I've a custom Windows service (written in C#) which basically I'm using for whitelisting or blacklisting Windows applications. I don't want to use any existing Windows functionality or any commercial solution. I want to check if a standard user is trying to launch a Windows application with the Run as Administrator option from the context menu.
For monitoring a launched application, I'm using ManagementEventWatcher() which is subscribing to __InstanceCreationEvent:
public class ProcessLaunchMonitorService : ServiceBase
{
public ProcessLaunchMonitorService()
{
this.ServiceName = "testservice";
}
protected override void OnStart(string[] args)
{
string query = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'";
// Setup the watcher
_watcher = new ManagementEventWatcher(query);
_watcher.EventArrived += new EventArrivedEventHandler(OnProcessStarted);
_watcher.Start();
}
private void OnProcessStarted(object sender, EventArrivedEventArgs e)
{
// Get the process name
var process = (ManagementBaseObject)e.NewEvent["TargetInstance"];
string processName = process["Name"].ToString();
int processId = Convert.ToInt32(process["ProcessId"]);
var launchedProcess = Process.GetProcessById(processId);
// want to check if this launchedProcess was launched with Run as Administrator option
}
}
Current result:
This code is fully executable without any error. This code is actually missing the part for detecting if the user used the Run as Administrator option while launching the application.
Expected result:
How can I check if the user used the Run as Administrator option while launching the application (launchedProcess)?
发布者：admin，转转请注明出处：http://www.yc00.com/questions/1745303206a4621562.html
评论列表（0条）