Re: Get a process owner username...

I'm just going to resort to WMI.
I've just given up on utilizing WIN32 api calls.  It's too complex and too
many security issues involved for it to work and WMI seems to fulfil what I
need.


On Wed, May 20, 2009 at 1:39 PM, John Warner <[email protected]> wrote:

> This will not solve your problem but can you get this via WMI? If that can
> be done perhaps it suggests another avenue.
>
>
> John Warner
>
> -----Original Message-----
> From: Discussion of advanced .NET topics.
> [mailto:[email protected]] On Behalf Of Mike Andrews
> Sent: Wednesday, May 20, 2009 2:07 PM
> To: [email protected]
> Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
>
> I'm trying to get this working but still not having any luck.
> I found a posting at MSDN
> Forums<
> http://social.msdn.microsoft.com/Forums/en-US/windowssdk/thread/6878
> 3a59-c553-4c1b-8697-d78c5a4ca8af>where
>  someone has a similar issue.  Instead he uses GetUserObjectSecurity.
> This code is in C++ so I've been trying to convert it to C# but haven't had
> much luck.  The method call GetUserObjectSecurity also fails.
>
> Does any know if the Local Security Policy Setting called "Create a token
> object" the security setting that will allow access for the
> OpenProcessToken?  I tried it by adding administrators (of which I am one)
> and just myself and neither affected the method call returning "Access is
> Denied."
>
> I also looked up the AdjustTokenPrivileges method and it requires a valid
> Token Handle which wouldn't work since I can't acquire one.
>
>
> On Wed, May 20, 2009 at 12:10 PM, Wilson, Phil
> <[email protected]>wrote:
>
> > You might be Administrator but there's probably some right you need
> > that you don't actually currently have, maybe SE_DEBUG_NAME, so you'd
> > need to do something like an AdjustTokenPrivileges on yourself first.
> >
> > Phil Wilson
> >
> > -----Original Message-----
> > From: Discussion of advanced .NET topics. [mailto:
> > [email protected]] On Behalf Of Mike Andrews
> >  Sent: Wednesday, May 20, 2009 8:52 AM
> > To: [email protected]
> > Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
> >
> > Hi Alex.
> >
> > Thanks for the help.  However I'm still having the same problem.
> > Here's my code that I'm using.  Some of it I got on pinvoke.net for
> > the flags and api signatures and some of it was on CodeProject.
> >
> > [DllImport("kernel32")]
> > static extern IntPtr OpenProcess(
> >    ProcessAccessFlags dwDesiredAccess,
> >    int inheritHandle,
> >    int dwProcessId
> > );
> > [DllImport("advapi32", SetLastError = true)] static extern int
> > OpenProcessToken(
> >    IntPtr ProcessHandle,
> >    DesiredAccess DesiredAccess,
> >    out IntPtr TokenHandle
> > );
> > public enum DesiredAccess : uint {
> >    STANDARD_RIGHTS_REQUIRED = 0x000F0000,
> >    STANDARD_RIGHTS_READ = 0x00020000,
> >    TOKEN_ASSIGN_PRIMARY = 0x0001,
> >    TOKEN_DUPLICATE = 0x0002,
> >    TOKEN_IMPERSONATE = 0x0004,
> >    TOKEN_QUERY = 0x0008,
> >    TOKEN_QUERY_SOURCE = 0x0010,
> >    TOKEN_ADJUST_PRIVILEGES = 0x0020,
> >    TOKEN_ADJUST_GROUPS = 0x0040,
> >    TOKEN_ADJUST_DEFAULT = 0x0080,
> >    TOKEN_ADJUST_SESSIONID = 0x0100,
> >    TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY),
> >    TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
> >        TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY |
> > TOKEN_QUERY_SOURCE |
> >        TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS |
> > TOKEN_ADJUST_DEFAULT
> > |
> >        TOKEN_ADJUST_SESSIONID)
> > }
> > [Flags]
> > public enum ProcessAccessFlags : uint {
> >    All = 0x001F0FFF,
> >    Terminate = 0x00000001,
> >    CreateThread = 0x00000002,
> >    VMOperation = 0x00000008,
> >    VMRead = 0x00000010,
> >    VMWrite = 0x00000020,
> >    DupHandle = 0x00000040,
> >    SetInformation = 0x00000200,
> >    QueryInformation = 0x00000400,
> >    Synchronize = 0x00100000
> > }
> >
> > public static string GetProcessUser(Process p) {
> >    IntPtr k = IntPtr.Zero;
> >    IntPtr process = OpenProcess(ProcessAccessFlags.QueryInformation,
> > 0, p.Id);
> >    var t = OpenProcessToken(process, DesiredAccess.TOKEN_QUERY, out k);
> >    var lastError = Marshal.GetLastWin32Error();
> >    var exception = new Win32Exception(lastError);
> >    return null;
> > }
> > It still returns "Access is Denied" or error 5 for the call to
> > OpenProcessToken.  However the OpenProcess method returns the correct
> > process handle that
> >
> >
> >
> > On Wed, May 20, 2009 at 10:31 AM, Alex Ivanoff
> > <[email protected]
> > >wrote:
> >
> > > 1. Call OpenProcess with PROCESS_QUERY_INFORMATION.
> > > 2. Call OpenProcessToken with TOKEN_QUERY.
> > > 3. Call GetTokenInformation with TokenOwner.
> > >
> > >
> > > -----Original Message-----
> > > From: Discussion of advanced .NET topics.
> > > [mailto:[email protected]] On Behalf Of Mike
> > > Andrews
> > > Sent: Wednesday, May 20, 2009 10:28
> > > To: [email protected]
> > > Subject: Re: [ADVANCED-DOTNET] Get a process owner username...
> > >
> > > Hi Peter.
> > > Yes, I figured as much.
> > > I do have plans for this to be run by another user but for now I'm
> > > running it under my own account.  My OS is Windows XP Pro and my
> > > account is an Administrator.  I've tried the various flags but each
> > > one gives me the same Access Denied message.  I must be doing
> > > something wrong since I can use Process Explorer from sysinternals
> > > and it shows the Domain\Username just fine.
> > >
> > >
> > >
> > > On Wed, May 20, 2009 at 10:19 AM, Peter Ritchie <
> > > [email protected]> wrote:
> > >
> > > > One thing to keep in mind when calling this method is that the
> > > > current
> > > user
> > > > needs to have permission to request that information.  I believe
> > > > if
> > > the user
> > > > is not an administrator they will not have that permission; which
> > > would
> > > > result in the Access Denied error.
> > > >
> > > > -- Peter
> > > >
> > > > ===================================
> > > > View archives and manage your subscription(s) at
> > > > http://peach.ease.lsoft.com/archives
> > > >
> > >
> > > ===================================
> > > View archives and manage your subscription(s) at
> > > http://peach.ease.lsoft.com/archives
> > >
> > > ===================================
> > > View archives and manage your subscription(s) at
> > > http://peach.ease.lsoft.com/archives
> > >
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
> >
> > ===================================
> > View archives and manage your subscription(s) at
> > http://peach.ease.lsoft.com/archives
> >
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>
> ===================================
> View archives and manage your subscription(s) at
> http://peach.ease.lsoft.com/archives
>

===================================
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives