Re: Windows Service running as LocalSystem and NT AUTHORITY\SERVICE

I would do it the other way around.
Ask SCM for a list of services and their PIDs and compare that with =20
the pid of your process.



On 26/09/2009, at 8:35 AM, "Alex Ivanoff" <[email protected]> =20
wrote:

> I hope someone on this list knows the answer to my question (no one =20
> Microsoft forums seems to know).
>
> We need a way to check whether the process is Windows service. For =20
> this we check process token for the presence of NT AUTHORITY\SERVICE =20
> group. It works except for when service is running as LocalSystem: =20
> then NT AUTHORITY\SERVICE group is not present in the process token. =20
> But if you look at the process token with ProcessExplorer it shows =20
> that this group is still present. Are we using the wrong API to get =20
> process token groups?
>
> Thank you,
> Alex

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives