How to determine process security level?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

ESmith - 23 Jan 2007 13:43 GMT

I want to enumerate through the running processes on the system and
determine if the process is running with a higher security token then the
current user, that is, which are the more privileged processes then the
executing one - how can accomplish this?

TIA

Reply to this Message

Dominick Baier - 23 Jan 2007 13:53 GMT

Windows (before Vista) does not have a concept of less/more privileged processess/account
(you may know something from *ix systems)

Obviosly there are normal users, administrators and SYSTEM. But two normal
users can have totally different privileges based on a combination of group
memberships and OS privileges.

A normal user could e.g. have the SeTcbPrivilege which makes him as powerful
as SYSTEM...

So it is hard to compare two accounts...

-----
Dominick Baier (http://www.leastprivilege.com)

> I want to enumerate through the running processes on the system and
> determine if the process is running with a higher security token then
> the current user, that is, which are the more privileged processes
> then the executing one - how can accomplish this?
>
> TIA

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...