title: How to determine the integrity level of a process?
body: <p>I recently needed to get the integrity level of a process, and I found help from MSDN. The sample code looks like this:</p>
  <pre><code>if (GetTokenInformation(hToken, TokenIntegrityLevel, 
       pTIL, dwLengthNeeded, &amp;dwLengthNeeded))
   {
    dwIntegrityLevel = *GetSidSubAuthority(pTIL-&gt;Label.Sid, 
      (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL-&gt;Label.Sid)-1));
  
    if (dwIntegrityLevel == SECURITY_MANDATORY_LOW_RID)
    {
     // Low Integrity
     wprintf(L&quot;Low Process&quot;);
    }
    else if (dwIntegrityLevel &gt;= SECURITY_MANDATORY_MEDIUM_RID &amp;&amp; 
         dwIntegrityLevel &lt; SECURITY_MANDATORY_HIGH_RID)
    {
     // Medium Integrity
     wprintf(L&quot;Medium Process&quot;);
    }
    else if (dwIntegrityLevel &gt;= SECURITY_MANDATORY_HIGH_RID)
    {
     // High Integrity
     wprintf(L&quot;High Integrity Process&quot;);
    }
    else if (dwIntegrityLevel &gt;= SECURITY_MANDATORY_SYSTEM_RID)
    {
     // System Integrity
     wprintf(L&quot;System Integrity Process&quot;);
    }
   }
  </code></pre>
  <p>As you all know,</p>
  <pre><code>SECURITY_MANDATORY_LOW_RID == 0x00001000L
  SECURITY_MANDATORY_MEDIUM_RID == 0x00002000L
  SECURITY_MANDATORY_HIGH_RID == 0x00003000L
  SECURITY_MANDATORY_SYSTEM_RID == 0x00004000L.
  </code></pre>
  <p><strong>Here is my question:</strong><br />
  If this sample code is correct, then what integrity level does process A have if it has the <code>dwIntegrityLevel</code> of <code>0x00004100L</code>? <code>SECURITY_MANDATORY_HIGH_RID</code> and <code>SECURITY_MANDATORY_SYSTEM_RID</code>? Does it mean that a process that has the <code>SECURITY_MANDATORY_SYSTEM_RID</code> level also has the <code>SECURITY_MANDATORY_HIGH_RID</code> level?</p>
  <p>If the sample code is wrong, then what is the right way to determine the integrity level of a process?</p>