We Keep Coding

Issue executing command line command in .NET c#

Attempting to run ntdsutil from a C# executable and encountering an error. In case anyone is wondering, this is for a automated auditing process as part of a managed service provider - not trying to create a trojan/malware.
The command is: ntdsutil "ac i ntds" "ifm" "create full c:\audit" q q
This is Windows server specific, am running on Windows 2016.
I am using System.Diagnostics.Process and have tried various combinations of properties but getting same result. The following is an example, there is a standard output redirect so can see results of execution:
Process process = new System.Diagnostics.Process();
ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo();
startInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Normal;
startInfo.FileName = #"C:\Windows\System32\ntdsutil.exe";
startInfo.Arguments = "\"ac i ntds\" \"ifm\" \"create full c:\\audit\" q q";
//Set output of program to be written to process output stream
startInfo.RedirectStandardOutput = true;
startInfo.RedirectStandardError= true;
startInfo.UseShellExecute = false;
process.StartInfo = startInfo;
process.Start();
// Get program output
string strOutput = process.StandardOutput.ReadToEnd();
//Wait for process to finish
process.WaitForExit();
File.WriteAllText("out.txt", strOutput);
The output looks like this:
C:\Windows\System32\ntdsutil.exe: ifm
ifm: create full c:\audit
error 0x80042302(A Volume Shadow Copy Service component encountered an unexpected error. Check the Application event log for more information.)
ifm: q
C:\Windows\System32\ntdsutil.exe: q
Have checked event logs as mention (nothing obvious) and done various searches on error but nothing useful appears. Running the command on command line works fine.
It is running a Administrator level user. Is it possible related to app.manifest priveleges?
Any help is appreciated.

How to differentiate multiple processes with the same name and to kill all those processes which are running with my USERNAME in C#?

I have multiple process named COM SURROGATE (dllhost.exe) are running in Task Manager at my System. In which I need to kill all those processes which are running with my USERNAME(One is running with SYSTEM/"" so no need to kill that).
I need to do like below but only for the dllhost process running with myusername :
Process[] runningProcess = Process.GetProcessesByName("dllhost");
if(runningProcess.Length > 0 )
{
foreach (var surrogateProcess in runningProcess)
{
surrogateProcess.Kill();
}
}

I found the solution for this. Below are the key points :
We can't close process running by SYSTEM/""/otheruser etc without admin access so process.kill() used to throw Access Denied error.
By using below we are trying to terminate all the process with the name of dllhost.exe (we can write any of the process name) and used Style.Hidden so user will not see the cmd prompt and not even the message.
Message could be like :
ERROR: The process "dllhost.exe" with PID 6332 could not be terminated.
Reason: Access is denied. [This is running with either system or other user]
SUCCESS: The process "dllhost.exe" with PID 15320 has been terminated. [This was running with my username which can be closed without any issue]
System.Diagnostics.Process process = new System.Diagnostics.Process();
System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo();
startInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
startInfo.FileName = "cmd.exe";
startInfo.Arguments = "/C taskkill /IM dllhost.exe /F";
process.StartInfo = startInfo;
process.Start();
The code will close all the processes running with my username only. Cheers.

Run new process as user interacting with UI

I have a GUI process that is running as nt authority\system. I'd like to launch another process (preferably via Process class) as the user that is interacting with the GUI process. If I just call Process.Start the new process will also run as nt authority\system but I want it to be domain\user.
Edit: for clarification, I don't have the current user's username or password. I just want to run the process as though the user was starting it themselves without having to ask for username/password.

Use StartInfo property with a valid credentials.
Process proc = new Process();
proc.StartInfo.Domain = "YourDomain";
proc.StartInfo.UserName = "Username";
proc.StartInfo.Password = "YourPassword";

You can do this:
Process proc = new System.Diagnostics.Process();
System.Security.SecureString ssPwd = new System.Security.SecureString();
proc.StartInfo.UseShellExecute = false;
proc.StartInfo.FileName = "C:/YourPath/YourProcess.exe";
proc.StartInfo.Arguments = "Args"; //Arguments if any, otherwise delete this line
proc.StartInfo.Domain = "domainname";
proc.StartInfo.UserName = "username";
proc.StartInfo.Password = "password";
proc.Start();

var psi = new ProcessStartInfo();
psi.Verb = "runas";
psi.FileName = "notepad.exe";
Process.Start(psi);

'run as' argument while invoking a process with Process object, will ask for password of the user.
It is not possible to run a process as User account from a Local System Account.
You can do a workaround to solve your problem
Start a Main Process 'A' as the logged on user.
Now, start the required Local System Account 'B' process from the Main Process(A).
Now 'A' will monitor for a trigger from process B, if the main code (the code that must be run in user account) needs to be run. If the trigger hits, the required code can be run.
Monitoring can be done by monitoring(reading) a text file for every certain duration, and the trigger can be sent from B(system account process) which is writing to the text file. Any other better monitoring approach can be taken.

Mimic Windows' 'Run' window in .NET

I would like to mimic the Run command in Windows in my program. In other words, I would like to give the user the ability to "run" an arbitrary piece of text exactly as would happen if they typed it into the run box.
While System.Diagnostics.Process.Start() gets me close, I can't seem to get certain things like environment variables such as %AppData% working. I just keep getting the message "Windows cannot find '%AppData%'..."

You can use the Environment.ExpandEnvironmentVariables method to turn %AppData% into whatever it actually corresponds to.

Depending on what you're trying to do, you could also call CMD.EXE, which will expand your environment variables automatically. The example below will do a DIR of your %appdata% folder, and redirect the stdOut to the debug:
StreamReader stdOut;
Process proc1 = new Process();
ProcessStartInfo psi = new ProcessStartInfo("CMD.EXE", "/C dir %appdata%");
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
proc1.StartInfo = psi;
proc1.Start();
stdOut = proc1.StandardOutput;
System.Diagnostics.Debug.Write(stdOut.ReadToEnd());

Process.Start() And Trying to launch a game

I'm trying launch an application using c#, and have been experimentiing with the following line, if I run this from a cmd prompt it's ok but when running in my forms app it fails.
Process.Start(#"C:\Program Files (x86)\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe","+connect 91.192.210.47:2304");
The Error is Win_Improper_quit_body
any ideas.

I believe the particular executable you're trying to launch expects the working directory to be set correctly.
var processStartInfo = new ProcessStartInfo(pathToExe, args);
processStartInfo.WorkingDirectory = Path.GetDirectoryName(pathToExe);
Process.Start(processStartInfo);
See here for more info.

You should put the arguments part in Arguments property of ProcessStartInfo
Here's an example:
ProcessStartInfo startInfo = new ProcessStartInfo("IExplore.exe");
startInfo.WindowStyle = ProcessWindowStyle.Minimized;
Process.Start(startInfo);
startInfo.Arguments = "www.northwindtraders.com";
Process.Start(startInfo);