Getting the current logged in user (FullToken Context)

Question

I have a Problem, which is... i start a programm with right click -> run as administrator. Which means the programm is running in an administrative context.

WindowsIdentity.GetCurrent().Name;

if i try to get the user name that way i will get the user that started the programm as admin.. for example "administrator", but what i need is the name of the current logged in user which is for example: bob

Can anybody help me out? :)

score 5 · Answer 1 · answered Dec 20 '10 at 16:59

You could try using WMI (System.Management.dll) to get the owner of the explorer.exe process.

string GetExplorerUser()
{
    var query = new ObjectQuery(
        "SELECT * FROM Win32_Process WHERE Name = 'explorer.exe'");

    var explorerProcesses = new ManagementObjectSearcher(query).Get();

    foreach (ManagementObject mo in explorerProcesses)
    {
        string[] ownerInfo = new string[2];
        mo.InvokeMethod("GetOwner", (object[])ownerInfo);

        return String.Concat(ownerInfo[1], @"\", ownerInfo[0]);
    }

    return string.Empty;
}

This relies on the fact that the explorer process is single instance an so you don't end up with the possibility of having several explorer processes running with different user credentials.

what about terminal services where each session could have it's own explorer.exe process ? — Sébastien Nussbaumer, Mar 26 '12 at 13:56

score 0 · Answer 2 · edited May 23 '17 at 12:14

1) Cassia should be able to give you a list of currently logged in users including RDC.

foreach (ITerminalServicesSession sess in new TerminalServicesManager().GetSessions())
{
    // sess.SessionId
    // sess.UserName
}

2) WMI (SO answer)

Select * from Win32_LogonSession

3) PInvoke to WTSEnumerateSessions

4) Enumerate all instances of "explorer.exe" and get the owner using PInvoke (OpenProcessHandle).

Process[] processes = Process.GetProcessesByName("explorer");

This is a bit hacky. WMI can also be used for this.

It might be a good idea to set winmgmt as a dependency for your service if you decided to go with solution that uses WMI.

score 0 · Answer 3 · edited May 23 '17 at 12:29

0

You will probably need to use win32 API for that. Read about Window Station and Desktop functions here: http://msdn.microsoft.com/en-us/library/ms687107%28v=vs.85%29.aspx

Also see this question: Get the logged in Windows user name associated with a desktop

edited May 23 '17 at 12:29

Community

1
1

answered Dec 20 '10 at 16:12

MK.

33,605
18
74
111

score 0 · Answer 4 · edited May 23 '17 at 12:03

0

Maybe you could start as normal user, save user name, then programmatically request elevation :

Windows 7 and Vista UAC - Programmatically requesting elevation in C#

edited May 23 '17 at 12:03

Community

1
1

answered Dec 20 '10 at 16:14

Run CMD

2,937
3
36
61

I know this would be possible via impersonation. So there is no other way? – Lars Dec 20 '10 at 16:17
I don't know of any other method .. This is a common problem during installation too, because you need Admin access to write files, yet you need user access for getting correct user paths (/docs and settings/Username/etc) ... ?!? .. it's not a bug, it's a feature ... – Run CMD Dec 20 '10 at 16:33
:) no i want to unload all registries i loaded but not the registry of the local users which i use as a kind of reference. so i need to find out which one this is. – Lars Dec 20 '10 at 16:38

score 0 · Answer 5 · answered Dec 20 '10 at 16:46

0

All .NET libraries will give you the user from the current context ('Administrator' in your case).

If you are trying to secure your code, you might consider reading about: Security in the .NET framework

answered Dec 20 '10 at 16:46

tivo

146
2
3
15

Getting the current logged in user (FullToken Context)

5 Answers5