Dectect users running in an impersonate process