Ho can i get user account name, that ran the process with specified id. Is there any api function for this?
I am using windows,c++.
-
There is not an API function that does this directly, however you can combine a few API calls to do this. Of course your program will need to satisfy any ACLs that are applied to the process that you are interested in examining.
First, given the process ID, you'll need to open a handle to the process. You can use
OpenProcessfor that, requesting thePROCESS_QUERY_INFORMATIONaccess right.Once you have that handle, you can call
OpenProcessToken, requesting theTOKEN_QUERYaccess right.Finally, you can then call
GetTokenInformation, requesting theTokenUserinformation class, which will give you the user account of the token. This information is provided to you in the form of aSID. To convert theSIDto the actual name of the account, you can callLookupAccountSid.Don't forget to call
CloseHandleon both the process handle and the token handle once you're finished with them.
0 comments:
Post a Comment