Question

I want to know, if a user is administrator on a PC or not? I found a code snippet, which does this, but i have a problem with it. The problem with this code is, that this function will return if the user, who started the process has admin rights or not. But i want to query if a specific user has administrator rights or not. Can i do this somehow? This is important because my application will run under SYSTEM account, so it will always return that the user is admin, but i want to know if the logged on user is admin or not?

Code snippet:

BOOL IsUserAdmin( VOID )
/*++ 
Routine Description: This routine returns TRUE if the caller's
process is a member of the Administrators local group. Caller is NOT
expected to be impersonating anyone and is expected to be able to
open its own process and process token. 
Arguments: None. 
Return Value: 
  TRUE - Caller has Administrators local group. 
  FALSE - Caller does not have Administrators local group. --
*/ 
{
BOOL b;
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
PSID AdministratorsGroup; 

b = AllocateAndInitializeSid(
                                &NtAuthority,
                                2,
                                SECURITY_BUILTIN_DOMAIN_RID,
                                DOMAIN_ALIAS_RID_ADMINS,
                                0, 0, 0, 0, 0, 0,
                                &AdministratorsGroup
                            ); 
if ( b ) 
{
    if ( !CheckTokenMembership( NULL, AdministratorsGroup, &b ) ) 
    {
        b = FALSE;
    } 
    FreeSid( AdministratorsGroup ); 
}

return ( b );
}

Answer 1

You need to take the following steps.

1. Decide which logged on user you want to pick on, there could be more than one. I would identify them using a process, e.g. the explorer process.
2. Call OpenProcessToken() passing the process handle. Make sure you specify TOKEN_DUPLICATE.
3. Call DuplicateToken() to get an impersonation token.
4. Call CheckTokenMembership() as before but passing the token rather than NULL.
5. Tidy up!