On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which requires elevation, which does indeed show all processes.

Why though can I see processes from other users (Including other standard users or Administrator user) without needing to elevate?

  • 1
    You should only be able to see the process names and PID's, not the users who are actually running them. Can you verify you are seeing other users' names?
    – Steve
    Commented Jun 8, 2011 at 15:30
  • Yes, I can see usernames. Commented Jun 8, 2011 at 23:10

1 Answer 1


In terms of Windows system calls, getting process information can be done via NtQuerySystemInformation() with SYSTEM_PROCESS_INFORMATION as a parameter.

However, the true clue to this behaviour lies with GetProcessMemoryInfo() which mentions a permission called PROCESS_QUERY_LIMITED_INFORMATION discussed in Process Security and Access Rights. Specifically:

[With Windows Vista] The PROCESS_QUERY_LIMITED_INFORMATION right was introduced to provide access to a subset of the information available through PROCESS_QUERY_INFORMATION.

This exists because (if you keep reading that page) PROCESS_QUERY_INFORMATION is denied on some processes in Vista, particularly those with DRM. So in order to provide you with some information about the process you're running, you get this cut down version.

I'm not at a Windows box to verify this yet, but I believe that all users have at least PROCESS_QUERY_LIMITED_INFORMATION on any given processes so you are able to query limited information even on processes that do not belong to you. Their existence is one such property, although as SteveS notes in the comments, the detail is limited.

  • why would MS design TM this way? Why can I still see usernames without elevating? Commented Jun 12, 2011 at 15:01
  • @Sonny I guess because they wanted you to be able to identify which are NT AUTHORITY\SYSTEM processes and which are your processes. I'm not entirely sure as to the exact reason, but it's clear they felt that ought to be part of the limited information available to every user.
    – user2213
    Commented Jun 12, 2011 at 15:24
  • but it isn't just SYSTEM processes, but processes from other users I can see, with detail... Commented Jun 12, 2011 at 17:28
  • a good example may be starting cmd as administrator, and it is then visible in the process list to a standard user, with all information. Why? Commented Jun 15, 2011 at 4:03
  • 1
    @Sonny if it is the same user (i.e. one is at an elevated level, one at a standard level), then I suspect you have permissions to read information about the full process. However, you won't be able to debug it or otherwise alter it as a standard user I don't think.
    – user2213
    Commented Jun 15, 2011 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .