Click here to Skip to main content
15,443,778 members
Articles / Programming Languages / C++
Posted 15 Apr 2007


13 bookmarked

List Processes Which Are Created By Specific Users

Rate me:
Please Sign up or sign in to vote.
4.08/5 (6 votes)
15 Apr 2007CPOL1 min read
When you want to list processes created by a specific user instead of those by SYSTEM, LOCAL SERVICE etc., you can use my code!


Sometimes, in the Task Manager, you may be interested only in viewing the processes which are created by a specific user instead of all the processes. When you open the Task Manager, it will normally list all the processes and the users who created them. The user names would include your user name, "SYSTEM", "LOCAL SERVICE" etc.

I created a function called GetProcessUserName which can retrieve the user name information of a process so that you can list all the processes created by a specific user.


I have a project which needs me to gather information about processes, like below:

8:07:05 am, April 06, 2007 : OUTLOOK.exe, <Firefox.exe>, cmd.exe, WINWORD.exe... 
8:07:10 am, April 06, 2007 : OUTLOOK.exe, Firefox.exe, <cmd.exe>, WINWORD.exe... 
8:07:15 am, April 06, 2007 : OUTLOOK.exe, Firefox.exe, <cmd.exe>, WINWORD.exe...

This list would show all the processes created by a user and the angle brackets would show the process which the user is focusing on.

Use the code

Followed is the main function which can retrieve the user information from a PID (Process ID). I used the Unicode version of all the functions. Therefore, remember to compile the program in UNICODE mode.

LPWSTR GetProcessUserName(DWORD dwPID)
 /*  Get The the username information form a Process.
  *  Parameters: dwPID , the Process's ID which you want to look for
  *  Return:  The username of the process
  *  Author: Vincent,Wei <a href=""""></a>
 HANDLE hProcessToken;
 HANDLE hProcess;
 //Open the Remote Process

  //Open The Process's Token which can be used 
  //to achieve more security information

   DWORD TokenInformationLength;
   DWORD ReturnLength;
   LPWSTR UserName=new WCHAR[255];   // Username declared in the Heap

   DWORD cchName;
   LPWSTR lpReferencedDomainName=new WCHAR[255];
   DWORD  cchReferencedDomainName;
   SID_NAME_USE peUse;
   //Get the User Information from the Token

   else // The structure is not large enough

    delete tuUser;
    tuUser=(PTOKEN_USER)(new BYTE[ReturnLength]);
    delete tuUser;
   delete lpReferencedDomainName;
   return UserName;    
 return NULL;


The second important procedure is to get the PID of the focused window.

We can use ToolHelp functions to get the process list. Then, we can check if the focused window's PID equals to the members in the list. If you don't know how to get the focused window's process ID, please read the following code:

HWND hwndFocusWindow;

//Get the Focus Window

// Get the PID from that window

Points of interest

I first looked in MSDN for an API which could realize this function, but failed. The key point is to get the information from the process. Fortunately, I found that the TokenInformation of a process can show us a lot about the process. You can search the function in MSDN so that many interesting ideas can be realized!


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Written By
Web Developer
China China
Vincent, Wei is the senior year student at Department of Computer Science, Fudan University. His interest includes programming in C++/C#/C and secure coding.

Comments and Discussions

Generalcan't get the process create by LOCAL SERVICE or NETWORK SERVICE Pin
Motorcure25-Aug-08 21:40
MemberMotorcure25-Aug-08 21:40 
GeneralAlso see WTSEnumerateProcesses Pin
Blake Miller17-Apr-07 7:47
MemberBlake Miller17-Apr-07 7:47 
GeneralRe: Also see WTSEnumerateProcesses Pin
Vincent, Wei17-Apr-07 15:06
MemberVincent, Wei17-Apr-07 15:06 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.