3 ms·
You can look at process SID (security identifier), which should give you info about the user.
by m1el 6y ago
You can look at process SID (security identifier), which should give you info about the user.
- GordonS 6y agoWon't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
- GordonS 6y agoAnother one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?