.NET - get processes running on a machine in another domain

Question

I am looking for a way, from .NET code, to get the list of running processes on a remote machine, which is on a different domain.

I have the username and password for the machine. However, the System.Diagnostics.Process.GetProcesses() function only has two overrides. One of them accepts a remote machine's name, but no way to send the username and password to that machine. In order for the punciton to work, it would have to be a machine on your domain that you already have access to.

I'm not 100% sure if this can be done, but I suspect it could be done via Interop and WMI.

If it matters, the .NET app is running on a Windows 7 monitoring machine that needs to connect to a Windows XP machine out in one of our retail locations.

I have tried searching for previous questions and tried Google before posting this question. If there is a duplicate question out there, please let me know and I'll delete this question.

David · Accepted Answer · 2011-10-11T13:35:10.077

I hate answering my own questions, but for the next person to face this challenge, I did find an easier way to do this via the System.Management objects.

There's a full working application with source code at codeproject.com.

http://www.codeproject.com/KB/cs/Remote_process_controller.aspx

I modified it quite a bit for my specfic purpose, and got the smallest possible funciton to do this. I'm sharing it for the next person to come along.

Note, that you will need to add a reference to System.Management to your project.

    private bool CheckForExpectedProcess(string userName, string password, string machineName, string logonDomain, string PartialProcessname)
    {
        bool ReturnValue = false;
        System.Management.ManagementScope managementScope;
        try
        {
            System.Management.ConnectionOptions connOptions = new System.Management.ConnectionOptions();

            connOptions.Impersonation = System.Management.ImpersonationLevel.Impersonate;
            connOptions.EnablePrivileges = true;
            connOptions.Username = logonDomain + "\\" + userName;
            connOptions.Password = password;
            managementScope = new System.Management.ManagementScope(@"\\" + machineName + @"\ROOT\CIMV2", connOptions);

            managementScope.Connect();
            System.Management.ManagementObjectSearcher objSearcher = new System.Management.ManagementObjectSearcher("SELECT Name FROM Win32_Process WHERE NAME LIKE'%" + PartialProcessname + "%'");
            System.Management.ManagementOperationObserver opsObserver = new System.Management.ManagementOperationObserver();
            objSearcher.Scope = managementScope;
            string[] sep = { "\n", "\t" };

            System.Management.ManagementObjectCollection  objects = objSearcher.Get();
            ReturnValue = objects.Count > 0;

        }
        catch (Exception ex)
        {
           // handle error - we log it to our own system, but it's up to you.
        }

        return ReturnValue;
    }

score 2 · Answer 2 · edited May 23 '17 at 11:55

2

What you are looking for is implementing an equivalent to runas /networkonly where the process identity on the local machine is unchanged, while any outbound network access is done using specified credentials.

According to an SO post How to build RUNAS /NETONLY functionality into a (C#/.NET/WinForms) program? you need to use CreateProcessWithLogonW with LOGON_NETCREDENTIALS_ONLY.

edited May 23 '17 at 11:55

Community

1
1

answered Oct 10 '11 at 16:02

Anders Abel

67,989
17
150
217

that other answer does look very promising. Thank you! I'm going to try that now. – David Oct 10 '11 at 16:07
I abandoned trying to do it this way because I was sure there had to be an easier way, and I found it. I've voted you up, but I found a better answer and sample project code at CodeProject.com. Thank you for your time, however! I used the term "CreateProcessWithLogonW" to lead me to many other posts, and some of them mentioned WMI as an alternative, so you did help me indirectly. Thank you again for your time! – David Oct 10 '11 at 17:05

score 1 · Answer 3 · answered Apr 25 '13 at 15:37

1

You could try this tool , which exactly fulfills your requirement. You could monitor remote computers from any domain. This tool allows to monitor the remote machine processes, installed software, devices, services, sessions, etc...

answered Apr 25 '13 at 15:37

James

21
1

I think he wants an API rather than a tool. – Allon Guralnek Apr 25 '13 at 16:18

.NET - get processes running on a machine in another domain

3 Answers3