Finding the user that owns a process.
I have OpenProcess(...) and OpenProcessToken(...) and I can get all sorts of information about a process, except the user name of who's process it is.
Basically this is part of a long painful process of figuring out how to launch a program as another user (you do not have their user-name or password). I have found out that ImpersonateUser() doesn't allow me to launch things as that other user for reasons I do not understand.
Currently I need to load the users profile, but for that to work I need the username and I do not know how to get it. Any help would greatly be appreciated.
Re: Finding the user that owns a process.
Re: Finding the user that owns a process.
Quote:
Originally Posted by
DeepT
I have OpenProcess(...) and OpenProcessToken(...) and I can get all sorts of information about a process, except the user name of who's process it is.
Basically this is part of a long painful process of figuring out how to launch a program as another user (you do not have their user-name or password). I have found out that ImpersonateUser() doesn't allow me to launch things as that other user for reasons I do not understand.
Currently I need to load the users profile, but for that to work I need the username and I do not know how to get it. Any help would greatly be appreciated.
CreateProcessAsUser never requires for something else but token... that you already have. :)
Anyway, GetTokenInformation + TokenUser gives you user's SID, that can be resolved to user account name by LookupAccountSid.
Re: Finding the user that owns a process.
Yeah, but CreateProcessAsUser does not load the user's profile, which does require the user's name. Thanks for this info though. I did go down that path, but then I tried something using a different users account in another session. I could open their process, but I could not open their process token. I was running at a higher privilege then they were.
Basically on vista I created another "normal" account, that is a non-admin account. I opened notepad.exe. I switched to my account, where dev studio is running as Admin, and then I ran into the wall about opening their process token. I needed enough to duplicate it and create a new primary token to launch something, but could never get their token.
Any ideas on that?
All this trouble is because someone demanded I run my installer from an MSI package and that runs it as system which launches my programs as system so I need a way to counter that effect.
Re: Finding the user that owns a process.
Search the web for using NtQuerySystemInformation. This is what task manager uses internally to retrieve the process owner names.
Re: Finding the user that owns a process.
But I still need to open the process token to invoke a process as that user, which I can't for other users in other sessions. Now maybe if Dev studio was running as local system it would work, but it is kind of hard to debug with no GUI.
Actually, I remember trying something like this years ago and asking about it. How do you start a process as another user in another session. IE: You are service in session 0 running as SYSTEM, how do you launch NotePad.exe for the user, as the user, in session 1?
I think in the end, it was not possible. People said it was, but nobody ever gave a working example. I even went on the MSDN forums, and some MSVP posted some code to do it. I compiled it, and it did not work. It ran alright, but the program was as SYSTEM in session 0, not as UserX in session 1.
Re: Finding the user that owns a process.
Quote:
Originally Posted by
DeepT
All this trouble is because someone demanded I run my installer from an MSI package and that runs it as system which launches my programs as system so I need a way to counter that effect.
Can you give system the right to install programs by adjusting a group policy?
Re: Finding the user that owns a process.
I do not really understand that. This is a request from "above". I have no idea how active directory works, or even MSIs beyond this very basic wrapper I created. Maybe if my program was running as SYSTEM those API calls would work for me, but they fail even running as an elevated Admin against a non-admin account, so I have no way to test this since I can't even get a process token (not handle) from another user in another session. Oddly I can open it with Full Privileges, which then I would assume would grant me the right to get an access token with Full or even some privileges, yet even the most minor requests, like Query is denied.
Re: Finding the user that owns a process.
It's not really clear to me what you are trying to do. From what I understand you are trying to launch a separate process (which installs an msi package) from a system process that runs in a non-admin user account.
If so, that is going to fail because the non-admin user account won't have the priviledges to install the msi package.
As far as 'this coming from above'.... keep in mind that all ideas or approaches that come from above aren't necessarily good ones.
2 Attachment(s)
Re: Finding the user that owns a process.
Quote:
Originally Posted by
DeepT
How do you start a process as another user in another session. IE: You are service in session 0 running as SYSTEM, how do you launch NotePad.exe for the user, as the user, in session 1?
I think in the end, it was not possible. People said it was, but nobody ever gave a working example.
Okay, let's close the gap a bit. See the sample attached. It finds the first notepad.exe, obtains its token and runs calc.exe side by side in the same session interactively. I have verified it with my Vista sp1, and it woks alright.
The scenario is as follows:
- Switch to another user account and run notepad.exe
- Switch back to your development account (no notepad running in)
- make
- setup (this is where finally "you're service in session 0 running as SYSTEM")
- run_calc
- see mysvcx.log
- make sure the calc.exe of the PID specifed is running
- switch to the account running notepad and make sure a calculator instance is running there
- close calc and switch back to your development account
- setup -u
In the log finally you have something like that:
Code:
[03/10/09 00:39:23] ++ Start ++
[03/10/09 00:39:26] [PID:5280] Path: C:\Windows\System32\notepad.exe
[03/10/09 00:39:26] [5280] Token: 0000007C
[03/10/09 00:39:26] [5280] uSID: S-1-5-21-3531474516-4049177484-105061100-1002
[03/10/09 00:39:26] [5280] User: IVARTANOV-VISTA\dummy
[03/10/09 00:39:26] Duplicating token handle...
[03/10/09 00:39:26] Impersonating logged on user...
[03/10/09 00:39:26] Running executable...
[03/10/09 00:39:26] C:\Windows\system32\calc.exe
[03/10/09 00:39:26] [PID:8136] Process was run successfully. Waiting for stop...
[03/10/09 00:39:49] Cleanup after process stop...
[03/10/09 00:39:49] Quitting thread...
[03/10/09 00:40:07] -- Stop --
EDIT: Sample updated to support Win7 as well. Please see the difference: it searches for explorer.exe running particular user account.
Re: Finding the user that owns a process.
Quote:
Originally Posted by
DeepT
Yeah, but CreateProcessAsUser does not load the user's profile, which does require the user's name. Thanks for this info though. I did go down that path, but then I tried something using a different users account in another session. I could open their process, but I could not open their process token. I was running at a higher privilege then they were.
Basically on vista I created another "normal" account, that is a non-admin account. I opened notepad.exe. I switched to my account, where dev studio is running as Admin, and then I ran into the wall about opening their process token. I needed enough to duplicate it and create a new primary token to launch something, but could never get their token.
Any ideas on that?
All this trouble is because someone demanded I run my installer from an MSI package and that runs it as system which launches my programs as system so I need a way to counter that effect.
Frankly, all this description looks like a mess... I don't get how all the things you mention relate to each other.
Yeah, CreateProcessAsUser does not load the user's profile. And?.. Since you're talking about impersonating user in session 1, I can get from this the user is already logged in. And if yes, why do you need to load the profile that is already loaded??? :confused:
And regarding the open token thing. Are you talking about interactive process or SYSTEM? According to my sample I gave, LocalSystem account has no problem with opening tokens in user sessions.
Re: Finding the user that owns a process.
Ill look at this project you sent me, maybe it will clear it all up. However, in order to try and clear up what is going on, although your comment about loading a profile may be relevant.
A LONG TIME AGO... (not in a galaxy far far away) I had an application that ran in user-space on windows XP. Then Vista was going to come out, clearly big changes were needed. So I decided to make my application a service since it would need higher privileges and not be bothered by UAC.
My application communicated to the user via web pages. It is a network access control tool and the server (A Linux box) would tell me (the service) which pages to show. For example a page might say, "You do not have anti-virus software installed. The network admin requires anti-virus software. Here is a link or links to some free or site-licensed AV packages you can install."
This had two major problems:
1. Services ran in session 0 and session 0 had no GUI.
2. If the services DID launch a web browser, it would be running as SYSTEM which is a BAD thing.
At the time I tried to figure out how to launch an app as a service. I asked here and I asked on the official MSDN forums. I got code from a MSDN MVP. I tried it, and it DID NOT WORK.
I tried impersonating a logged on user, then doing "shell execute" of the URL and guess what happened? A web browser opened, in session 0, which suddenly got a temporary GUI running as SYSTEM. This was using the exact code provided to my by this MVP guy. This was pre-service pack 1 vista.
So I split my service into two parts. A client that ran in user space, which would be invoked by the startup menu when the user logged in, and then the service which started when the system booted up. The client launched web pages and gave me information from the user's point of view, like what his name was, was he remoting in, etc...
Meanwhile we had been using install-shield. Install-shield sucks, but we paid like 1500 bucks for it AND they update the version 2x a year. They only support one previous version. Their installer was huge and took like 2 minutes to install our product and was not Vista compatable.
I decide to write my own installer. In a few days I have it. It takes less then 1 second to install the product after you hit the install button, and the uninstaller is even faster and can be invoked via Add / Remove programs. So everything is cool. BTW part of the install is to invoke the client app and start the service.
Now lets jump to a few weeks ago: Some admins want a MSI version of our installer. I do not know MSI and I do not have time to try and learn it. If I knew it, I could tell it to invoke an application as a user and not have this issue.
So I wrap my installer in a very simple MSI package which will just run my installer with a /s switch meaning silent. Then we notice that my client is running as SYSTEM and thus begins the problem of how to launch my client as non-system, but as the user.
Now this MSI for testing, is being run from my user space, not being pushed down in AD, so somehow it does launch my client in my session as SYSTEM.
I use my own processes for testing and use impersonate user. There is a problem though. I can't tell if an application is running as an elevated version of me, or a non elevated version of me. BTW I am just testing my installer "raw" and not using the MSI because it would greatly slow down things. So I have an idea, create a non-admin user account, run notepad.exe in it, and do the same things I did for my user test I did before.
Only this time, OpenProcess fails. I find out I need to assign myself debug prives, which I do and now I can OpenProcess on the other user's notepad.exe asking for full access. Next thing on the list: Get the process token.
I can not open the process token no matter what I do. No token = No impersonation. Then I look at CreateProcessAsUser() it warns about not loading the user's profile which is why I asked about the user-name since LoadUserProfile needs a PROFILEINFO structure with a user name.
OK so that part is moot. No longer needed as you have pointed it out. Now I am stuck on getting that process token. Maybe elevated Admin is not allowed to get a token from a "lesser" user in another session and all this would work if I were running as system.
Anyhow, I have that zip file and ill look at when I get a chance, and if it works it will answer a question I have had for a long time. Maybe Vista SP1 did fix something, but I know before SP1, there was nothing on god's green earth I could do from a service to launch something in another user's session, as that user. I had lots of examples, when compiled and run, totally fail.
Re: Finding the user that owns a process.
There are several points in this. I replied to only first one: how to run a process from service in interactive session.
Regarding InstallShield. I'm not sure what is 'Vista compatible', but still use IS7 packages in Vista as well and have no problem with this. Maybe you meant 'Vista certified'?
I'm not MSI pro, so I have no guess about AD and all the stuff. :)
And about Vista. I have tested the solution only on my home system, so I intend to test it once again on my workplace, in a few minutes.
Re: Finding the user that owns a process.
As it was supposed, all worked fine once again.
Re: Finding the user that owns a process.
I am sure it will work fine and Ill learn a lot. Ill probably put it in a folder for things to never forget. I am just really busy with other peoples problems and this is not a high priority anymore I guess.
Re: Finding the user that owns a process.
I looked at your program, I kind of wished it was more of a proper project, but that is a small gripe. I am guessing that the reason my testing (of my code) is failing is because Elevated Admin is not sufficient and you are creating a service, which is running as system which is permitted to do what you did.
I guess I would have to know what level my installer was running at, so I could attempt to do it the way you did if I was running as system, which would ONLY be from an MSI. I can do this with my own processes to simulate it, but to verify it working I would need a way to tell if a process was running elevated or not. Is there an easy way to determine that?
It seems that an elevated user is a "ghosted" version of your user with higher privileges. In task manager it all seems to be the same. I have noticed this because of some annoying network drive mapping problems. I can create mapped network drives to automatically reconnect at login. They work fine for non-elevated apps. However any elevated app sees the same drive as disconnected and they need to re-enter user name / password each time I reboot.
If any elevated program does this, then all elevated programs see the drive mapped. Vista will "Sticky" the non elevated mappings, but refuses to do that with the elevated equivalents. So I am guessing Elevated "me" is really a different user all-together even though my user name and user context is the same.
Re: Finding the user that owns a process.
Quote:
I looked at your program, I kind of wished it was more of a proper project, but that is a small gripe.
Yep, it is. Actually, it was answering the question in the thread's title.
As I said before, there're lots of specific questions you're asking in one thread, so it's hard to me to follow all of them (besides, I can't get a good part of them because of knowing nothing about some specifics). In case you want get the answers from the community, ask the questions separately and clearly.
Or just fing a time to learn MSI and get rid of your surrogate installer, along with the problems it brings in. ;)
Re: Finding the user that owns a process.
Yeah I know, the thread got off track and that is an IT support question really. I found a tool, process explorer that will give me that info and I can tell my installer, on vista is able to launch an app without elevated privileges while itself is running that way. However that was using my own processes in my own session. As for your code, I am going to hold off on it for a while with respect to the MSI installer since I can only test is as "SYSTEM" and I can't run Dev Studio as "SYSTEM" so I can't really step through and debug it. Anyhow, its about time this thread died.
Thanks for all the info.
