Process permissions?

Hi,

Currently there is an application that is closing SysInternals Process Monitor whenever I run it. Steps:

1) I start procmon.exe
2) I start [anonymous] application and it closes procmon.exe

Is there something I can do in Vista to prevent a process (specifically Process Monitor) from being terminated by another application? Thanks.

Running Process Monitor as one administrator user and then running the other app as a different non-admin user should do the trick.

Quote:

---

Originally Posted by Tuttle

Running Process Monitor as one administrator user and then running the other app as a different non-admin user should do the trick.

---

Thanks for your response. How would I go about doing this?

Hi, I would try right clicking on procmon.exe and left click on run as administrator.

Quote:

---

Originally Posted by jenae

Hi, I would try right clicking on procmon.exe and left click on run as administrator.

---

I tried this, it still doesn't help. The account I use in Vista has administrator rights, perhaps it shouldn't? How can I instruct the application closing procmon.exe to run using a lower level of access rights?

Thanks.

::EDIT::
I tried using Process Explorer to modify the permissions on the process that is closing Process Monitor, however I'm not an expert at permissions in Windows. Of all the things I tried messing with, nothing seemed to make a difference. I even set "Deny" on the "Terminate" permission. Perhaps I'm just doing it wrong...

In any case, if I can use Process Explorer to restrict the permissions of the application closing Process Monitor, let me know.

Hi open task manager options and make sure always on top is checked now open process monitor, then look to processes in task manager you can right click process monitor and set priority to high, see if this helps.

Quote:

---

Originally Posted by jenae

Hi open task manager options and make sure always on top is checked now open process monitor, then look to processes in task manager you can right click process monitor and set priority to high, see if this helps.

---

That's thread priority I thought... it doesn't deal with permissions, it says how much processing time the operating system allocates to that process. Correct?

Hi, yes thats correct Vista will create an administrator account for the install and this is seperate to the real adminisrator in Vista in other words even though you are from the user accounts showing as administrator the UAC function will still need to be confirmed, when you right click on the program and select "run as administrator" then you have total control so as you said you tried this and it did not work then the problem is not permissions(admin has total control) , next to see if priority is being overidden do you know what process closes process monitor/ Task manager can help here.. I hope I understand what your problem is..

I set procmon.exe and procmon64.exe processes to use the 'High' priority, however this did not help. Priority determines how much processing priority the processes's main thread gets from the operating system, it has nothing to do with permissions.

Any other solutions I can try?

Hi, I would love to help, if you can start the program then it has nothing to do with permissions, a program will only start if a user has permissions and since you have started this program as "run as administrator" then that is the highest level Vista gives you. Maybe you have a corrupt install why not download again I have this on Vista ultimate and it runs fine.

I don't think you understand the problem. Let me elaborate:

I have 2 programs that I run. Program "A" and program "B". While both are running, program "B" is terminating program "A". I want to prevent program "B" from terminating program "A". How can I do this?

Sorry, got busy for a few days. I'm thinking actual Windows users -- create a new username to run one of the apps.

You could then either use Fast User Switching to run one of the apps (if there's no UI that you feel like interacting with), or use runas:

Code:

---

runas /u:"computername\username" "C:\path\to\app.exe"

---

A process running as User A can't do anything nasty to User B's processes unless User A is a local admin and the process is running elevated or you've disabled UAC. (That's not strictly true -- there are a few other permissions which would allow it -- but a regular user account won't have any of those either.)

So if I were to run process A using the 'guest' account, then process A couldn't close process B if B was started using my administrator account?

Right.

Doesn't work. Maybe it is specific to the application I'm running:

Code:

---

C:\>runas /u:"MDM\guest" "C:\Program Files (x86)\GPSoftware\Directory Opus\dopus.exe"
Enter the password for MDM\guest:
Attempting to start C:\Program Files (x86)\GPSoftware\Directory Opus\dopus.exe as user "MDM\guest" ...
RUNAS ERROR: Unable to run - C:\Program Files (x86)\GPSoftware\Directory Opus\dopus.exe
1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

---