How to check admin rights C#

Question

How to check is my application starts with admin rights? I use this code now:

public static bool IsUserAdministrator()
        {
            //bool value to hold our return value
            bool isAdmin;
            try
            {
                //get the currently logged in user
                WindowsIdentity user = WindowsIdentity.GetCurrent();
                WindowsPrincipal principal = new WindowsPrincipal(user);
                isAdmin = principal.IsInRole(WindowsBuiltInRole.Administrator);
            }
            catch (UnauthorizedAccessException ex)
            {
                isAdmin = false;
            }
            catch (Exception ex)
            {
                isAdmin = false;
            }
            return isAdmin;
        }

This code checks user rights, I need to check the rights that application has. For example, I'm not the administrator but when the application starts with admin rights this code returns false. Thanks!

possible duplicate of [How can I tell if my process is running As Administrator?](http://stackoverflow.com/questions/509292/how-can-i-tell-if-my-process-is-running-as-administrator) — msarchet, Sep 26 '11 at 14:04
Cannot see a reason to catch `UnauthorizedAccessException` it's equal to `Exception` — WhileTrueSleep, Jul 23 '14 at 08:23

score 2 · Accepted Answer · edited May 06 '22 at 08:41

That's the correct approach to performing the check, I use it myself in my PowerShell profile to distinguish elevated sessions.

I suspect you're not taking into account the effect of User Access Control (UAC). When a user logs in they get a security token object allocated. This contains both their own security id (SID), the SIDs of groups they belong to and a list of privileges they have (and whether those privileges are enabled).

With UAC enabled, when you do an interactive login if you have certain privileges or are a member of the local administrators you get two tokens: one with everything and a second with administrative access SIDs and privileges removed. The latter token is used with each launched process, unless launched elevated when the former token is used.

Thus an administrator cannot exercise their full power without an extra step – this helps prevent malware from being started with full control of the system.

The best tool for seeing this in action is Process Explorer. The Security tab of the process properties dialogue shows the contents of the process's security token (and adding the "Integrity Level" column to the main display will show what processes are elevated) – run Process Explorer elevated to see the full information.

So your code will only return true for a process run by an administrator that is also elevated (run as administrator).

How to check admin rights C#

1 Answers1

Linked