Are any special security rights required to read performance data counters on Windows?

Question

I'm working on migrating a Windows application from always running as the SYSTEM account to running as a limited user account. One of the many things this application does is query Windows Performance Counters in order to log the overall system memory and CPU usage. MSDN's list of Privilege Constants is vague, but SE_PROF_SINGLE_PROCESS_NAME or SE_SYSTEM_PROFILE_NAME strike me as being potentially required for this sort of operation. However, MSDN's documentation of functions such as PdhOpenQuery, PdhAddCounter, and PdhCollectQueryData do not mention any required privileges.

Given this, does querying the Performance Data Counters require any privileges? Alternatively, what specifically do the SE_PROF_SINGLE_PROCESS_NAME or SE_SYSTEM_PROFILE_NAME privileges grant access to?

Answer 1

The required privileges are mentioned in the description "About Performance Counters" here:

Only the administrator of the computer or users in the Performance Logs User Group can log and view counter data. Users in the Administrator group can log and view counter data only if the tool they use to log and view counter data is started from a Command Prompt window that is opened with Run as administrator.... Users in the Performance Monitoring Users group can view counter data.

Windows XP: The Administrator or users in the Administrator group can log and view counter data without restriction.