windows-8：在用户名“DWM-1”和“ANONYMOUS LOGON”下运行的某些进程

Question

我在检查任务管理器时安装了 window-8 我发现以下详细信息：

1. dwm（桌面窗口管理器）在用户名“DWM-1”下运行。

2. “SandboxieDcomLaunch.exe”，“SandboxieRpcSs.exe”和应用程序运行的内部沙盘 正在用户名“匿名登录”运行。

.

---

---

在检查事件查看器中的安全日志时，我发现了以下信息：

An account was successfully logged on.

Subject:
    Security ID:        **NULL SID**
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Impersonation Level:        Impersonation

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:       ANONYMOUS LOGON
    Account Domain:     NT AUTHORITY
    Logon ID:       0x1F481
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x0
    Process Name:       -

Network Information:
    Workstation Name:   
    Source Network Address: -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   NTLM V1
    Key Length:     0

---

---

在 Powershell 中运行以下命令时，我发现 win32_system_account 列表中列出了“ANONYMOUS LOGON”。

get-wmiobject -class "win32_account" -namespace "root\cimv2" | 排序标题| 格式表标题、__CLASS、全名

caption                                 __CLASS                                 FullName                               
-------                                 -------                                 --------                               
PCX\Access Control Assistance Opera... Win32_Group                                                                    
pcx\Administrator                      Win32_UserAccount                                                              
PCX\Administrators                     Win32_Group                                                                    
**PCX\ANONYMOUS LOGON**                    Win32_SystemAccount                                                            
PCX\Authenticated Users                Win32_SystemAccount                                                            
PCX\Backup Operators                   Win32_Group                                                                    
PCX\BATCH                              Win32_SystemAccount                                                            
PCX\BUILTIN                            Win32_SystemAccount                                                            
PCX\CREATOR GROUP                      Win32_SystemAccount                                                            
PCX\CREATOR GROUP SERVER               Win32_SystemAccount                                                            
PCX\CREATOR OWNER                      Win32_SystemAccount                                                            
PCX\CREATOR OWNER SERVER               Win32_SystemAccount                                                            
PCX\Cryptographic Operators            Win32_Group                                                                    
PCX\DIALUP                             Win32_SystemAccount                                                            
PCX\Distributed COM Users              Win32_Group                                                                    
PCX\ENTERPRISE DOMAIN CONTROLLERS      Win32_SystemAccount                                                            
PCX\Event Log Readers                  Win32_Group                                                                    
PCX\Everyone                           Win32_SystemAccount                                                            
pcx\Guest                              Win32_UserAccount                                                              
PCX\Guests                             Win32_Group                                                                    
PCX\Hyper-V Administrators             Win32_Group                                                                    
PCX\IIS_IUSRS                          Win32_Group                                                                    
PCX\INTERACTIVE                        Win32_SystemAccount                                                            
PCX\IUSR                               Win32_SystemAccount                                                            
PCX\LOCAL                              Win32_SystemAccount                                                            
PCX\LOCAL SERVICE                      Win32_SystemAccount                                                            
PCX\NETWORK                            Win32_SystemAccount                                                            
PCX\Network Configuration Operators    Win32_Group                                                                    
PCX\NETWORK SERVICE                    Win32_SystemAccount                                                            
PCX\OWNER RIGHTS                       Win32_SystemAccount                                                            
PCX\Performance Log Users              Win32_Group                                                                    
PCX\Performance Monitor Users          Win32_Group                                                                    
PCX\Power Users                        Win32_Group                                                                    
PCX\PROXY                              Win32_SystemAccount                                                            
PCX\Remote Desktop Users               Win32_Group                                                                    
PCX\REMOTE INTERACTIVE LOGON           Win32_SystemAccount                                                            
PCX\Remote Management Users            Win32_Group                                                                    
PCX\Replicator                         Win32_Group                                                                    
PCX\RESTRICTED                         Win32_SystemAccount                                                            
PCX\SELF                               Win32_SystemAccount                                                            
PCX\SERVICE                            Win32_SystemAccount                                                            
PCX\SYSTEM                             Win32_SystemAccount                                                            
pcx/CYBORG                         Win32_UserAccount                                                              
PCX\TERMINAL SERVER USER               Win32_SystemAccount                                                            
PCX\Users                              Win32_Group                                                                    
PCX\WinRMRemoteWMIUsers__              Win32_Group

---

---

---

有人可以解释一下发生了什么吗？什么是“DWM-1”和“ANONYMOUS LOGON”，我从未见过在这样的用户名下运行的进程。

Answer 1

该用户是在Windows 8中新的; 它是仅用于进程的系统用户。DWM-#Desktop Window Manager

另一个用户NT AUTHORITY\ANONYMOUS LOGON也是系统用户。

有关的

• Microsoft TechNet 论坛：为什么桌面 Windows 管理器在任务管理器中显示 DWM-2、DWM3、DWM-1