Share via

3.7.4.1.20 RpcWinStationEnumerateProcesses (Opnum 36)

  • Article

The RpcWinStationEnumerateProcesses method retrieves the processes running on a remote server on which the caller has WINSTATION_QUERY permission to retrieve information. The method checks whether the caller has WINSTATION_QUERY permission (section 3.1.1) by setting it as the Access Request mask, and fails if the caller does not have the permission.<190>

 BOOLEAN RpcWinStationEnumerateProcesses(
   [in] SERVER_HANDLE hServer,
   [out] DWORD* pResult,
   [out, size_is(ByteCount)] PBYTE pProcessBuffer,
   [in, range(0, 0x8000 )] DWORD ByteCount
 );

hServer: Handle to the server object. This is of type SERVER_HANDLE. hServer MUST be obtained from a previous call to RpcWinStationOpenServer.

pResult:  Failure error code if the call to RpcWinStationEnumerateProcesses failed. If the call was successful, this parameter MUST be STATUS_SUCCESS (0x00000000), as specified in [MS-ERREF].

Value

Meaning

STATUS_SUCCESS

0x00000000

The call succeeded.

STATUS_INFO_LENGTH_MISMATCH

0xC0000004

ByteCount is too small to receive the data.

pProcessBuffer:  Pointer to a buffer receiving the list of processes.

In pProcessBuffer for each process, the server will return the following in the buffer, in this order:

  1. A TS_PROCESS_INFORMATION_NT4 structure.

  2. A number of SYSTEM_THREAD_INFORMATION (see [WININTERNALS] or [MSFT-WINSYSINTERNALS]) structures equal to the maximum number of threads in the process.

  3. A TS_SYS_PROCESS_INFORMATION structure for the process.

Only up to SIZEOF TS4_SYSTEM_THREAD_INFORMATION of the SYSTEM_THREAD_INFORMATION structure (as specified in [WININTERNALS] or [MSFT-WINSYSINTERNALS]) is copied into the buffer and only up to SIZEOF TS4_SYSTEM_PROCESS_INFORMATION of the TS_SYS_PROCESS_INFORMATION_NT4 structure is copied into the buffer.

ByteCount:  The size, in bytes, of the pProcessBuffer parameter. If ByteCount is too small to receive the data, the method returns an error code (STATUS_INFO_LENGTH_MISMATCH, as specified in [MS-ERREF]) in the pResult parameter. Note that during failure no indication is given to the caller specifying the correct size if pProcessBuffer is too small.

Return Values:  Returns TRUE if the call succeeded, or FALSE if the method failed. On failure, pResult indicates the failure status code.

Return value/code

Description

0x01

TRUE

Successful completion.

0x00

FALSE

Method call failed.