{"id":92451,"date":"2015-12-10T07:00:00","date_gmt":"2015-12-10T22:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/?p=92451"},"modified":"2019-03-13T12:22:43","modified_gmt":"2019-03-13T19:22:43","slug":"20151210-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20151210-00\/?p=92451","title":{"rendered":"Why does OpenProcess return access denied, even if I enable debug privilege?"},"content":{"rendered":"<p>Many customers ask something like this: <\/p>\n<blockquote CLASS=\"q\">\n<p>We want to get the creation time of a process, but our call to <code>Open&shy;Process<\/code> fails with <code>ERROR_ACCESS_DENIED<\/code>. <\/p>\n<pre>\nstruct KernelHandleDeleter\n{\n void operator()(HANDLE *h)\n {\n  if (h != nullptr) CloseHandle(h);\n }\n};\n\nbool GetCreationTimeOfProcess(DWORD pid, FILETIME *creationTime)\n{\n std::unique_ptr&lt;HANDLE, KernelHandleDeleter&gt;\n    process(OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid));\n if (!process) {\n  \/\/ GetLastError() returns ERROR_ACCESS_DENIED\n  return false;\n }\n FILETIME exitTime, kernelTime, userTime;\n return GetProcessTimes(process, creationTime,\n                 &amp;exitTime, &amp;kernelTime, &amp;userTime) != FALSE;\n}\n<\/pre>\n<p>It works if the program is running as administrator, but not if the program is running as a standard user. We even <a HREF=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/ff541528%28v=vs.85%29.aspx\">enabled debug privilege<\/a>, but that didn&#8217;t help. <\/p>\n<\/blockquote>\n<p>You don&#8217;t have access because you don&#8217;t have <code>PROCESS_ALL_ACCESS<\/code> permission on the process. <code>PROCESS_ALL_ACCESS<\/code> is a huge set of permissions, including <code>WRITE_DAC<\/code> (permission to change permissions), and if all you are doing is getting the process creation time, it&#8217;s totally overkill. It&#8217;s like getting power of attorney in order to be able to check their cell phone bill. All you need in order to check someone&#8217;s cell phone bill is to be listed as an <i>authorized person<\/i> on their account. You don&#8217;t need permission to make like-and-death decisions on their behalf. <\/p>\n<p>Getting the creation time for a process <a HREF=\"http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms683223%28v=vs.85%29.aspx\">requires <code>PROCESS_QUERY_INFORMATION<\/code> or <code>PROCESS_QUERY_LIMITED_INFORMATION<\/code> access<\/a>. So just ask for the minimum required to accomplish <!-- backref: When you open a securable object, make sure you pass the security mask you actually want (no more, no less) -->what you need<\/a>. then you are <a HREF=\"http:\/\/en.wikipedia.org\/wiki\/You_Can%27t_Always_Get_What_You_Want\">more likely to get it<\/a>. <\/p>\n<pre>\nbool GetCreationTimeOfProcess(DWORD pid, FILETIME *creationTime)\n{\n std::unique_ptr&lt;HANDLE, KernelHandleDeleter&gt;\n    process(OpenProcess(<font COLOR=\"blue\">PROCESS_QUERY_LIMITED_INFORMATION<\/font>, FALSE, pid));\n ...\n}\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Asking for more than you need.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-92451","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>Asking for more than you need.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/92451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=92451"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/92451\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=92451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=92451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=92451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}