1

I need to test the effective permissions of a specific user (i.e. not necessarily the current user) from within a batch script and take action (provide a warning) based on that. I'd like to have a subroutine I could call to check privileges against a specified file or directory so I could test that something only an administrator should be able to access (and thus warn that too high of permissions are granted) and check that data directories in my apps path can be accessed (otherwise too low of permissions). I'd like this to work in XP, 2008, and win7.

By the way, I have figured out how to parse "net localgroup Administrators", but I don't think this is sufficient for my needs.

Jared
  • 1,887
  • 3
  • 20
  • 45
  • 1
    I made a batch file (long time ago) to run a exe file but previously, detect if the file was running with admin privileges.. and if not, elevate automaticly to run the called file as admin. Maybe, you can use it and catch the %errorlevel% (if you cant elevate) to determinate if that user doesn't have admin rights... Let me know if you think that can help. (BTW, detects Win 95,NT,98,Me,2000,XP,2003,Vista and 7) – gmo Aug 22 '12 at 18:13
  • @gmo does your script do this progmatically and without user intervention? If so could you post it or the link to it? :) – Lizz Mar 01 '13 at 08:13
  • @Lizz Yeap... It does without user intervention...Let me find it and I will paste here ;-) – gmo Mar 04 '13 at 09:12

1 Answers1

2

@Jared,

For your needs, I think with a simple copy and %errorlevel% you can have what you want.

copy %tempFile% %yourProtectedDir%
if %errorlevel% == 1 goto sorryYouFail
if %errorlevel% == 0 goto youAreIn
...
del %tempFile% /Q

Or, to check for any user, do the same but with a windows protected folder...

copy %tempFile% %windir%\system32
if %errorlevel% == 1 goto youDontHaveAdminPrivileges
if %errorlevel% == 0 goto howdyThereAdmin
...
del %tempFile% /Q

If you need to test other user try with the runas option...

@Lizz

This script check windows version, and elevate a temporary file to run a specific one with ADMIN RIGHTS.

@echo off
title Detect and run file with Admin privileges

set yourFile=yourFileNameAsAdmin.bat
set privileges=no

VER | FINDSTR /IL "6.2." > NUL
IF %ERRORLEVEL% EQU 0 (
SET winVersion=8
SET privileges=yes
)

VER | FINDSTR /IL "6.1." > NUL
IF %ERRORLEVEL% EQU 0 (
SET winVersion=7
SET privileges=yes
)

VER | FINDSTR /IL "6.0." > NUL
IF %ERRORLEVEL% EQU 0 (
SET winVersion=Vista
SET privileges=yes
)

if "%privileges%"=="no" goto SkipElevation
If "%privileges%"=="yes" goto Elevation

:SkipElevation
call %CD%\%yourFile%
goto End

:Elevation
PushD "%~dp0"
If Exist "%~0.ELEVATED" Del /f "%~0.ELEVATED"

Set CMD_Args=%0 %*
Set CMD_Args=%CMD_Args:"=\"%
Set ELEVATED_CMD=PowerShell -Command (New-Object -com 'Shell.Application').ShellExecute('%yourFile%', '/%cd:~0,1% %CMD_Args%', '', 'runas')
Echo %ELEVATED_CMD% >> "%~0.ELEVATED"
call %ELEVATED_CMD%

Del /f "%~0.ELEVATED"
goto End

:End
Echo -------------------------------
Echo All done!
Pause
goto EOF

Note: If yourFileNameAsAdmin.bat use RELATIVE path to files, remember to enableextensions and the local dir at the beginning of the file:

@echo off
@setlocal enableextensions
@cd /d "%~dp0"
::...your code here

Hope that helps!...

As adition related info...

With the command net you get a lot of info about users and goups, and also can you work with them.

e.g.

NET USER

  • net users List off all users.
  • net users [name] Detail info about a specific user, including all the groups that he belongs.
  • net help users for more...

NET LOCALGROUP

  • net localgroup List all groups.
  • net localgroup [groupName] Detail info about a specific group, including all the users that belongs to that grup.
  • net help localgroup for more...
gmo
  • 8,860
  • 3
  • 40
  • 51