Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which requires elevation, which does indeed show all processes.

Why though can I see processes from other users (Including other standard users or Administrator user) without needing to elevate?

share|improve this question
1  
You should only be able to see the process names and PID's, not the users who are actually running them. Can you verify you are seeing other users' names? – SteveS Jun 8 '11 at 15:30
Yes, I can see usernames. – Sonny Ordell Jun 8 '11 at 23:10

1 Answer

up vote 4 down vote accepted

In terms of Windows system calls, getting process information can be done via NtQuerySystemInformation() with SYSTEM_PROCESS_INFORMATION as a parameter.

However, the true clue to this behaviour lies with GetProcessMemoryInfo() which mentions a permission called PROCESS_QUERY_LIMITED_INFORMATION discussed in Process Security and Access Rights. Specifically:

[With Windows Vista] The PROCESS_QUERY_LIMITED_INFORMATION right was introduced to provide access to a subset of the information available through PROCESS_QUERY_INFORMATION.

This exists because (if you keep reading that page) PROCESS_QUERY_INFORMATION is denied on some processes in Vista, particularly those with DRM. So in order to provide you with some information about the process you're running, you get this cut down version.

I'm not at a Windows box to verify this yet, but I believe that all users have at least PROCESS_QUERY_LIMITED_INFORMATION on any given processes so you are able to query limited information even on processes that do not belong to you. Their existence is one such property, although as SteveS notes in the comments, the detail is limited.

share|improve this answer
why would MS design TM this way? Why can I still see usernames without elevating? – Sonny Ordell Jun 12 '11 at 15:01
@Sonny I guess because they wanted you to be able to identify which are NT AUTHORITY\SYSTEM processes and which are your processes. I'm not entirely sure as to the exact reason, but it's clear they felt that ought to be part of the limited information available to every user. – Antony Vennard Jun 12 '11 at 15:24
but it isn't just SYSTEM processes, but processes from other users I can see, with detail... – Sonny Ordell Jun 12 '11 at 17:28
a good example may be starting cmd as administrator, and it is then visible in the process list to a standard user, with all information. Why? – Sonny Ordell Jun 15 '11 at 4:03
1  
@Sonny if it is the same user (i.e. one is at an elevated level, one at a standard level), then I suspect you have permissions to read information about the full process. However, you won't be able to debug it or otherwise alter it as a standard user I don't think. – Antony Vennard Jun 15 '11 at 8:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.