Re: Process access across logon session.
From: Ivan Brugiolo [MSFT] (ivanbrug_at_online.microsoft.com)
Date: Mon, 19 May 2003 11:17:04 -0700
Local KD is availalble from WinXP.
You need to get the SD for your process object
then you need to add an ACE to the DACL
for the "Authenticated Users" group with the access mask of
#define SYNCHRONIZE (0x00100000L).
GetSecurityDescriptorDacl and companion APIs will help you on this way.
I think that 'Authenticated Users" will fit hyour needs,
but you may want to look for the "interactive users" group as well.
-- This posting is provided "AS IS" with no warranties, and confers no rights. Use of any included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm "Guogang" <nospam@no_such_domain.com> wrote in message news:eX2fnEjHDHA.1608@TK2MSFTNGP11.phx.gbl... > I can't find anything about LKD, is it available for Windows XP > Professional? > > I'll try to refine my question: > How can I assign "SYNCHRONIZE" access of a process running in USER1 account > to everyone logged in as any account? > > Thanks, > Guogang > > "Ivan Brugiolo [MSFT]" <firstname.lastname@example.org> wrote in message > news:Oroom3BHDHA.email@example.com... > > TaskManager uses WTSEnumerateProcesses in order to have the list of > > processes > > generated by the Terminal Server Service that is running as LocalSystem. > > > > You can dump the dacl of a process object in the following way (using > local > > KD), > > otherwise you will have to get the Security Descriptor from > > the Process Kernel Object and dump it programmatically. > > > > This is for OutLook Express. Basically a process can be accessed by > > localsystem and local administrators, > > plus the primary group of the owner, by default. > > If you own the process, you can add more security principals to the DACL > of > > the SecurityDescriptor > > of the process kernel object > > > > lkd> !process 81766230 0 > > PROCESS 81766230 SessionId: 0 Cid: 0760 Peb: 7ffdf000 ParentCid: > 03dc > > DirBase: 182f7000 ObjectTable: e2e6b648 HandleCount: 393. > > Image: msimn.exe > > > > lkd> ?poi(81766230-4)&FFFFFFF8 > > Evaluate expression: -508985248 = e1a98060 > > lkd> !dumpsd e1a98060 -n > > Revision 1 > > Sbz1 0 > > Control 0x8004 > > SE_DACL_PRESENT > > SE_SELF_RELATIVE > > Owner: S-1-5-32-544 (Alias: BUILTIN\Administrators) > > Group: S-1-5-21-XXXXX-YYYYY-ZZZZZZZ-513 (Group: YourDomain\Domain Users) > > DACL: > > AclRevision 2 > > Sbz1 0 > > AclSize 52 > > AceCount 2 > > Sbz2 0 > > Ace > > AceType 0: ACCESS_ALLOWED_ACE_TYPE > > AceFlags 0 > > AceSize 24 > > AccessMask 0x1f0fff > > S-1-5-32-544 (Alias: BUILTIN\Administrators) > > Ace > > AceType 0: ACCESS_ALLOWED_ACE_TYPE > > AceFlags 0 > > AceSize 20 > > AccessMask 0x1f0fff > > S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM) > > SACL: > > (null) > > > > -- > > This posting is provided "AS IS" with no warranties, and confers no > rights. > > Use of any included script samples are subject to the terms specified at > > http://www.microsoft.com/info/cpyright.htm > > > > > > "Guogang" <nospam@no_such_domain.com> wrote in message > > news:OOHTgkBHDHA.firstname.lastname@example.org... > > > Hi, > > > > > > I login as User1, and there is a Windows Service running as User2 in > > > background (not system). I send an program's processID to the Windows > > > Service, and use the following command to open it: > > > > > > ::OpenProcess(SYNCHRONIZE, FALSE, processID); > > > > > > I have "Access Denied error" here. > > > > > > I also tried to use: ::EnumProcesses as User2, but I can't see processes > > of > > > User1 in the output. This means basically User2 can't see any processes > of > > > User1. BUT, "Windows Task Manager" running in User2's account can list > all > > > the processes running as User1. > > > > > > My question: > > > 1. What permission should User2 has in order to access User1's process? > > > 2. Why "Windows Task Manager" can see some processes, that my C++ > program > > > can't see? > > > > > > Thanks, > > > Guogang > > > > > > > > > > > >