Per Skript eigene Prozesse finden, die elevated laufen

#Requires -RunAsAdministrator

function Get-ProcessElevation {
    param([parameter(Mandatory=$true,ValueFromPipeline=$true)][System.Diagnostics.Process]$process)
    begin {
        if(!('WIn32.Tools' -as [type])){  
            Add-Type –MemberDefinition '  
            [DllImport("advapi32.dll", SetLastError = true)]  
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle);

            [DllImport("advapi32.dll", SetLastError = true)]  
            public static extern bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, uint TokenInformationLength, out uint ReturnLength);

            [DllImport("kernel32.dll", SetLastError = true)]  
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool CloseHandle(IntPtr hObject);
            
            public enum TOKEN_INFORMATION_CLASS
            {
                TokenUser = 1,
                TokenGroups,
                TokenPrivileges,
                TokenOwner,
                TokenPrimaryGroup,
                TokenDefaultDacl,
                TokenSource,
                TokenType,
                TokenImpersonationLevel,
                TokenStatistics,
                TokenRestrictedSids,
                TokenSessionId,
                TokenGroupsAndPrivileges,
                TokenSessionReference,
                TokenSandBoxInert,
                TokenAuditPolicy,
                TokenOrigin,
                TokenElevationType,
                TokenLinkedToken,
                TokenElevation,
                TokenHasRestrictions,
                TokenAccessInformation,
                TokenVirtualizationAllowed,
                TokenVirtualizationEnabled,
                TokenIntegrityLevel,
                TokenUIAccess,
                TokenMandatoryPolicy,
                TokenLogonSid,
                MaxTokenInfoClass
            }
    
            public enum TOKEN_ELEVATION_TYPE
            {
                TokenElevationTypeDefault = 1,
                TokenElevationTypeFull,
                TokenElevationTypeLimited
            }
        ' -name "tools" -namespace Win32 –passThru -EA SilentlyContinue | out-null  
    }
    $elevationresult = [Win32.tools+TOKEN_ELEVATION_TYPE]::TokenElevationTypeDefault
    }

    process{
        [System.IntPtr]$tokenhandle = [System.IntPtr]::Zero
        [System.IntPtr]$elevationTypePtr = [System.IntPtr]::Zero

        try{    
            if ([Win32.Tools]::OpenProcessToken([System.IntPtr]$process.Handle,(0x00020000 -bor 0x0008),[ref]$tokenhandle)){
                [int]$elevationResultSize = [System.Runtime.InteropServices.Marshal]::SizeOf([int]$elevationresult)
                [int]$returnedSize = 0
                [System.IntPtr]$elevationTypePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($elevationResultSize)

                if ([Win32.Tools]::GetTokenInformation($tokenhandle,[Win32.tools+TOKEN_INFORMATION_CLASS]::TokenElevationType,$elevationTypePtr,$elevationResultSize,[ref]$returnedSize)){
                    $elevationresult = [Win32.tools+TOKEN_ELEVATION_TYPE][System.Runtime.InteropServices.Marshal]::ReadInt32($elevationTypePtr)
                    $process | Add-Member -MemberType NoteProperty -Name Elevated -Value ($elevationresult -eq [Win32.tools+TOKEN_ELEVATION_TYPE]::TokenElevationTypeFull) -PassThru
                }
            }
        }catch{
            return $false
        }finally{
            if($elevationTypePtr -ne [Intptr]::Zero){
                [System.Runtime.InteropServices.Marshal]::FreeHGlobal($elevationTypePtr)
            }
            if($tokenhandle -ne [Intptr]::Zero){
                [Win32.Tools]::CloseHandle($tokenhandle) | out-null
            }
        }
    }
  
}

Get-Process -IncludeUserName | Get-ProcessElevation | ?{$_.Elevated -and $_.id -ne $pid} | select Name,Username,Elevated