I wrote Task Manager and I just remembered something

Re:I wrote Task Manager and I just remembered something by KiwiJohnno on Tuesday May 26, 2020 @02:19AM (#23307998)

In windows processes have an access control list, just like file permissions. MsMpEng.exe (and other sometimes other critical system processes and antivirus scanners etc) can't be killed because only system has permission, not administrators. Process Explorer allows you to view and modify a process access control list (if you have permission).

If you use psexec to run process explorer as system, then you can get into the access control list of these processes and add permission for administrator (or just kill them from there...)

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by asveikau on Wednesday May 27, 2020 @12:08AM (#23319299)

I am ex msft. I have written windows code in kernel mode. I know that there are acls. I know about psexec too. I was not talking about any of that, but Task Manager as this thread was about.

Personally if I were killing with psexec I would try invoking taskkill.exe.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by KiwiJohnno on Wednesday May 27, 2020 @01:42AM (#23319718)

Ah, ok, sorry I was just trying to be helpful, I wasn't trying to teach you to suck eggs :)

But my main point was (that I implied, but I didn't say) is yes, I remember killing off early versions of microsoft security essentials (when that was its name) with task manager too. Logically, back then the process didn't have a restricted ACL, but it now does.

I didn't actually know you could specify the system user when killing a process with taskkill, thanks

[ Parent | on HN ]