Determining Admin Access via the CLI

myITforum.com Community Forum

Home Forums Blogs Live Support chat Search Articles Wiki FAQ Email Lists Register Login My Profile Inbox Address Book My Subscription My Forums

Photo Gallery Member List Search Calendars FAQ Ticket List Log Out

All Forums RSS Feed Subscription:

Determining Admin Access via the CLI

View related threads: (in this forum | in all forums)

Logged in as: Guest

Printable Version

All Forums >> [Scripting Technologies] >> Batch >> Determining Admin Access via the CLI

Page: [1]

Message

<< Older Topic Newer Topic >>

Determining Admin Access via the CLI - 5/9/2008 9:20:04 AM

ndaniels

Posts: 145
Score: 26
Joined: 2/24/2006
From: The Republic of Elbonia
Status: offline

I'm looking for ideas on an easy way to determine if the user running my batch file is a local administrator (in a domain environment). For a non-domain environment, I figured I could probably just do something like this...

net localgroup administrators|find /i "%USERNAME%"

...And then check for the error level. The problem I have is that, in a domain environment, the "Administrators" local group may also consist of global groups (like "Domain Admins") and, therefore, the user ID would not actually appear in the "Administrators" local group.

I'd also like to do this without making changes to the file system, if possible. For example: I thought about attempting to create a text file inside the System32 folder and then checking for its existence; however, "Power Users" also have the ability to create files there.

For some reason, I'm just drawing a blank. If anyone has any thoughts or ideas, I'd love to hear them. Thanks!

Post #: 1

RE: Determining Admin Access via the CLI - 5/9/2008 12:51:02 PM 1 votes

mcampbell926

Posts: 19
Score: 2
Joined: 5/3/2005
Status: offline

Here's something 'out of the box' that you could try. From the command line, issuing defrag /? will give an errorlevel > 0 if the user executing the script does not have administrative rights. I'm relatively sure an errorlevel > 0 will occur if the user is a Power User, as defragging the drive requires absolute administrative rights.

I hope this unusual solution assists you.

(in reply to ndaniels)

Post #: 2

RE: Determining Admin Access via the CLI - 5/9/2008 10:02:21 PM

ndaniels

Posts: 145
Score: 26
Joined: 2/24/2006
From: The Republic of Elbonia
Status: offline

Excellent suggestion! Thanks! What's strange is that, even when the command is executed as an administrator and the help screen is displayed, the error level is still not zero...

On Vista:
User: errorlevel = 740
Administrator: errorlevel = 87

I haven't had the opportunity to fully test on Windows XP, yet, but will follow up when I have the chance. Thanks again!

(in reply to mcampbell926)

Post #: 3