Determining an administrator on Vista

I am using the techinque to get the TokenElevationType using the API
GetTokenInformation on Vista to determine if a user is an admin. It seems to
work fine on Vista Business/Ultimate etc. However, it fails on Vista Home.
Does anyone have any clues?

The code is along the following lines:

TOKEN_ELEVATION_TYPE elevationType;
DWORD dwSize;

GetTokenInformation(hUserToken, TokenElevationType, &elevationType,
sizeof(elevationType), &dwSize);

switch (elevationType)
{
case TokenElevationTypeDefault:
TRACE(_T("TokenElevationTypeDefault - User is not using a split token\n"));
m_bAdmin = FALSE;
break;

case TokenElevationTypeFull:
TRACE(_T("TokenElevationTypeFull - User has a split token, and the
process is running elevated\n"));
m_bAdmin = TRUE;
break;

case TokenElevationTypeLimited:
TRACE(_T("TokenElevationTypeLimited - User has a split token, but the
process is not running elevated\n"));
m_bAdmin = TRUE;
break;

}

Thanks.

First, when posting questions about a function that returns potential errors,

First, when posting questions about a function that returns potential
errors, include the error code. This function returns an error code that is
obtained by GetLastError. If you have not used GetLastError for this then if
you do use it for this you might have an answer. If the error code does not
immediately tell you what the problem is then search for GetTokenInformation
with the error code. You might need to convert the error code to a symbolic
name; look in winerror.h to do that. Or you might need to search the error
code with a "0x" prefix. Search the MSDN, and if that does not help, search
the Windows programming security group (Google groups might help) and if
that does not help search the internet.

Second, any time a question says something such as "doesn't work" or
I describe above.

Finally, this is not a programming group. You should ask in the Windows
programming security group.

How about this instead.

How about this instead. Right Click on my computer, click manage, local
users and groups, users, right click, properties, member of. If they are
in the administrators group they are an admin.

SuperXero
*'HackingManual.Net' (http://hackingmanual.net)*


--
SuperXero

You obviously are clueless about what I asked.

You obviously are clueless about what I asked. If you do not know, that is
fine but please do not waste everyone's time by responding with useless
messages.

Determining an administrator on Vista

http://www.developmentnow.com/groups/post.aspx?newsgroupid=21&threadid=851943

http://blogs.msdn.com/cjacks/archive/2006/10/09/How-to-Determine-if-a-User-is-a-Member-of-the-Administrators-Group-with-UAC-Enabled-on-Windows-Vista.aspx


If that doesn't answer it, contact Wang. (e-mail at end of post, first link)

to
token\n"));

Determining an administrator on Vista

http://blogs.msdn.com/cjacks/archive/2006/10/09/How-to-Determine-if-a-User-is-a-Member-of-the-Administrators-Group-with-UAC-Enabled-on-Windows-Vista.aspx

Maybe these guys can be more help.

So do you think this is a programmer's group?

So do you think this is a programmer's group?

The answer I gave is typical of answers given in the MSDN forums. It is very
normal for people in a programmer's forum to ask for details of "fails"; in
particular what does GetLastError return when it is relevant. If this
question were responded to by a Microsoft person, they would certainly ask
for that.

What in particular do you consider incorrect?

Al (the person asking the question) needs to do it in a program.

Al (the person asking the question) needs to do it in a program. If I am
incorrect about that then the source code is misleading. In programming
forums, when someone provides source code, they cannot use a "manual"
(non-automated) solution.

I get it sam, like if a program needs to validate someone as admin ornot admin.

I get it sam, like if a program needs to validate someone as admin or
not admin. Yep I am not a programmer just a network admin.


--
SuperXero

Yes, there you go; there are many reasons that might be done.

Yes, there you go; there are many reasons that might be done. Generally it
would be useful for issuing a message informing someone they need to have
Administrator privileges when they don't, instead of letting them proceed
and then get a more obscure crash message.