Re: Windows Service running as LocalSystem and NT AUTHORITY\SERVICE

I would also suggest what Mattias suggested: enumerate the services and g=
et the process id from the SCM and compare it to the process you're inter=
ested in (see EnumServicesStatusEx [http://msdn.microsoft.com/en-us/libra=
ry/ms682648(VS.85).aspx] and SERVICE_STATUS_PROCESS structure [http://msd=
n.microsoft.com/en-us/library/ms685992(VS.85).aspx])

The LocalSystem (NT AUTHORITY\Local System) account is a different accoun=
t from the LocalService (NT AUTHORITY\Local Service) account.  LocalSyste=
m has less rights than LocalService.  Just because a process has been run=
 by the SCM doesn't mean it's running as NT AUTHORITY\Local Service.

There's really no such thing as a "Windows service process".  Most Window=
s services are run directly by the SCM (which then calls specific service=
-specific entry points)--but it's process like any other process.  The be=
st way to reliably tell if a process is a service is to as the SCM if it =
ran it.

You can actually execute an exe with another exe to have it run "as a ser=
vice" (see utilities like srvany)--which may mean you can't ask the SCM a=
bout it.  If that's an issue for you, you may have to see if you can find=
 out what desktop the process is running under.  If the service is config=
ured to interact with the destkop, then you're probably out of luck.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
View archives and manage your subscription(s) at http://peach.ease.lsoft.com/archives