Process.StartTime Access Denied

Question

My code needs to determine how long a particular process has been running. But it continues to fail with an access denied error message on the Process.StartTime request. This is a process running with a User's credentials (ie, not a high-privilege process). There's clearly a security setting or a policy setting, or something that I need to twiddle with to fix this, as I can't believe the StartTime property is in the Framework just so that it can fail 100% of the time.

A Google search indicated that I could resolve this by adding the user whose credentials the querying code is running under to the "Performance Log Users" group. However, no such user group exists on this machine.

Answer 1

The underlying code needs to be able to call OpenProcess, for which you may require SeDebugPrivilege.

Is the process you're doing the StartTime request on running as a different user to your own process?

Answer 2

@Will: The process that's attempting to query StartTime is an ASP.NET process, impersonating the same user that's running the target process.

Edit: Sorry Will, no dice. Granting "Everyone" SeDebugPrivilege didn't even do it.

Answer 3

OK, sorry that didn't work... I am no expert on ASP.NET impersonation, I tend to use app pools which I don't think you can do on W2K Have you tried writing a tiny little test app which does the same query, and then running that as various users?

I am reluctant to post a chunk of MS framework code here, but you could use either Reflector or this: http://www.codeplex.com/NetMassDownloader to get the source code for the relevant bits of the framework so that you could try implementing various bits to see where it fails.

Can you get any other info about the process without getting Access Denied?

Answer 4

I can enumerate the process (ie, the GetProcessById function works), and we have other code that gets the EXE name and other bits of information.

I will give the test app a try. I'm also going to attempt to use WMI to get this information if I can't get the C# implementation working properly in short order (this is not critical functionality, so I can't spend days on it).

Answer 5

Process of .Net 1.1 uses the Performance Counters to get the information. Either they are disabled or the user does not have administrative rights. Making sure the Performance Counters are enabled and the user is an administrator should make your code work.

Actually the "Performance Counter Users Group" should enough. The group doesn't exist by default. So you should create it yourself.

Process of .Net 2.0 is not depended on the Performance Counters.

See http://weblogs.asp.net/nunitaddin/archive/2004/11/21/267559.aspx

Answer 6

I've read something similar to what you said in the past, Lars. Unfortunately, I'm somewhat restricted with what I can do with the machine in question (in other words, I can't go creating user groups willy-nilly: it's a server, not just some random PC).

Thanks for the answers, Will and Lars. Unfortunately, they didn't solve my problem.

Ultimate solution to this is to use WMI:

using System.Management;
String queryString = "select CreationDate from Win32_Process where ProcessId='" + ProcessId + "'";
SelectQuery query = new SelectQuery(queryString);

ManagementScope scope = new System.Management.ManagementScope(@"\\.\root\CIMV2");
ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);
ManagementObjectCollection processes = searcher.Get();

    //... snip ... logic to figure out which of the processes in the collection is the right one goes here

DateTime startTime = ManagementDateTimeConverter.ToDateTime(processes[0]["CreationDate"].ToString());
TimeSpan uptime = DateTime.Now.Subtract(startTime);

Parts of this were scraped from Code Project:

http://www.codeproject.com/KB/system/win32processusingwmi.aspx

And "Hey, Scripting Guy!":

http://www.microsoft.com/technet/scriptcenter/resources/qanda/jul05/hey0720.mspx

Answer 7

Process of .Net 1.1 uses the Performance Counters ...

Process of .Net 2.0 is not depended on the Performance Counters.

That's interesting to know - it certainly explains why my suggestions based on reading the 2.0 source code were completely useless!