Menu
I have a program which adjusts SeDebugPrivilege and then starts to iterate through system processes and calls OpenProcess for them (and does other stuff, but it's not important now). Also the program runs in administrator mode of course. On Windows XP and Windows 7 it works fine, but on Windows 8.1 OpenProcess fails for the following system processes with ERROR_ACCESS_DENIED(5): smss.exe, csrss.exe, services.exe. As I know with SeDebugPrivilege I should be able to open these processes and retrieve a handle for them. Does anybody have a clue, what kind of magic causes this error only on Windows 8.1?
(Anyway I have the same error with the same processes for CreateToolhelp32Snapshot)
342
Right-click the file or folder, and then click Properties. Click the Security tab. Under Group or user names, click your name to see the permissions that you have. Click Edit, click your name, select the check boxes for the permissions that you must have, and then click OK.
Folder Access Denied as AdminIdentify the folder and right-click on it. From the menu, tap “Properties” to open a new screen. Navigate to “Security,” then select the admin account. Check the “Permissions” section to ensure that all permissions have been granted.
Go to the Start menu by clicking on the icon at the bottom-left corner of your screen. Type in “cmd” at the Search bar. Once the cmd option pops up, right-click on it then select Run as administrator. On the Command Prompt, type in “net user administrator /active: yes” then press Enter on your keyboard.
Windows 8.1 introduces the concept of a system protected process. This is documented in the context of third-party anti-malware software, but it seems reasonable to suppose that it is also used to protect particularly critical system processes.
System protected processes are an extension of the Protected Process mechanism (Microsoft Word document) introduced in Windows Vista as a DRM measure.
You cannot obtain any of these access rights for a protected process, even with debug privilege:
DELETEREAD_CONTROLWRITE_DACWRITE_OWNERPROCESS_CREATE_THREADPROCESS_DUP_HANDLEPROCESS_QUERY_INFORMATIONPROCESS_SET_QUOTAPROCESS_SET_INFORMATIONPROCESS_VM_OPERATIONPROCESS_VM_READPROCESS_VM_WRITEYou should still be able to open the process by requesting PROCESS_QUERY_LIMITED_INFORMATION access. According to the documentation, SYNCHRONIZE and PROCESS_TERMINATE access are also permitted.
64
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
