我如何檢查我的程序是否以用戶身份作爲管理員運行（Vista/Win7，C++）

Question

我看到了IsInRole方法，但找不到有關如何將它與C++一起使用的信息。

Answer 1

從CodePlex上的UACHelpers項目取得的this old answer中有一個C++代碼片段。

Answer 2

你可以試試這段代碼。它給出了需要做什麼樣的草圖：

const HANDLE hProcess = GetCurrentProcess(); 
if (hProcess==NULL) 
    return FAILURE; 

HANDLE hToken; 
const BOOL lR = OpenProcessToken(hProcess, TOKEN_QUERY, &hToken); 
if (lR == NULL) 
    return FAILURE; 

PSID psidAdministrators; 
SID_IDENTIFIER_AUTHORITY x = SECURITY_NT_AUTHORITY; 
if (!AllocateAndInitializeSid(
    &x, 2, 
    SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, 
    &psidAdministrators)) 
    return FAILURE; 

bool isAdmin = false; //dummy init 
DWORD size; 
GetTokenInformation(hToken, TokenGroups, NULL, 0, &size); 
char* buffer = new char[size]; 
DWORD notUsed; 
if (!GetTokenInformation(hToken, TokenGroups, (void*)buffer, size, &notUsed)) 
    return FAILURE; 

TOKEN_GROUPS* ptgGroups = (TOKEN_GROUPS*)buffer; 
isAdmin = false; //until proven otherwise 
for (UINT32 i=0; i<ptgGroups->GroupCount; ++i) 
{ 
    if (EqualSid(psidAdministrators, ptgGroups->Groups[i].Sid)) 
    { 
     isAdmin = true; 
     break; 
    } 
} 

FreeSid(psidAdministrators); 
return isAdmin; 

Answer 3

的IsUSerAnAdmin文檔解釋了它，因爲Vista的過時，但您指出CheckTokenMembership。這應該爲你做好這份工作。

Answer 4

此代碼可解決您的問題。隨意使用它。它適用於SE_GROUP_USE_FOR_DENY_ONLY。

/** 
    IsGroupMember determines if the current thread or process has a token that contais a given and enabled user group. 

    Parameters 
    dwRelativeID: Defines a relative ID (par of a SID) of a user group (e.g. Administrators DOMAIN_ALIAS_RID_ADMINS (544) = S-1-5-32-544) 
    bProcessRelative: Defines whether to use the process token (TRUE) instead of the thread token (FALSE). If FALSE and no thread token is present 
    the process token will be used though. 
    bIsMember: Returns the result of the function. The value returns TRUE if the user is an enabled member of the group; otherwise FALSE. 

    Return Value 
    If the function succeeds, the return value is TRUE; otherwise FALSE. Call GetLastError for more information. 
*/ 
BOOL IsGroupMember(DWORD dwRelativeID, BOOL bProcessRelative, BOOL* pIsMember) 
{ 
    HANDLE hToken, hDupToken; 
    PSID pSid = NULL; 
    SID_IDENTIFIER_AUTHORITY SidAuthority = SECURITY_NT_AUTHORITY; 

    if (!pIsMember) 
    { 
     SetLastError(ERROR_INVALID_USER_BUFFER); 
     return FALSE; 
    } 

    if (bProcessRelative || !OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_DUPLICATE, TRUE, &hToken)) 
    { 
     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &hToken)) 
     { 
      return FALSE; 
     } 
    } 

    if (!DuplicateToken(hToken, SecurityIdentification, &hDupToken)) 
    { 
     CloseHandle(hToken); 
     return FALSE; 
    } 

    CloseHandle(hToken); 
    hToken = hDupToken; 

    if (!AllocateAndInitializeSid(&SidAuthority, 2, 
      SECURITY_BUILTIN_DOMAIN_RID, dwRelativeID, 0, 0, 0, 0, 0, 0, 
      &pSid)) 
    { 
     CloseHandle(hToken); 
     return FALSE; 
    } 

    if (!CheckTokenMembership(hToken, pSid, pIsMember)) 
    { 
     CloseHandle(hToken); 
     FreeSid(pSid); 

     *pIsMember = FALSE; 
     return FALSE; 
    } 

    CloseHandle(hToken); 
    FreeSid(pSid); 

    return TRUE; 
} 

BOOL IsUserAdministrator(BOOL* pIsAdmin) 
{ 
    return IsGroupMember(DOMAIN_ALIAS_RID_ADMINS, FALSE, pIsAdmin); 
}