locked
Getting Windows Process Owner's Name RRS feed

  • Question

  • Dears,

    I have a service installed on some servers that need to consult the class Win32_Process WMI to collect information on all processes running at that time. Ideally the user that will run this service must have a minimum of permissions possible.

    The problem is that I do not find the permission / role / policy that I should give to this user so that it can obtain the owner's name that is running each process, that is, calling the method GetOwner() in class Win32_Process, it does not return an empty string in "owner" and "domain" fields.

    We have already run this service as an administrator and the owner's name returned well, but even after including our user on Administrators group this still can't get the name of the owner of the process run by an administrator user.

    We have made the following attempts:
    * Change permissions of the user (adding in Administrators group);
    * Assign specific policies: "Act the part of the operating system", "Profile single process" and "Profile system performance";
    * Change permissions on WMI Security (in 'Computer Management \ Services and Applications \ WMI Control ") for Class cimv2.

    Finally the only way to resolve the problem was running the service as "Local System", everything worked well, except we think it is not appropriate because our service also connects to a SQL Server database to obtain indicators.

    To test we also used the "Task Manager" and "WMI Code Creator to see if this user test has sufficient permissions to get the owner's name of the process.

    Thank you for your help,
    Nuno Costa
    PORTUGAL
    Friday, January 9, 2009 6:16 PM

Answers