From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mout.gmx.com (mout.gmx.com [74.208.4.201]) by sourceware.org (Postfix) with ESMTPS id 9D4DB3858C53 for ; Thu, 24 Aug 2023 18:46:48 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9D4DB3858C53 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=iname.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=iname.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=iname.com; s=s1089575; t=1692902807; x=1693507607; i=bstewart@iname.com; bh=7KoUl62pd0ooLclg4r0X6wBmkzlQVod5Zg4e7WN/NAo=; h=X-UI-Sender-Class:References:In-Reply-To:From:Date:Subject:To; b=FEg6UvwN7zTy8VZRC7Gm6AjlNfMfbMqm2YC8VO6NYssDWFLkam/wUAibA2X/KhE5Eeco4wZ wD/zdw4tlRlwssIBkWArr1vt3bXtwPYosgZjGxGAzch6ZwlgKjSACC0KfpZBXEdNBaLFVoJHX arokJSTLi7AWA2ZjQTck3oDlJDXVAYjr8MkbS/GWidp+ro5x9djZApoGb8B8ADCUsqIY+z/mb jy6dpj+YIXgyouMlt6Qn+WPOBP3jVI/ELALBUnHunO05y+is/Npt+lkuB/Ut2Y1rtEEg/5nuf d3m78C+CtPrSMiCitsT0voaKMetp2zAKBUEVNZoLYCI6iFu16C3w== X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a Received: from mail-lf1-f50.google.com ([209.85.167.50]) by smtp.mail.com (mrgmxus004 [74.208.5.15]) with ESMTPSA (Nemesis) id 0MU06J-1q8bhO1L0L-00Qg0s for ; Thu, 24 Aug 2023 20:46:47 +0200 Received: by mail-lf1-f50.google.com with SMTP id 2adb3069b0e04-500913779f5so166973e87.2 for ; Thu, 24 Aug 2023 11:46:46 -0700 (PDT) X-Gm-Message-State: AOJu0YyQLGYW8bfcYRE4ItDOtAbO8plYTpy4AyksSl06Wx4YWFf7j7od Rnl1oZ8r38YTcTHIoxaCjoSUQj3DNj8ri6RtWuk= X-Google-Smtp-Source: AGHT+IF5D0WFOqWwUQlCbY0X6uBCjbr5ALyH8tczSq2lh0Vsd+1TFraVtPq7FK/nPFpXWYnhCin8xXk5brVoapKX7HE= X-Received: by 2002:a05:6512:2092:b0:500:9a15:9054 with SMTP id t18-20020a056512209200b005009a159054mr3383996lfr.20.1692902805616; Thu, 24 Aug 2023 11:46:45 -0700 (PDT) MIME-Version: 1.0 References: <74leei1djvvgnbtvrkpctgnp9jc2kqtsjf@4ax.com> In-Reply-To: From: Bill Stewart Date: Thu, 24 Aug 2023 12:46:19 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: Test for Windows Administrator permissions from Cygwin terminal|script? To: cygwin@cygwin.com Content-Type: multipart/alternative; boundary="0000000000005e3f110603afa604" X-Provags-ID: V03:K1:qlbi6w1B6zHULWWfDkJembE6hb86AKw5dPozVFWpP37bzAqza5f fv3e3n8s7p6KzDUmcJnF+XUOYMn30Yn3ex/6L7wvsJaFKeJ0wKHrjzbw8zTO61H4s5yTdXG Ga8l3eX9svTUi2N0+DU2OAkq+B8q5Ul8e4ZxJ88c/p72YmQtXfwdf27zBX+yKlFh13sayU/ mWtiQGQNopKc+xF6fY98Q== UI-OutboundReport: notjunk:1;M01:P0:48lyqp1outU=;Pw3jYUTiIRKmLnWCe3+ixb++lZL 45VVtRTwLLvmDTSsY+ZecYPeYn+j4G3wG4MT/w0iYbVIuS+ak/JybF6potLWtLQPDJMt4xK+Q uT+k1D6jwzJweM0Bs2nQkdHwTFnL6is1chTa6InkrdruuMakacLJgRcRbK7vsHHZ9FDM7+qEi KRtBTEbBevXjbElBagJs0QcwfgfvBaBHC91USuwsObw9CYogd5PRn5qJoa9DPnH331ijBzuai /SFp3l0IRc6yBDYfPnlfWbCAbB22/vpHQ0QOrJdjOyy3t66Xtou2gDBaq12n+x6E7yF/0cneo /bl+kIbX036hH0tNCb7gemksMowBUnBLuGBd8kXnnnsZRcNI+f7uhtG+JHD9xuH8h+16PYsbY 35wSTCU0Cr0Z31rF5Aj24mua/V3VGOD/eLPnD44Hp23V9gTAQXQSfctjZUyWWGahbHnsiq+fR GOhnwVQnqrusIGSLi41Ee0Y0Jpho93FjxqebfRS+nPJl4CE7KAiz08Lxlyi2f70JTBO333bWW mJi5n0BRuukV6wOBdtihjuTjiXwUHDvNMiE314PlCGUrB443D3hwYCCwCxnkqlLsiQIAU/I4y kL2MBcHCI4cj+7WkQ/FVmlT5CknwRG0QzDII+E1I6pXrQzkzZDTBSrrTdFZ2KopBbPefRU77J Vzby2Z+TNk6021vRNGRjTLj5roInu7JAcPIhPQlidRA7uvoSYBhozycpURc0WxMjTHT01a1IU Pnfk/dNk0GYTsAg1VtsAt2NRWGWBf6YxORHRCybFFURhu5j1ZlHdWlHrtxEgh8LA1+Y30sNB1 2FytDtH19uj8eGby7o9+a4oxQYuhd/ekPRelWwI+wIAjA9zcevspmJaDIFD+0CTATdIqep6g2 UFL3vQYHoKgsDKKU2qmy52FT9Cu2lCzH7+a1wDKAro/CNaweGfzBd/7Z/VZOsLhW8TW4xUrBk 2FdwDVVBkSsBTLmvMXLBC7NhDh0= X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: --0000000000005e3f110603afa604 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 24, 2023 at 8:52=E2=80=AFAM Bill Stewart wrote: On Thu, Aug 24, 2023 at 7:01=E2=80=AFAM Andrew Schulman wrote: > > > How can I find out whether the current Cygwin terminal has >> > Administrator rights? I want to safeguard our admin scripts with a >> > simple test and bail out with an error if someone wants to do admin >> > stuff (say: regtool) without admin privileges. >> >> >> https://superuser.com/questions/660191/how-to-check-if-cygwin-mintty-bas= h-is-run-as-administrator/874615#874615 >> > > This answer may be misleading. For example, when I log on using an account > that's a member of Administrators, my account is a member of the group, b= ut > the Administrators group token is not enabled. For example, if I log on as > a member of the Administrators group and open a PowerShell window, I can > run the following, and it will output the local Administrators group (the= re > will be no output if the account is not a member of Administrators): > > PS C:\> whoami /groups /fo csv | ConvertFrom-Csv | Where-Object { $_.SID > -eq "S-1-5-32-544" } > > That is, while it is true that the process is a member of the > Administrators group, the group isn't enabled, so the process isn't > actually running with administrative permissions. In Windows-speak we wou= ld > say the process isn't "elevated" ("elevated" =3D "running with administra= tive > permissions"). In other words, logging on as a member of Administrators > doesn't mean that processes you start are elevated. > > IME, what is normally being asked for is whether the current process is > elevated (i.e., the group is both present and enabled). The usual Windows > API way to check this is the CheckTokenMembership() function: > > > https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-se= curitybaseapi-checktokenmembership > > In that reference: "The CheckTokenMembership function simplifies the > process of determining whether a SID is both present and enabled in an > access token." > > As an example, I wrote a little Windows program called 'elevate' that has > a '-t' option to test whether the current process is elevated: > > https://github.com/Bill-Stewart/elevate > To elaborate on the above, the cygwin 'id -G' command looks like it takes this into account and only outputs enabled group IDs. I should have checked this before I responded, of course. In other words, 'id -G' outputs a 544 in its list if the current process is elevated ("run as administrator"). The 544 won't be in there if the process is not elevated. I just tested from an elevated PowerShell console: PS C:\Windows\System32> ((id -G) -split ' ') -contains '544' True Sorry for any confusion. Bill --0000000000005e3f110603afa604--