function SIDToName (const SID: PSID): string;
var
 Use: SID_NAME_USE;
 DomainName: array;0..1024] of char;
 DomainNameLength: DWORD;
 Name: array[0..1024] of char;
 NameLength: DWORD;
begin
 DomainNameLength := SizeOf(DomainName);
 NameLength := SizeOf(Name);
 if not LookupAccountSid (nil, SID, Name, NameLength, DomainName,
    DomainNameLength, Use) then
   Result := '***'
 else
   Result := Name;
end;

function GetUserName (ProcessId: Cardinal): string;
var
 AccessToken: THandle;
 SidInfo: PSIDANDATTRIBUTES;
 ReturnLength: DWORD;
 ProcessHandle: THandle;
begin
 Result := '';
 ProcessHandle := OpenProcess(PROCESS_QUERY_INFORMATION, false,
   ProcessId);
 if ProcessHandle = 0 then
   Exit;
 try
   if not OpenProcessToken(ProcessHandle, TOKEN_QUERY, AccessToken) then
     Exit;
   GetMem (SidInfo, 4096);
   try
     Win32Check(GetTokenInformation(AccessToken, TokenUser, SidInfo, 4096,
       ReturnLength));
     Result := SidToName(SidInfo^.Sid);
   finally
     FreeMem(SidInfo);
     CloseHandle(AccessToken);
   end;
 finally
   CloseHandle(ProcessHandle);
 end;
end;