Detect Administrator account

Question

DelphiXe, Win7x64

How to define, that the user started the program starts it on behalf of system record of the Administrator of system (domain or local). The rights I define so:

Function IsUserAdmin:Bool;
Const 
  SECURITY_NT_AUTHORITY: TSIDIdentifierAuthority =(Value: (0, 0, 0, 0, 0, 5));
  SECURITY_BUILTIN_DOMAIN_RID = $00000020;
  DOMAIN_ALIAS_RID_ADMINS = $00000220;
Var 
  hAccessToken: THandle;
  ptgGroups: PTokenGroups; 
  dwInfoBufferSize: DWORD; 
  psidAdministrators: PSID; 
  x: Integer;
  bSuccess: BOOL;
begin
  Result := False;
  bSuccess := OpenThreadToken(GetCurrentThread, TOKEN_QUERY, True, hAccessToken);
  if not bSuccess then 
  begin
    if GetLastError = ERROR_NO_TOKEN then 
      bSuccess := OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hAccessToken);
  end;

  if bSuccess then 
  begin 
    GetMem(ptgGroups, 1024);
    bSuccess := GetTokenInformation(hAccessToken, TokenGroups, ptgGroups, 
                                    1024, dwInfoBufferSize);
    CloseHandle(hAccessToken);
    if bSuccess then 
    begin
      AllocateAndInitializeSid(SECURITY_NT_AUTHORITY, 2,
                               SECURITY_BUILTIN_DOMAIN_RID, 
                               DOMAIN_ALIAS_RID_ADMINS, 
                               0, 0, 0, 0, 0, 0, psidAdministrators);
      {$R-}
      for x := 0 to ptgGroups.GroupCount-1 do 
        if EqualSid(psidAdministrators, ptgGroups.Groups[x].Sid) then 
        begin 
          Result := True;
          Break;
        end;
      {$R+}
      FreeSid(psidAdministrators);
    end;
    FreeMem(ptgGroups);
  end;
end;

But it only defines an accessory of the user to group of administrators. How to define, what exactly from under the accounting record "Administrator" goes start (taking into account what the record name can be changed (the account is renamed, example "Admin")?

P.S. It is all to that if the user starting the application is in group administrator at inclusion Windows UAC at it start on behalf of the Administrator will be all the same requested.

So it is necessary for me:

To learn, that the user which starts the program is in group of managers (local or domain) is as works
Start is made on behalf of the system accounting record the "Administrator" (can and renamed), instead of the created new user with the rights of the administrator

[UPDATE]

Once again, in another way. We will admit, in system there are some accounts: Administrator (a system account of the administrator by default), User1 (consists in group "Administrators", the new created account), User2 (consists in group "Users", the new created account). For any reasons, system account "Administrator" is renamed in "Admin" (or into any other name). There is my application. It is started by different users. As to me to establish, that the user who starts my application, is the administrator of system (Admin). Because for Windows UAC the rights for start from User1 and Admin will differ - also question UAC will appear only if the application starts User1, and if Admin - message UAC will not appear. Here a question: how to define, what the user who has started the application = Admin (old name Administrator), in other words the user and is the administrator of system?

Need:

Function GetCurrentUserName:string;
begin
... detect current user name
end;

Function isCurrentUserisAdministratorPC:bool; 
begin
// ??? Result:=isUserPCAdmin(GetCurrentUserName);
end;

// uses

User1 start program: isCurrentUserisAdministratorPC return False;

User2 start program: isCurrentUserisAdministratorPC return False;

Admin start program: isCurrentUserisAdministratorPC return TRUE; //!!!

rename account Admin to Test123.

Test123 start program: isCurrentUserisAdministratorPC return TRUE; //!!!

What do you want to accomplish by detecting the user privileges? — Jens Mühlenhoff, Aug 17 '11 at 10:28

score 2 · Accepted Answer · edited May 23 '17 at 12:11

2

That code checks if the user is a member of the Administrators group. Someone can be a member of the Administrators group, but not have any administrator privelages.

You want to know if the user actually has administrator privelages. i answered this already here.

edited May 23 '17 at 12:11

Community

1
1

answered Aug 15 '11 at 02:49

Ian Boyd

246,734
253
869
1,219

score 0 · Answer 2 · answered Sep 06 '11 at 20:10

Has found. By means of NetUserEnum (http://msdn.microsoft.com/en-us/library/aa370652(VS.85).aspx) at level=1 at the built in record the flag 66049 (or 66051 if it is disconnected) will come back.

Ian Boyd: That code checks if the user is a member of the Administrators group. Someone can be a member of the Administrators group, but not have any administrator privelages.

If it is included Windows UAC that members of group of Admins for reception of the rights at first should confirm it in an emerging window of the message from UAC (it is by default included in local and group politicians Windows). Local record of the Administrator of the personal computer - does not require such actions.

And yes, it's also detected "IsUserAnAdmin" function.

if IsUserAnAdmin then Showmessage('Admin') else Showmessage('Not Admin, or UAC enabled');

Detect Administrator account

2 Answers2