|
In this article, I'll quickly discuss how to make all the processes appear in the Task Manager for any normal user.
Prerequisites:
•A running terminal server that needs a user to see all the processes in the Task Manager
•A registry editor, like regedit.exe
Section 1: Indicators:
Under most circumstances, a normal user cannot see all the processes running on a terminal server, except if you give them administrator privileges.
While this is a limitation, it is merely a GUI limitation, and can be overridden via the registry; no permission changes are necessary.
In the registry at HKCU\Software\Microsoft\Windows NT\CurrentVersion\TaskManager, the Preferences value holds the data that is needed to make all the processes appear in the Task Manager.
When the Task Manager doesn't show all the processes, the Preferences value looks like this:
70,01,00,00,F4,01,00,00,02,00,00,00,00,00,00,00,00,00,00,00,
49,00,00,00,2B,00,00,00,D5,02,00,00,EA,01,00,00,01,00,00,00,00,00,00,00,01,
00,00,00,04,00,00,00,05,00,00,00,06,00,00,00,FF,FF,FF,FF,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6B,
00,00,00,32,00,00,00,23,00,00,00,46,00,00,00,46,00,00,00,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,CB,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
When the Task Manager does show all the processes, the Preferences value looks like this:
70,01,00,00,F4,01,00,00,02,00,00,00,00,00,00,00,00,00,00,00,
49,00,00,00,2B,00,00,00,D5,02,00,00,EA,01,00,00,01,00,00,00,00,00,00,00,01,
00,00,00,04,00,00,00,05,00,00,00,06,00,00,00,FF,FF,FF,FF,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6B,
00,00,00,32,00,00,00,23,00,00,00,46,00,00,00,46,00,00,00,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,00,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,
FF,FF,FF,FF,FF,FF,FF,CB,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00
The only difference is in the fourth from the last set of hexadecimal digits. Checking the "Show all the processes" box on the Task Manager turns the 00 into 01. Making this change through a registry hack will give the specific user the ability to see all the processes running on the server even though they are not administrators.
If you have numerous users you need to migrate this out to, you can hack this registry entry, export the changes to a .reg file, then silently import it (regedit.exe /q) into all the user's registries upon logon using a logon script.
|
