src/Helpers.c
bool IsUserInAdminGroup()
{
  BOOL fInAdminGroup = FALSE;
  HANDLE hToken = NULL;
  HANDLE hTokenToCheck = NULL;

  Globals.dwLastError = ERROR_SUCCESS;
  const WCHAR* pLastErrMsg = L"";

  do {
    // Open the primary access token of the process for query and duplicate.
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &hToken))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"OpenProcessToken()";
      break;
    }

    DWORD cbSize = 0;

    // Determine token type: limited, elevated, or default. 
    TOKEN_ELEVATION_TYPE elevType;
    if (!GetTokenInformation(hToken, TokenElevationType, &elevType, sizeof(elevType), &cbSize))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"GetTokenInformation()";
      break;
    }

    // If limited, get the linked elevated token for further check.
    if (TokenElevationTypeLimited == elevType)
    {
      if (!GetTokenInformation(hToken, TokenLinkedToken, &hTokenToCheck, sizeof(hTokenToCheck), &cbSize))
      {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"GetTokenInformation()";
        break;
      }
    }

    // CheckTokenMembership requires an impersonation token. If we just got a 
    // linked token, it already is an impersonation token.  If we did not get 
    // a linked token, duplicate the original into an impersonation token for 
    // CheckTokenMembership.
    if (!hTokenToCheck)
    {
      if (!DuplicateToken(hToken, SecurityIdentification, &hTokenToCheck))
      {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"DuplicateToken()";
        break;
      }
    }

    // Create the SID corresponding to the Administrators group.
    BYTE adminSID[SECURITY_MAX_SID_SIZE];
    cbSize = sizeof(adminSID);
    if (!CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID, &cbSize))
    {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"CreateWellKnownSid()";
        break;
    }

    // Check if the token to be checked contains admin SID.
    // http://msdn.microsoft.com/en-us/library/aa379596(VS.85).aspx:
    // To determine whether a SID is enabled in a token, that is, whether it 
    // has the SE_GROUP_ENABLED attribute, call CheckTokenMembership.
    if (!CheckTokenMembership(hTokenToCheck, &adminSID, &fInAdminGroup))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"CheckTokenMembership()";
      break;
    }

  } while (false); // Centralized cleanup for all allocated resources.

  if (hToken)
  {
    CloseHandle(hToken);
    hToken = NULL;
  }
  if (hTokenToCheck)
  {
    CloseHandle(hTokenToCheck);
    hTokenToCheck = NULL;
  }

  if (Globals.dwLastError != ERROR_SUCCESS) {
    MsgBoxLastError(pLastErrMsg, Globals.dwLastError);
  }

  return fInAdminGroup;
}
//=============================================================================
//
//   IsUserInAdminGroup()
//
//   PURPOSE: The function checks whether the primary access token of the 
//   process belongs to user account that is a member of the local 
//   Administrators group, even if it currently is not elevated.
//
//   RETURN VALUE: Returns TRUE if the primary access token of the process 
//   belongs to user account that is a member of the local Administrators 
//   group. Returns FALSE if the token does not.
//
//
//
IsUserInAdminGroup()
PURPOSE: The function checks whether the primary access token of the
process belongs to user account that is a member of the local
Administrators group, even if it currently is not elevated.

RETURN VALUE: Returns TRUE if the primary access token of the process
belongs to user account that is a member of the local Administrators
group. Returns FALSE if the token does not.
IsUserInAdminGroup () PURPOSE : The function checks whether the primary access token of the process belongs to user account that is a member of the local Administrators group even if it currently is not elevated . RETURN VALUE : Returns TRUE if the primary access token of the process belongs to user account that is a member of the local Administrators group . Returns FALSE if the token does not .
bool IsUserInAdminGroup()
{
  BOOL fInAdminGroup = FALSE;
  HANDLE hToken = NULL;
  HANDLE hTokenToCheck = NULL;
  Globals.dwLastError = ERROR_SUCCESS;
  const WCHAR* pLastErrMsg = L"";
  do {
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &hToken))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"OpenProcessToken()";
      break;
    }
    DWORD cbSize = 0;
    TOKEN_ELEVATION_TYPE elevType;
    if (!GetTokenInformation(hToken, TokenElevationType, &elevType, sizeof(elevType), &cbSize))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"GetTokenInformation()";
      break;
    }
    if (TokenElevationTypeLimited == elevType)
    {
      if (!GetTokenInformation(hToken, TokenLinkedToken, &hTokenToCheck, sizeof(hTokenToCheck), &cbSize))
      {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"GetTokenInformation()";
        break;
      }
    }
    if (!hTokenToCheck)
    {
      if (!DuplicateToken(hToken, SecurityIdentification, &hTokenToCheck))
      {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"DuplicateToken()";
        break;
      }
    }
    BYTE adminSID[SECURITY_MAX_SID_SIZE];
    cbSize = sizeof(adminSID);
    if (!CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID, &cbSize))
    {
        Globals.dwLastError = GetLastError();
        pLastErrMsg = L"CreateWellKnownSid()";
        break;
    }
    if (!CheckTokenMembership(hTokenToCheck, &adminSID, &fInAdminGroup))
    {
      Globals.dwLastError = GetLastError();
      pLastErrMsg = L"CheckTokenMembership()";
      break;
    }
  } while (false); 
  if (hToken)
  {
    CloseHandle(hToken);
    hToken = NULL;
  }
  if (hTokenToCheck)
  {
    CloseHandle(hTokenToCheck);
    hTokenToCheck = NULL;
  }
  if (Globals.dwLastError != ERROR_SUCCESS) {
    MsgBoxLastError(pLastErrMsg, Globals.dwLastError);
  }
  return fInAdminGroup;
}
bool IsUserInAdminGroup ( ) { BOOL fInAdminGroup = FALSE ; HANDLE hToken = NULL ; HANDLE hTokenToCheck = NULL ; Globals . dwLastError = ERROR_SUCCESS ; const WCHAR * pLastErrMsg = L" " ; do { if ( ! OpenProcessToken ( GetCurrentProcess ( ) , TOKEN_QUERY | TOKEN_DUPLICATE , & hToken ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } DWORD cbSize = 0 ; TOKEN_ELEVATION_TYPE elevType ; if ( ! GetTokenInformation ( hToken , TokenElevationType , & elevType , sizeof ( elevType ) , & cbSize ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } if ( TokenElevationTypeLimited == elevType ) { if ( ! GetTokenInformation ( hToken , TokenLinkedToken , & hTokenToCheck , sizeof ( hTokenToCheck ) , & cbSize ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } } if ( ! hTokenToCheck ) { if ( ! DuplicateToken ( hToken , SecurityIdentification , & hTokenToCheck ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } } BYTE adminSID [ SECURITY_MAX_SID_SIZE ] ; cbSize = sizeof ( adminSID ) ; if ( ! CreateWellKnownSid ( WinBuiltinAdministratorsSid , NULL , & adminSID , & cbSize ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } if ( ! CheckTokenMembership ( hTokenToCheck , & adminSID , & fInAdminGroup ) ) { Globals . dwLastError = GetLastError ( ) ; pLastErrMsg = L" " ; break ; } } while ( false ) ; if ( hToken ) { CloseHandle ( hToken ) ; hToken = NULL ; } if ( hTokenToCheck ) { CloseHandle ( hTokenToCheck ) ; hTokenToCheck = NULL ; } if ( Globals . dwLastError != ERROR_SUCCESS ) { MsgBoxLastError ( pLastErrMsg , Globals . dwLastError ) ; } return fInAdminGroup ; }
IsUserInAdminGroup()
PURPOSE: The function checks whether the primary access token of the
process belongs to user account that is a member of the local
Administrators group, even if it currently is not elevated.
IsUserInAdminGroup () PURPOSE : The function checks whether the primary access token of the process belongs to user account that is a member of the local Administrators group even if it currently is not elevated .
// Open the primary access token of the process for query and duplicate. // Determine token type: limited, elevated, or default.  // If limited, get the linked elevated token for further check. // CheckTokenMembership requires an impersonation token. If we just got a  // linked token, it already is an impersonation token.  If we did not get  // a linked token, duplicate the original into an impersonation token for  // CheckTokenMembership. // Create the SID corresponding to the Administrators group. // Check if the token to be checked contains admin SID. // http://msdn.microsoft.com/en-us/library/aa379596(VS.85).aspx: // To determine whether a SID is enabled in a token, that is, whether it  // has the SE_GROUP_ENABLED attribute, call CheckTokenMembership. // Centralized cleanup for all allocated resources.