGHTS_READ = 0x00020000,
>    TOKEN_ASSIGN_PRIMARY = 0x0001,
>    TOKEN_DUPLICATE = 0x0002,
>    TOKEN_IMPERSONATE = 0x0004,
>    TOKEN_QUERY = 0x0008,
>    TOKEN_QUERY_SOURCE = 0x0010,
>    TOKEN_ADJUST_PRIVILEGES = 0x0020,
>    TOKEN_ADJUST_GROUPS = 0x0040,
>    TOKEN_ADJUST_DEFAULT = 0x0080,
>    TOKEN_ADJUST_SESSIONID = 0x0100,
>    TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY),
>    TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
>        TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY |
> TOKEN_QUERY_SOURCE |
>        TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS |
> TOKEN_ADJUST_DEFAULT
> |
>        TOKEN_ADJUST_SESSIONID)
> }
> [Flags]
> public enum ProcessAccessFlags : uint {
>    All = 0x001F0FFF,
>    Terminate = 0x00000001,
>    CreateThread = 0x00000002,
>    VMOperation = 0x00000008,
>    VMRead = 0x00000010,
>    VMWrite = 0x00000020,
>    DupHandle = 0x00000040,
>    SetInformation = 0x00000200,
>    QueryInformation = 0x00000400,
>    Synchronize = 0x00100000
> }
>
> public static string GetProcessUser(Process p) {
>    IntPtr k = IntPtr.Zero;
>    IntPtr process = OpenProcess(ProcessAccessFlags.QueryInformation,
> 0, p.Id);
>    var t = OpenProcessToken(process, DesiredAccess.TOKEN_QUERY, out k);
>    var lastError = Marshal.GetLastWin32Error();
>    var exception = new Win32Exception(lastError);
>    return null;
> }
> It still returns "Access is Denied" or error 5 for the call to
> OpenProcessToken.  However the OpenProcess method returns the correct
> process handle that
>
>
>
> On Wed, May 20, 2009 at 10:31 AM, Alex Ivanoff
> <[email protected]
> >wrote:
>
> > 1. Call OpenProcess with PROCESS_QUERY_INFORMATION.
> > 2. Call OpenProcessToken with TOKEN_QUERY.
> > 3. Call GetTokenInformation with TokenOwner.
> >
> >
> > -----Original Message-----
> > From: Discussion of advanced .NET topics.
> > [mailto:[email protected]] On Behalf Of Mike
> > Andrews
> > Sent: Wednesday, May 20, 2009 10:28
> > To: [email protected]
> > Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
> >
> > Hi Peter.
> > Yes, I figured as much.
> > I do have plans for this to be run by another user but for now I'm
> > running it under my own account.  My OS is Windows XP Pro and my
> > account is an Administrator.  I've tried the various flags but each
> > one gives me the same Access Denied message.  I must be doing
> > something wrong since I can use Process Explorer from sysinternals
> > and it shows the Domain\Username just fine.
> >
> >
> >
> > On Wed, May 20, 2009 at 10:19 AM, Peter Ritchie <
> > [email protected]> wrote:
> >
> > > One thing to keep in mind when calling this method is that the
> > > current
> > user
> > > needs to have permission to request that information.  I believe
> > > if
> > the user
> > > is not an administrator they will not have that permission; which
> > would
> > > result in the Access Denied error.
> > >
> > > -- Peter
> > >
> > > ===================================
> > > View archives and manage your subscription(s) at
> > > http://peach.ease.lsoft.com/archives
> > >
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
> >
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at
http://peach.ease.lsoft.com/archives

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives