2 ms·
This looks interesting, but does it capture the user that performed the a action? I've have a look, and I can't see anything about usernames.
by GordonS 6y ago
This looks interesting, but does it capture the user that performed the a action? I've have a look, and I can't see anything about usernames.
- m1el 6y agoYou can look at process SID (security identifier), which should give you info about the user.
- GordonS 6y agoWon't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
- GordonS 6y agoAnother one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?