4 ms·
Won't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
by GordonS 6y ago
Won't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
- GordonS 6y agoAnother one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?