Detectar ejecución de aplicación en Terminal Server

[[escafandra]]

Puedes encontrar el usuario y el dominio conociendo el Pid de un proceso con esta función:

Código Delphi [-]
 type
 WTS_PROCESS_INFO = record
   SessionId: DWORD;    // session id
   ProcessId: DWORD;    // process id
   pProcessName: LPSTR; // name of process
   pUserSid: PSID;      // user's SID
 end;
 PWTS_PROCESS_INFO = ^WTS_PROCESS_INFO;

 TA_WTS_PROCESS_INFO = array of WTS_PROCESS_INFO;
 PTA_WTS_PROCESS_INFO = ^TA_WTS_PROCESS_INFO;

 function WTSEnumerateProcessesA(hServer: Cardinal; Reserved: DWORD; Version: DWORD;
   var ppProcessInfo: PWTS_PROCESS_INFO; var pCount: DWORD): BOOL; stdcall external 'Wtsapi32.dll';
 procedure WTSFreeMemory(pMemory: Pointer); stdcall external 'Wtsapi32.dll';

 implementation

 function GetUserAndDomainFromPID(ProcessId: Cardinal; var User, Domain: String): boolean;
 var
   snu: SID_NAME_USE;
   pProcessInfo: TA_WTS_PROCESS_INFO;
   nProc,UserSize, DomainSize: Cardinal;
 begin
   Result:= false;
   nProc:= 0;
   UserSize:= 0;
   DomainSize:= 0;

   if WTSEnumerateProcessesA(0, 0, 1, PWTS_PROCESS_INFO(pProcessInfo), nProc) then
   begin
     repeat dec(nProc) until (nProc <= 0) or (ProcessId = pProcessInfo[nProc].ProcessId);
     LookupAccountSid(nil, pProcessInfo[nProc].pUserSid, nil, UserSize, nil, DomainSize, snu);
     if (UserSize <> 0) or (DomainSize <> 0) then
     begin
       SetLength(User, UserSize);
       SetLength(Domain, DomainSize);
       Result:= LookupAccountSid(nil, pProcessInfo[nProc].pUserSid, @User[1], UserSize, @Domain[1], DomainSize, snu);
     end;
     WTSFreeMemory(pProcessInfo);
   end;
 end;

Más información aquí.

Saludos.