Question

我通过WMI在远程计算机上运行进程。

如果远程创建过程代码（在远程计算机上），我可以签入吗？

我尝试了Process.GetCurrentProcess()和Process.GetCurrentProcess().StartInfo属性，但我没有找到任何信息。环境类也不包含任何信息。

我的代码用于创建远程进程（我在某个论坛上找到了它）：

                var connOptions = new ConnectionOptions()
                {
                    Username = "user",
                    Password = "password"
                };

            connOptions.Impersonation = ImpersonationLevel.Impersonate;
            connOptions.EnablePrivileges = true;

            var manScope = new ManagementScope(string.Format(@"\\{0}\root\cimv2", "MachineName"), connOptions);

            manScope.Connect();

            var objectGetOptions = new ObjectGetOptions();
            var managementPath = new ManagementPath("Win32_Process");
            using (var processClass = new ManagementClass(manScope, managementPath, objectGetOptions))
            {
                using (ManagementBaseObject inParams = processClass.GetMethodParameters("Create"))
                {
                    inParams["CommandLine"] = remoteFilePath;

                    using (ManagementBaseObject outParams = processClass.InvokeMethod("Create", inParams, null))
                    {
                        if ((uint)outParams["returnValue"] == 0)
                        {
                            var pid = (uint)outParams["processId"];

                            return pid;
                        }
                    }
                }
            }

Answer 1

我不知道你是否可以检测到它，但你可以做的一个解决方法是通过命令行参数传递类似“remoteStarted”的内容，当你通过WMI启动时，然后在你的代码中执行

const string REMOTELY_STARTED_FLAG = "remotelyStarted";

if(Environment.GetComandLineArgs().Contains(REMOTELY_STARTED_FLAG, StringComparison.OrdinalIgnoreCase))
{
    //Do code here if it was running remotely.
}

如何检查进程是否远程启动

1 个答案: