Как узнать SID процесса, для того чтобы понять системный процесс или нет и от имени какого пользователя он запущен

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ProcessStartTime As Any, pProcessUserSid As Any, dwSidSize As Long) As Long

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ProcessStartTime As FILETIME, pProcessUserSid As Long, dwSidSize As Long) As Long
Private Declare Function GetProcessTimes Lib "kernel32" (ByVal hProcess As Long, lpCreationTime As FILETIME, lpExitTime As FILETIME, lpKernelTime As FILETIME, lpUserTime As FILETIME) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
 
Private Type FILETIME
    dwLowDateTime As Long
    dwHighDateTime As Long
End Type
 
Private Sub Form_Load()
    Dim MyPid As Long
    Dim FT As FILETIME
    Dim FT0 As FILETIME
    Dim sid As Long
    Dim ret As Long
    
    MyPid = GetCurrentProcessId
    GetProcessTimes -1, FT, FT0, FT0, FT0 ' Получить FILETIME текущего процесса
    
    WinStationGetProcessSid 0&, MyPid, FT, sid, ret
End Sub

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Long, dwSidSize As Long) As Long

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Any, dwSidSize As Long) As Long
Private Declare Function GetProcessTimes Lib "kernel32" (ByVal hProcess As Long, lpCreationTime As Currency, lpExitTime As Currency, lpKernelTime As Currency, lpUserTime As Currency) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
 
Private Sub Form_Load()
    Dim MyPid As Long
    Dim timZero As Currency ' Íå èíòåðåñóåìûå íàìè âðåìåíà, íî îáÿçàòåëüíûå ê çàïîëíåíèþ â ôóíêöèè GetProcessTimes
    Dim tim As Currency
    Dim sid() As Byte
    Dim ret As Long
    
    MyPid = GetCurrentProcessId
    GetProcessTimes -1, tim, timZero, timZero, timZero ' Ïîëó÷èòü âðåìÿ çàïóñêà òåêóùåãî ïðîöåññà
    
    ReDim Preserve sid(0)
    WinStationGetProcessSid ByVal 0&, MyPid, tim, sid(0), ret
    
    ReDim Preserve sid(ret - 1)
    WinStationGetProcessSid ByVal 0&, MyPid, tim, sid(0), ret
    
    Print sid
    Print ret
End Sub

Option Explicit
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Private Declare Function GetTokenInformation Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal TokenInformationClass As Long, TokenInformation As Any, ByVal TokenInformationLength As Long, ReturnLength As Long) As Long
Private Declare Function LookupAccountSidA Lib "advapi32.dll" (ByVal lpSystemName As Any, ByVal Sid As Long, ByVal name As String, cbName As Long, ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (pTo As Any, uFrom As Any, ByVal lSize As Long)
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
 
Private Const PROCESS_QUERY_LIMITED_INFORMATION As Long = &H1000
Private Const TOKEN_QUERY = &H8
 
Public Function GetProcessUserName(pid As Long) As String
    Dim hProcess As Long
    Dim hToken As Long
    Dim lNeeded As Long
    Dim baBuffer() As Byte
    Dim sBuffer As String
    Dim lpSid As Long
    Dim lpString As Long
    Dim lpszDomain As String, lpszUsername As String, cbDomain As Long, cbUsername As Long
    Dim k As Long
    
    hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, pid)
    
    If hProcess <> 0 Then
        If OpenProcessToken(hProcess, TOKEN_QUERY, hToken) = 1 Then
            Call GetTokenInformation(hToken, 1, ByVal 0, 0, lNeeded)
            ReDim baBuffer(0 To lNeeded)
            
            If GetTokenInformation(hToken, 1, baBuffer(0), UBound(baBuffer), lNeeded) = 1 Then
                Call CopyMemory(lpSid, baBuffer(0), 4)
                
                cbDomain = 260: cbUsername = 260: lpszDomain = String(cbDomain, 0): lpszUsername = String(cbUsername, 0)
                If LookupAccountSidA(0&, lpSid, lpszUsername, cbUsername, lpszDomain, cbDomain, k) <> 0 Then
                    lpszDomain = Left(lpszDomain, cbDomain)
                    lpszUsername = Left(lpszUsername, cbUsername)
                Else
                    lpszDomain = "<Unknown>"
                    lpszUsername = "<Unknown>"
                End If
                
                GetProcessUserName = lpszDomain & "\" & lpszUsername
            End If
            Call CloseHandle(hToken)
        End If
        Call CloseHandle(hProcess)
    End If
End Function
 
Private Sub Form_Load()
    Me.AutoRedraw = True
    Print Chr(34) & GetProcessUserName(GetCurrentProcessId) & Chr(34)
End Sub

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Any, dwSidSize As Long) As Long
Private Declare Function GetProcessTimes Lib "kernel32" (ByVal hProcess As Long, lpCreationTime As Currency, lpExitTime As Currency, lpKernelTime As Currency, lpUserTime As Currency) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LookupAccountSidA Lib "advapi32.dll" (ByVal lpSystemName As Any, ByVal sid As Long, ByVal name As String, cbName As Long, ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Long) As Long
 
Private Sub Form_Load()
    Dim MyPid As Long
    Dim timZero As Currency ' Не интересуемые нами времена, но обязательные к заполнению в функции GetProcessTimes
    Dim tim As Currency
    Dim sid() As Byte
    Dim ret As Long
    Dim lpszDomain As String, lpszUsername As String, cbDomain As Long, cbUsername As Long
    Dim k As Long
    Dim ReturnValue As Long
    
    MyPid = GetCurrentProcessId
    GetProcessTimes -1, tim, timZero, timZero, timZero ' Получить время запуска текущего процесса
    
    ReDim Preserve sid(0)
    ReturnValue = WinStationGetProcessSid(ByVal 0&, MyPid, tim, sid(0), ret)
    ' Почему-то у меня функция WinStationGetProcessSid возвращает всё время разные числа
    
    If ret > 0 Then
        ReDim Preserve sid(ret - 1)
        WinStationGetProcessSid ByVal 0&, MyPid, tim, sid(0), ret
        
        lpSid = VarPtr(sid(0))
        
        cbDomain = 260: cbUsername = 260: lpszDomain = String(cbDomain, 0): lpszUsername = String(cbUsername, 0)
        If LookupAccountSidA(0&, lpSid, lpszUsername, cbUsername, lpszDomain, cbDomain, k) <> 0 Then
            lpszDomain = Left(lpszDomain, cbDomain)
            lpszUsername = Left(lpszUsername, cbUsername)
        Else
            lpszDomain = "<Unknown>"
            lpszUsername = "<Unknown>"
        End If
        
        Print Chr(34) & lpszDomain & "\" & lpszUsername & Chr(34)
        Print ReturnValue ' Почему-то у меня функция WinStationGetProcessSid возвращает всё время разные числа
    End If
End Sub

Option Explicit
Private Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExW" (lpVersionInformation As Any) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Private Declare Function GetTokenInformation Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal TokenInformationClass As Long, TokenInformation As Any, ByVal TokenInformationLength As Long, ReturnLength As Long) As Long
Private Declare Function LookupAccountSid Lib "advapi32.dll" Alias "LookupAccountSidW" (ByVal lpSystemName As Long, ByVal sid As Long, ByVal name As Long, cbName As Long, ByVal ReferencedDomainName As Long, cbReferencedDomainName As Long, peUse As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function GetMem4 Lib "msvbvm60" (ByVal Addr As Long, ByRef dstValue As Long) As Long
 
Private Const PROCESS_QUERY_LIMITED_INFORMATION As Long = &H1000
Private Const PROCESS_QUERY_INFORMATION = 1024
Private Const TOKEN_QUERY = &H8
Private Const MAX_PATH As Long = 260
 
' Получить имя пользователя процесса
Public Function GetProcessUserName(pid As Long) As String
    Dim hProc As Long
    Dim hToken As Long
    Dim lNeeded As Long
    Dim buffer() As Byte
    Dim lpSid As Long
    Dim lpszDomain As String, lpszUsername As String
    Dim cbDomain As Long, cbUsername As Long
    Dim peUse As Long
    Dim inf(68) As Long
    Dim IsVistaAndLater As Boolean
    
    ' Вычислить версию Windows
    inf(0) = 276: GetVersionEx inf(0): IsVistaAndLater = inf(1) >= 6
    
    hProc = OpenProcess(IIf(IsVistaAndLater, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION), 0, pid)
    
    If hProc > 0 Then
        If OpenProcessToken(hProc, TOKEN_QUERY, hToken) = 1 Then
            GetTokenInformation hToken, 1, ByVal 0&, ByVal 0&, lNeeded
            ReDim Preserve buffer(lNeeded - 1)
            
            If GetTokenInformation(hToken, 1, buffer(0), lNeeded, lNeeded) = 1 Then
                GetMem4 VarPtr(buffer(0)), lpSid
                
                cbDomain = 260
                cbUsername = 260
                lpszDomain = Space$(MAX_PATH)
                lpszUsername = Space$(MAX_PATH)
                
                If LookupAccountSid(ByVal 0&, lpSid, StrPtr(lpszUsername), cbUsername, StrPtr(lpszDomain), cbDomain, peUse) > 0 Then
                    lpszDomain = Left$(lpszDomain, cbDomain)
                    lpszUsername = Left$(lpszUsername, cbUsername)
                Else
                    lpszDomain = "<Unknown>"
                    lpszUsername = "<Unknown>"
                End If
                
                GetProcessUserName = lpszDomain & "\" & lpszUsername
            End If
            
            CloseHandle hToken
        Else
            GetProcessUserName = "<Unknown>\<Unknown>"
        End If
        
        CloseHandle hProc
    Else
        GetProcessUserName = "<Unknown>\<Unknown>"
    End If
End Function
 
Private Sub Form_Load()
    Me.AutoRedraw = True
    Print Chr(34) & GetProcessUserName(GetCurrentProcessId) & Chr(34)
End Sub