I use the following
PEPROCESS exist;
UCHAR buffer[256];
PTOKEN_GROUPS sid=(PTOKEN_GROUPS)&buffer[sizeof(TOKEN_GROUPS)];
ptoken=PsReferencePrimaryToken(exist);
status=ObOpenObjectByPointer(ptoken,0,NULL,TOKEN_ALL_ACCESS,NULL,KernelMode,&THandle);
ObDereferenceObject(ptoken);
//to give the Handle of Token
status = ZwQueryInformationToken(
THandle,TokenGroups,&buffer,sizeof(buffer), &requiredLength);
DbgPrint(“%d \n”,sid->GroupCount);
DbgPrint(“%d \n”,sid->Groups[0].Sid);
But I dont give the GroupCount and Groups sid
I have give the Groups sid that using Application Program. administratros
is 544
But I have not give To Driver. I hope Group Sid in driver …
How to…?