正确的方法来确定服务是否作为SYSTEM用户运行

BOOL IsLocalSystem()
{
  HANDLE hToken;
  UCHAR bTokenUser[sizeof(TOKEN_USER) + 8 + 4 * SID_MAX_SUB_AUTHORITIES];
  PTOKEN_USER pTokenUser = (PTOKEN_USER)bTokenUser;
  ULONG cbTokenUser;
  SID_IDENTIFIER_AUTHORITY siaNT = Security_NT_AUTHORITY;
  PSID pSystemSid;
  BOOL bSystem;

  // open process token
  if (!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&hToken))
      return falSE;

  // retrieve user SID
  if (!GetTokenInformation(hToken,TokenUser,pTokenUser,sizeof(bTokenUser),&cbTokenUser))
  {
    CloseHandle(hToken);
    return falSE;
  }

  CloseHandle(hToken);

  // allocate LocalSystem well-kNown SID
  if (!AllocateAndInitializeSid(&siaNT,1,Security_LOCAL_SYstem_RID,&pSystemSid))
    return falSE;

  // compare the user SID from the token with the LocalSystem SID
  bSystem = EqualSid(pTokenUser->User.Sid,pSystemSid);

  FreeSid(pSystemSid);

  return bSystem;
}@H_607_18@ 
 
对于任何定义为here的已知SID,相同的代码将起作用(如果已修改).