Не получается сгруппировать запущенные процессы по ключу SID

#include <Windows.h>
#include <TlHelp32.h>
#include <algorithm>
#include <cstdio>
#include <vector>
 
 
 
namespace
{
 
 
 
typedef std::vector<DWORD> container_t;
typedef std::vector<byte>  sid_t;
typedef std::vector<byte>  buff_t;
 
 
 
//
// Log helper macros.
//
 
#define implLOG(Level,Format,...) printf(Level __FUNCTION__ ": " Format "\r\n", __VA_ARGS__)
 
#define LOG_INFO(Format,...) implLOG("[INFO]    ", Format, __VA_ARGS__)
#define LOG_WARN(Format,...) implLOG("[WARNING] ", Format, __VA_ARGS__)
#define LOG_ERR(Format,...)  implLOG("[ERROR]   ", Format, __VA_ARGS__)
 
#define ERROR_GLE(Func) LOG_ERR(#Func " failed with last error 0x%.8lx.", GetLastError())
#define ERROR_GLE_PID(Func,Pid) LOG_ERR(#Func " failed with last error 0x%.8lx (PID = %lu).", GetLastError(), Pid)
 
 
 
//
// Enable privilege for entire process.
//
bool EnablePrivilege(std::wstring const & PrivilegeName)
{
    HANDLE hToken = NULL;
 
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) {
        ERROR_GLE(OpenProcessToken);
        goto ErrorExit;
    }
 
    TOKEN_PRIVILEGES tkp;
    
    if (!LookupPrivilegeValueW(NULL, PrivilegeName.c_str(), &tkp.Privileges[0].Luid)) {
        ERROR_GLE(LookupPrivilegeValueW);
        goto ErrorExit;
    }
 
    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 
    if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof (tkp), NULL, NULL)) {
        ERROR_GLE(AdjustTokenPrivileges);
        goto ErrorExit;
    }
 
    //
    // NOTE!
    //   
    //      We must check last error value even if AdjustTokenPrivileges succeeded.
    //      See MSDN for more information.
    //
 
    DWORD const LastError = GetLastError();
    if (NO_ERROR != LastError) {
        LOG_ERR("AdjustTokenPrivileges: last error = 0x%.8lx.", LastError);
        goto ErrorExit;
    }
 
    CloseHandle(hToken);
    return true;
 
ErrorExit:
 
    if (hToken) { CloseHandle(hToken); }
    return false;
}
 
 
 
//
// Create SID of well-known type.
// See the following:
//
//      Well-known security identifiers in Windows operating systems
//      [url]https://support.microsoft.com/en-us/kb/243330[/url]
//
sid_t CreateSid(WELL_KNOWN_SID_TYPE SidType)
{
    sid_t RetValue;
    DWORD BuffSize = SECURITY_MAX_SID_SIZE;
    sid_t Buffer(BuffSize);
 
    if (!CreateWellKnownSid(SidType, NULL, &Buffer[0], &BuffSize)) {
        ERROR_GLE(CreateWellKnownSid);
    } else {
        RetValue = Buffer;
    }
 
    return RetValue;
}
 
 
 
//
// Get information of specified class type from the access token.
// The token must be open with TOKEN_QUERY access flag.
//
// NOTE!
//
//      Do not return output buffer as vector<byte> from this function
//      because the original buffer may contain embedded pointers.
//
bool GetTokenInfo(HANDLE hToken, TOKEN_INFORMATION_CLASS InfoClass, buff_t & OutBuffer)
{
    //
    // First step: determine necessary space, in bytes.
    //
 
    DWORD nBytes = 0;
    GetTokenInformation(hToken, InfoClass, NULL, 0, &nBytes);
 
    if (0 == nBytes) {
        ERROR_GLE(GetTokenInformation-1);
        return false;
    }
 
    //
    // Second step: allocate buffer and call function again.
    //
 
    OutBuffer.resize(nBytes);
 
    DWORD nBytes2;
    if (!GetTokenInformation(hToken, InfoClass, &OutBuffer[0], nBytes, &nBytes2)) {
        ERROR_GLE(GetTokenInforation-2);
        return false;
    }
 
    return true;
}
 
 
 
//
// Check whether token contain specified SID.
// Token must be opened with TOKEN_QUERY access flag.
// This is a same as CheckTokenMembership but a token
// is not required to have impersonation type.
//
bool IsTokenContainSid(HANDLE hToken, sid_t const & Sid)
{
    //
    // First, check the user SID.
    //
 
    buff_t Buffer;
    if (!GetTokenInfo(hToken, TokenUser, Buffer)) {
        LOG_ERR("GetTokenInfo (TokenUser) failed.");
        return false;
    }
    TOKEN_USER const * pTokUser = reinterpret_cast<TOKEN_USER const *>(&Buffer[0]);
    if (EqualSid(pTokUser->User.Sid, (PSID)&Sid[0])) { return true; }
 
    //
    // Next, check the group SID list.
    //
    // NOTE!
    //
    //      Check only the groups that has SE_GROUP_ENABLED flag.
    //      The groups without this flag are not used in the
    //      ordinal security checks.
    //
 
    if (!GetTokenInfo(hToken, TokenGroups, Buffer)) {
        LOG_ERR("GetTokenInfo (TokenGroups) failed.");
        return false;
    }
    TOKEN_GROUPS const * pTokGroups = reinterpret_cast<TOKEN_GROUPS const *>(&Buffer[0]);
    DWORD const NumGroups = pTokGroups->GroupCount;
    for (DWORD i = 0; i < NumGroups; ++i)
    {
        SID_AND_ATTRIBUTES const * pSidAndAttrs = &pTokGroups->Groups[i];
        if (
            (pSidAndAttrs->Attributes & SE_GROUP_ENABLED) &&
            (EqualSid(pSidAndAttrs->Sid, (PSID)&Sid[0]))
            )
        {
            return true;
        }
    }
    return false;
}
 
 
 
//
// Returns true on Windows Vista and higher or false otherwise.
//
bool IsVistaOrLater()
{
    OSVERSIONINFOW osvi = {0};
    osvi.dwOSVersionInfoSize = sizeof (osvi);
    if (!GetVersionExW(&osvi)) {
        ERROR_GLE(GetVersionExW);
        return false;
    }
    DWORD const VistaOsMajor = 6;
    return (osvi.dwMajorVersion >= VistaOsMajor);
}
 
 
 
//
// Add process ID to the list if it's access token has a specified SID.
//
void InspectProcess(PROCESSENTRY32W const & Entry, container_t & Container, sid_t const & Sid)
{
    DWORD const ProcessId = Entry.th32ProcessID;
 
    //
    // Exclude 'IDLE' and 'System' processes.
    //
 
    DWORD const IdlePID   = 0;
    DWORD const SystemPID = 4;
 
    if ( (ProcessId != IdlePID) && (ProcessId != SystemPID) )
    {
        //
        // Using of PROCESS_QUERY_LIMITED_INFORMATION access flag is
        // desirable because you can open some protected system processes
        // like audiodg.exe on Vista or even csrss.exe on Windows 8.1.
        // But this flag is not exists for pre-Vista Windows versions.
        //
        static DWORD const ProcessDesiredAccess = IsVistaOrLater() ?
            PROCESS_QUERY_LIMITED_INFORMATION : PROCESS_QUERY_INFORMATION;
 
        HANDLE const hProcess = OpenProcess(ProcessDesiredAccess, FALSE, ProcessId);
        if (!hProcess)
        {
            ERROR_GLE_PID(OpenProcess, ProcessId);
        }
        else
        {
            HANDLE hToken;
            if (!OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) {
                ERROR_GLE_PID(OpenProcessToken, ProcessId);
            }
            else
            {
                if (IsTokenContainSid(hToken, Sid))
                {
                    Container.push_back(ProcessId);
                }
                CloseHandle(hToken);
            }
            CloseHandle(hProcess);
        }
    }
}
 
 
 
//
// Return a list of processes (IDs) that has specified SID in their access token.
//
container_t
GetProcessesBySid(WELL_KNOWN_SID_TYPE SidType)
{
    container_t Container;
    sid_t Sid;
    HANDLE hSnap = INVALID_HANDLE_VALUE;
    PROCESSENTRY32W Entry = {0};
 
    //
    // First, we must try to enable 'Debug' privilege to
    // bypass security checks when opening a process handle.
    //
 
    if (!EnablePrivilege(SE_DEBUG_NAME)) {
        LOG_WARN("EnablePrivilege failed.");
    }
 
    //
    // Creating SID of specified well-known type.
    //
 
    Sid = CreateSid(SidType);
    if (Sid.empty()) {
        LOG_ERR("CreateSid failed (sid type = %d).", SidType);
        goto Finish;
    }
 
    //
    // Create snapshot of all running processes.
    //
 
    hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (INVALID_HANDLE_VALUE == hSnap)
    {
        ERROR_GLE(CreateToolhelp32Snapshot);
        goto Finish;
    }
 
    //
    // Inspect all founded processes.
    //
    
    Entry.dwSize = sizeof (Entry);
    if (Process32FirstW(hSnap, &Entry))
    {
        do
        {
            InspectProcess(Entry, Container, Sid);
        } while (Process32NextW(hSnap, &Entry));
    }
 
Finish:
    
    if (INVALID_HANDLE_VALUE != hSnap) { CloseHandle(hSnap); }
    return Container;
}
 
 
 
} // namespace
 
 
 
int main()
{
    container_t Container = GetProcessesBySid(WinLocalSystemSid);
    std::sort(Container.begin(), Container.end());
 
    for (container_t::const_iterator it = Container.begin();
        it != Container.end();
        ++it)
    {
        printf("%lu\r\n", *it);
    }
 
    return 0;
}