User Invoked Process and System Invoked Process

checkingrandom 206

During our machine Run we can find some process get started by the system in Task Manager.

For example, Sometimes automatically Microsoft Edge gets started in the background and we can see in Task Manager.

So is there any Windows API to find whether a process is started by User or by system....?
I mean windows API to differentiate Foreground windows and background windows

Roy Li - MSFT 32,091 Reputation points Microsoft Vendor

2022-04-29T09:28:59.577+00:00

Please do not ask the same question more than once on Microsoft Q&A. I've redirected other two similar questions to this one. @Xiaopo Yang - MSFT Has already answered your newest question about how to get the owner of a process on this question. Also, please take a look at How to write a quality question to make sure that you are asking a good question.

Accepted answer

Xiaopo Yang - MSFT 11,501 Reputation points Microsoft Vendor

2022-04-28T07:12:41.11+00:00

According the document sample Finding the Owner of a File Object in C++, You can use GetSecurityInfo and and LookupAccountSid function to retrieve the process owner.
Or you can determine the SID type like the answer.
Please sign in to rate this answer.

1 person found this answer helpful.
checkingrandom 206 Reputation points

2022-05-02T05:39:19.777+00:00

Thanks @Xiaopo Yang - MSFT this one worked well for me.

checkingrandom 206 Reputation points

2022-05-05T06:16:32.153+00:00

Hi, I tried the code you referred "Finding the Owner of a File Object in C++", But I'm getting ERROR 122 for the first LookupAccountSidA in the code. I trying to get the solution for this . do you have any idea of solving this

Xiaopo Yang - MSFT 11,501 Reputation points Microsoft Vendor

2022-05-05T06:40:46.2+00:00

ERROR 122 is The data area passed to a system call is too small.
According to LookupAccountSid,

If the function fails because the buffer is too small or if cchReferencedDomainName is zero, cchReferencedDomainName receives the required buffer size, including the terminating null character.

checkingrandom 206 Reputation points

2022-05-05T06:58:38.63+00:00

Oh do you mean that it will fail for the first call but it receives the required buffer sizes during that call ?

Xiaopo Yang - MSFT 11,501 Reputation points Microsoft Vendor

2022-05-05T07:02:39.427+00:00

yes .
Sign in to comment

1 additional answer

Castorix31 81,831 Reputation points

2022-04-28T06:34:15.813+00:00

I mean windows API to differentiate Foreground windows and background windows

A Background process in Task Manager is just a process without visible window
(you can see How does Task Manager categorize processes as App, Background Process, or Windows Process?)
Please sign in to rate this answer.

1 person found this answer helpful.
checkingrandom 206 Reputation points

2022-04-28T06:41:52.133+00:00

Thank you for the answer, It helps me a lot but I got another, can we able to find from PID that the process have a visible window ?

My task is I'm developing a small application and I need to find the Process Triggered by User and Process Triggered by System. and I only need the names of the Process that is Invoked by User(i.e The names of the process when the user clicks and open the windows app manually).

Castorix31 81,831 Reputation points

2022-04-28T07:36:18.61+00:00

can we able to find from PID that the process have a visible window ?

With EnumWindows and GetWindowThreadProcessId in the EnumProc
Sign in to comment