{"id":110336,"date":"2024-10-03T07:00:00","date_gmt":"2024-10-03T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=110336"},"modified":"2024-10-03T08:42:55","modified_gmt":"2024-10-03T15:42:55","slug":"20241003-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20241003-00\/?p=110336","title":{"rendered":"How can I detect whether the user is running as an elevated administrator (as opposed to a natural administrator)?"},"content":{"rendered":"

When a user with administrator privileges signs in, the User Account Control (UAC) feature signs in the administrator with a so-called “split token”, in which the user operates in Clark Kent mode: Although they have latent administrator privileges, the administrative powers in the token are disabled. To exercise those administrative powers, the user must elevate their token.<\/p>\n

A customer wanted to discourage users from running their program elevated, but they also didn’t want to scold users who were running with UAC disabled (such as on Windows Server), since those users had no opportunity to de-elevate.<\/p>\n

The way to inspect whether your token is split, and if so whether you have the non-administrator (“limited”) version or the administrator (“full”) version is to ask for the token’s elevation type.<\/p>\n\n\n\n\n\n\n
\u00a0<\/th>\nStandard user<\/th>\nAdministrative user<\/th>\n<\/tr>\n
UAC disabled<\/th>\nTokenElevationTypeDefault<\/td>\nTokenElevationTypeDefault<\/td>\n<\/tr>\n
UAC enabled, not elevated<\/th>\nTokenElevationTypeDefault<\/td>\nTokenElevationTypeLimited<\/td>\n<\/tr>\n
UAC enabled, elevated<\/th>\nN\/A<\/td>\nTokenElevationTypeFull<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Non-administrative users cannot split their token (there being no administrator privileges to split out), and administrative users cannot split their tokens if UAC is disabled.<\/p>\n

If you are looking for “users who manually elevated”, then you can consult the table above and see that a token elevation type of Full<\/code> exactly identifies the “Administrative user, UAC enabled, elevated” box.<\/p>\n

bool IsManuallyElevatedViaUAC()\r\n{\r\n    TOKEN_ELEVATION_TYPE type;\r\n    DWORD actual;\r\n    if (!GetTokenInformation(\r\n            GetCurrentProcessToken(),\r\n            TokenElevationType,\r\n            &type,\r\n            sizeof(type),\r\n            &actual)) {\r\n        \/\/ insert your favorite error handling here\r\n        throw_error(GetLastError());\r\n    }\r\n    return type == TokenElevationTypeFull;\r\n}\r\n<\/pre>\n
We learned about Get\u00adCurrent\u00adProcess\u00adToken()<\/code>  a little while ago<\/a>. This is a convenient pseudo-handle that refers to the current process. We ask for the current process’s token’s elevation type, and if that is Full<\/code>, then we are in that box in the bottom right corner.<\/p>\n
The helpers in the token_helpers.h<\/code> header in the Windows Implementation Library (wil) turn this into a one-line function.<\/p>\n
bool IsManuallyElevatedViaUAC()\r\n{\r\n    return wil::get_token_information<TOKEN_ELEVATION_TYPE>(\r\n            GetCurrentProcessToken()) == TokenElevationTypeFull;\r\n}\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
You can ask for the elevation type.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-110336","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
You can ask for the elevation type.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/110336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=110336"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/110336\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=110336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=110336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=110336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}