Windows sysinternals

More documents

Recommendations

Info

Chapter 3 Process Explorer 83 FIGURE 3-30 The TCP/IP tab on Windows XP and the Thread Stack dialog box. Security Tab The process token defines the security context for the process: the user principal the process is running as, the groups that the user is a member of, and systemwide privileges that the account has. The Security tab (shown in Figure 3-31) displays these details, as well as whether User Account Control file and registry virtualization is enabled for the process, and the ID of the terminal services session in which the process is running. Selecting a group in the Group list displays its Security Identifier (SID) below the list box. FIGURE 3-31 The Security tab of the process’ Properties dialog box. www.it-ebooks.info
84 Part II Usage Guide In most circumstances, particularly with desktop applications, access checks are performed with the process token, or in some cases with a thread token derived from the process token and that can never have more rights than the process token. The information on the Security tab can help explain the success or failure of operations. Services and server applications can impersonate the security context of a different user when performing actions on behalf of that user. Impersonation is implemented by associating a copy of the other user’s token with a thread within the process. During impersonation, access checks are performed with the thread token, so in these cases the process token might not be applicable. The dialog box does not show thread tokens. I won’t go into a detailed description of token contents here, but I would like to point out a few helpful tips and clear up some common misunderstandings: ■ In practice, a group that has the Deny flag set can be considered effectively equivalent to not being present in the token at all. With User Account Control, powerful groups such as Administrators are marked Deny-Only except in elevated processes. The Deny flag indicates that if an object has an access-allowed access control entry (ACE) for Administrators in its permissions, that entry is ignored, but if it has an access-denied ACE for Administrators (not common), the access is denied. ■ A privilege that is marked Disabled is not at all the same as the privilege not being present. If a privilege is in the token, the program can enable the privilege and then use it. If the privilege is not present, the process cannot acquire it. It’s also important to note that several privileges are considered administrator-equivalent in Windows Vista and newer. Windows never allows these privileges to appear in a standard user token. ■ If a domain-joined computer cannot contact a domain controller and has not cached the results of previous SID-to-name lookups, it cannot translate the SIDs for token groups into the group names. In this case, Procexp will display the SIDs. ■ The group called Logon SID is based on a random number generated at the time the user logged on. One of its uses is to grant access to terminal server session-specific resources. Logon SIDs always begin with S-1-5-5-. The Permissions button displays the security descriptor for the process object itself—that is, who can perform which actions on the process. Environment Tab The Environment tab lists the process’ environment variables and their corresponding values. Processes usually inherit their environment variables from their parent process, and very often, the environment blocks of all processes will be substantially equivalent. However, there can be exceptions: www.it-ebooks.info
Page 1 and 2:
www.it-ebooks.info
Page 3 and 4:
PUBLISHED BY Microsoft Press A Divi
Page 5 and 6:
www.it-ebooks.info
Page 7 and 8:
www.it-ebooks.info
Page 9 and 10:
viii Table of Contents 2 Windows Co
Page 11 and 12:
x Table of Contents Process Tree .
Page 13 and 14:
xii Table of Contents PsLogList. .
Page 15 and 16:
xiv Table of Contents Object Type .
Page 17 and 18:
xvi Table of Contents 14 System Inf
Page 19 and 20:
www.it-ebooks.info
Page 21 and 22:
www.it-ebooks.info
Page 23 and 24:
xxii Introduction layout, I set out
Page 25 and 26:
xxiv Introduction Microsoft had bee
Page 27 and 28:
xxvi Introduction Part III, “Trou
Page 29 and 30:
xxviii Introduction Errata & Book S
Page 31 and 32:
www.it-ebooks.info
Page 33 and 34:
4 Part I Getting Started Table 1-1
Page 35 and 36:
6 Part I Getting Started Utility LD
Page 37 and 38:
8 Part I Getting Started FIGURE 1-2
Page 39 and 40:
10 Part I Getting Started Running t
Page 41 and 42:
12 Part I Getting Started FIGURE 1-
Page 43 and 44:
14 Part I Getting Started Because t
Page 45 and 46:
16 Part I Getting Started unrestric
Page 47 and 48:
18 Part I Getting Started For more
Page 49 and 50:
20 Part I Getting Started FIGURE 2-
Page 51 and 52:
22 Part I Getting Started ■ The c
Page 53 and 54:
24 Part I Getting Started “System
Page 55 and 56:
26 Part I Getting Started is not av
Page 57 and 58:
28 Part I Getting Started symbolic
Page 59 and 60:
30 Part I Getting Started The debug
Page 61 and 62: 32 Part I Getting Started Terminal
Page 63 and 64: 34 Part I Getting Started access on
Page 65 and 66: 36 Part I Getting Started With UIPI
Page 67 and 68: www.it-ebooks.info
Page 69 and 70: 40 Part II Usage Guide ■ Tooltips
Page 71 and 72: 42 Part II Usage Guide Procexp repr
Page 73 and 74: 44 Part II Usage Guide is simply th
Page 75 and 76: 46 Part II Usage Guide Updating the
Page 77 and 78: 48 Part II Usage Guide Tooltips Hov
Page 79 and 80: 50 Part II Usage Guide On Windows V
Page 81 and 82: 52 Part II Usage Guide FIGURE 3-6 D
Page 83 and 84: 54 Part II Usage Guide FIGURE 3-7 T
Page 85 and 86: 56 Part II Usage Guide Process Perf
Page 87 and 88: 58 Part II Usage Guide FIGURE 3-9 T
Page 89 and 90: 60 Part II Usage Guide FIGURE 3-10
Page 91 and 92: 62 Part II Usage Guide By default,
Page 95 and 96: 66 Part II Usage Guide You can disp
Page 101 and 102: 72 Part II Usage Guide Peering Deep
Page 105 and 106: 76 Part II Usage Guide ■ Access M
Page 107 and 108: 78 Part II Usage Guide The Properti
Page 111: 82 Part II Usage Guide TCP/IP Tab A
Page 115 and 116: 86 Part II Usage Guide Click the Sa
Page 121 and 122: 92 Part II Usage Guide Some reasons
Page 123 and 124: 94 Part II Usage Guide available to
Page 125 and 126: 96 Part II Usage Guide running on t
Page 127 and 128: 98 Part II Usage Guide Command-Line
Page 129 and 130: www.it-ebooks.info
Page 131 and 132: 102 Part II Usage Guide Because mil
Page 133 and 134: 104 Part II Usage Guide Events Tabl
Page 135 and 136: 106 Part II Usage Guide As an NTSTA
Page 137 and 138: 108 Part II Usage Guide Application
Page 139 and 140: 110 Part II Usage Guide File Attrib
Page 141 and 142: 112 Part II Usage Guide ■ When th
Page 143 and 144: 114 Part II Usage Guide Displaying
Page 145 and 146: 116 Part II Usage Guide invoked by
Page 147 and 148: 118 Part II Usage Guide without per
Page 149 and 150: 120 Part II Usage Guide Configuring
Page 153 and 154: 124 Part II Usage Guide Saving Proc
Page 155 and 156: 126 Part II Usage Guide If Procmon
Page 157 and 158: 128 Part II Usage Guide When lookin
Page 159 and 160: 130 Part II Usage Guide History Dep
Page 161 and 162: 132 Part II Usage Guide Automating
Page 163 and 164:
134 Part II Usage Guide ■ Line 4
Page 165 and 166:
136 Part II Usage Guide File Summar
Page 167 and 168:
138 Part II Usage Guide FIGURE 4-28
Page 169 and 170:
140 Part II Usage Guide Cross Refer
Page 171 and 172:
142 Part II Usage Guide BOOL WriteP
Page 173 and 174:
www.it-ebooks.info
Page 175 and 176:
Page 177 and 178:
148 Part II Usage Guide Disabling o
Page 179 and 180:
150 Part II Usage Guide Files for w
Page 181 and 182:
152 Part II Usage Guide Viewing ASE
Page 183 and 184:
154 Part II Usage Guide Per-User AS
Page 185 and 186:
156 Part II Usage Guide Per-User AS
Page 187 and 188:
158 Part II Usage Guide Per-User an
Page 189 and 190:
160 Part II Usage Guide Codecs The
Page 191 and 192:
162 Part II Usage Guide Command Pro
Page 193 and 194:
164 Part II Usage Guide Winsock Pro
Page 195 and 196:
166 Part II Usage Guide Saving and
Page 197 and 198:
168 Part II Usage Guide The CSV for
Page 199 and 200:
170 Part II Usage Guide ■ A defau
Page 201 and 202:
172 Part II Usage Guide Incidentall
Page 203 and 204:
174 Part II Usage Guide Alternate C
Page 205 and 206:
176 Part II Usage Guide What this m
Page 207 and 208:
178 Part II Usage Guide Redirected
Page 209 and 210:
180 Part II Usage Guide PsExec Comm
Page 211 and 212:
182 Part II Usage Guide The -s opti
Page 213 and 214:
184 Part II Usage Guide Note The re
Page 215 and 216:
186 Part II Usage Guide Use of full
Page 217 and 218:
188 Part II Usage Guide In the prec
Page 219 and 220:
190 Part II Usage Guide Note PsList
Page 221 and 222:
192 Part II Usage Guide on the netw
Page 223 and 224:
194 Part II Usage Guide By default,
Page 225 and 226:
196 Part II Usage Guide the event l
Page 227 and 228:
198 Part II Usage Guide example, al
Page 229 and 230:
200 Part II Usage Guide The config
Page 231 and 232:
202 Part II Usage Guide Find One of
Page 233 and 234:
204 Part II Usage Guide Option Disp
Page 235 and 236:
206 Part II Usage Guide To suspend
Page 237 and 238:
208 Part II Usage Guide depend serv
Page 239 and 240:
www.it-ebooks.info
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
216 Part II Usage Guide Allocations
Page 247 and 248:
218 Part II Usage Guide ■ Shared
Page 249 and 250:
220 Part II Usage Guide When you co
Page 251 and 252:
222 Part II Usage Guide ■ The mem
Page 253 and 254:
Page 255 and 256:
226 Part II Usage Guide ■ .TXT Th
Page 257 and 258:
228 Part II Usage Guide Command-Lin
Page 259 and 260:
230 Part II Usage Guide To avoid an
Page 261 and 262:
232 Part II Usage Guide You can use
Page 263 and 264:
234 Part II Usage Guide and results
Page 265 and 266:
236 Part II Usage Guide Capturing A
Page 267 and 268:
238 Part II Usage Guide static meth
Page 269 and 270:
240 Part II Usage Guide You can ann
Page 271 and 272:
242 Part II Usage Guide the crash d
Page 273 and 274:
244 Part II Usage Guide Highlightin
Page 275 and 276:
246 Part II Usage Guide ■ Limit L
Page 277 and 278:
248 Part II Usage Guide To view deb
Page 279 and 280:
250 Part II Usage Guide LiveKd Requ
Page 281 and 282:
252 Part II Usage Guide This comman
Page 283 and 284:
254 Part II Usage Guide ListDLLs re
Page 285 and 286:
256 Part II Usage Guide Handle Hand
Page 287 and 288:
Page 289 and 290:
260 Part II Usage Guide Timer : 7 T
Page 291 and 292:
Page 293 and 294:
264 Part II Usage Guide ■ Signing
Page 295 and 296:
266 Part II Usage Guide displays ha
Page 297 and 298:
268 Part II Usage Guide Note that t
Page 299 and 300:
270 Part II Usage Guide Object Type
Page 301 and 302:
272 Part II Usage Guide Although th
Page 303 and 304:
274 Part II Usage Guide effective p
Page 305 and 306:
276 Part II Usage Guide is explicit
Page 307 and 308:
278 Part II Usage Guide Click on a
Page 309 and 310:
280 Part II Usage Guide ShellRunAs
Page 311 and 312:
282 Part II Usage Guide [1] Logon s
Page 313 and 314:
284 Part II Usage Guide The only wa
Page 315 and 316:
286 Part II Usage Guide The second
Page 317 and 318:
Page 319 and 320:
290 Part II Usage Guide Objects You
Page 321 and 322:
Page 323 and 324:
294 Part II Usage Guide The current
Page 325 and 326:
296 Part II Usage Guide You can scr
Page 327 and 328:
Page 329 and 330:
300 Part II Usage Guide To view inf
Page 331 and 332:
302 Part II Usage Guide AdInsight m
Page 333 and 334:
304 Part II Usage Guide To configur
Page 335 and 336:
306 Part II Usage Guide AdInsight c
Page 337 and 338:
www.it-ebooks.info
Page 339 and 340:
310 Part II Usage Guide When you st
Page 341 and 342:
312 Part II Usage Guide In addition
Page 343 and 344:
314 Part II Usage Guide selected, B
Page 345 and 346:
316 Part II Usage Guide the data it
Page 347 and 348:
Page 349 and 350:
320 Part II Usage Guide provide a w
Page 351 and 352:
322 Part II Usage Guide Drawing Mod
Page 353 and 354:
324 Part II Usage Guide LiveZoom Wh
Page 355 and 356:
326 Part II Usage Guide The followi
Page 357 and 358:
Page 359 and 360:
330 Part II Usage Guide into subdir
Page 361 and 362:
332 Part II Usage Guide By default,
Page 363 and 364:
334 Part II Usage Guide This sample
Page 365 and 366:
Page 367 and 368:
338 Part II Usage Guide disk), Disk
Page 369 and 370:
340 Part II Usage Guide Volume Perm
Page 371 and 372:
Page 373 and 374:
344 Part II Usage Guide ■ One lin
Page 375 and 376:
Page 377 and 378:
348 Part II Usage Guide sizing, and
Page 379 and 380:
350 Part II Usage Guide VolumeID Wh
Page 381 and 382:
352 Part II Usage Guide executables
Page 383 and 384:
354 Part II Usage Guide ■ System
Page 385 and 386:
356 Part II Usage Guide ■ Process
Page 387 and 388:
Page 389 and 390:
360 Part II Usage Guide costs on NU
Page 391 and 392:
Page 393 and 394:
Page 395 and 396:
Page 397 and 398:
www.it-ebooks.info
Page 399 and 400:
370 Part II Usage Guide and endpoin
Page 401 and 402:
Page 403 and 404:
Page 405 and 406:
376 Part II Usage Guide adjacent if
Page 407 and 408:
378 Part II Usage Guide Hex2Dec If
Page 409 and 410:
380 Part II Usage Guide his audienc
Page 411 and 412:
www.it-ebooks.info
Page 413 and 414:
384 Part III Troubleshooting—”T
Page 415 and 416:
Page 417 and 418:
Page 419 and 420:
Page 421 and 422:
Page 423 and 424:
Page 425 and 426:
Page 427 and 428:
Page 429 and 430:
Page 431 and 432:
Page 433 and 434:
Page 435 and 436:
Page 437 and 438:
Page 439 and 440:
Page 441 and 442:
Page 443 and 444:
Page 445 and 446:
Page 447 and 448:
Page 449 and 450:
Page 451 and 452:
Page 453 and 454:
Page 455 and 456:
Page 457 and 458:
Page 459 and 460:
Page 461 and 462:
Page 463 and 464:
Page 465 and 466:
Page 467 and 468:
438 AdInsight AdInsight (continued)
Page 469 and 470:
440 BgInfo BgInfo (continued) Rich
Page 471 and 472:
442 DebugView DebugView (continued)
Page 473 and 474:
444 events events (continued) filte
Page 475 and 476:
446 HKLM\System\CurrentControlSet\C
Page 477 and 478:
448 malware malware (continued) Aut
Page 479 and 480:
450 paging files, defragmenting pag
Page 481 and 482:
452 Process Monitor (Procmon) Proce
Page 483 and 484:
454 PsShutdown PsShutdown (continue
Page 485 and 486:
456 Security Reference Monitor Secu
Page 487 and 488:
458 Sysinternals utilities Sysinter
Page 489 and 490:
460 unhandled exceptions, process d
Page 491 and 492:
462 Windows 7 Windows 7 (continued)
Page 493 and 494:
www.it-ebooks.info
Page 495 and 496:
www.it-ebooks.info
Page 497:
What do you think of this book? We
show all

Windows sysinternals

Create successful ePaper yourself

Delete template?

Save as template?