Home All Groups Group Topic Archive Search About

How to determine process security level?

Author
23 Jan 2007 1:43 PM
ESmith
I want to enumerate through the running processes on the system and
determine if the process is running with a higher security token then the
current user, that is, which are the more privileged processes then the
executing one - how can accomplish this?

TIA

Author
23 Jan 2007 1:53 PM
Dominick Baier
Windows (before Vista) does not have a concept of less/more privileged processess/account
(you may know something from *ix systems)

Obviosly there are normal users, administrators and SYSTEM. But two normal
users can have totally different privileges based on a combination of group
memberships and OS privileges.

A normal user could e.g. have the SeTcbPrivilege which makes him as powerful
as SYSTEM...

So it is hard to compare two accounts...

-----
Dominick Baier (http://www.leastprivilege.com)

Show quoteHide quote
> I want to enumerate through the running processes on the system and
> determine if the process is running with a higher security token then
> the current user, that is, which are the more privileged processes
> then the executing one - how can accomplish this?
>
> TIA
>