IsAdminUser 返回不正确的值

Question

I'm using Win32::IsAdminUser() function (Can't paste code because to make it runnable I would have to paste whole code). It returns 0, I was curious why because the user with which this is run is member of Administrators group, so I created a little test function (c++) and run it right before running IsAdminUser Here is the code:

int davai()
{
FILE * fp;

fp = fopen ("C:\\tmp\\davai.txt", "a");
fprintf(fp, "shevedi davai");
fflush(fp);

HANDLE token = NULL;
HANDLE dupToken = NULL;

if(!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &token))
{
  fprintf(fp, "davai: OpenProcessToken cheijva. %d\n", (int)GetLastError());
  fflush(fp);
}

if (DuplicateTokenEx(token, MAXIMUM_ALLOWED, NULL, SecurityDelegation,
                          TokenPrimary, &dupToken) == 0)
{
  fprintf(fp, "davai: OpenProcessToken DuplicateTokenEx. %d\n", (int)GetLastError());
  fflush(fp);
}

PTOKEN_GROUPS pPrivilegesToken = NULL;
DWORD cbSize = 0;

GetTokenInformation(dupToken, TokenGroups, NULL, 0, &cbSize);

pPrivilegesToken = (PTOKEN_GROUPS) LocalAlloc(LPTR, cbSize);

if (GetTokenInformation(dupToken, TokenGroups, 
                             pPrivilegesToken, cbSize, &cbSize) == FALSE)
{
  fprintf(fp, "davai: GetTokenInformation cheijva. %d\n", (int)GetLastError());
  fflush(fp);
}

char * gio;

for (ULONG i = 0; i < pPrivilegesToken->GroupCount; i++)
{
  if (ConvertSidToStringSid(pPrivilegesToken->Groups[i].Sid, &gio) == 0)
  {
    fprintf(fp, "davai: ConvertSidToStringSid cheijva. %d\n", (int)GetLastError());
    fflush(fp);
  }
 
  fprintf(fp, "Value: %s\n",gio);
  fflush(fp);
}

LocalFree (gio);

return 1;
}

which just opens current processes token, and lists all the groups that user is involved in. Here is the ouput I get:

shevedi davaiValue: S-1-5-21-1018819917-2920201817-244685803-513
Value: S-1-1-0
Value: S-1-5-21-1018819917-2920201817-244685803-1000
Value: S-1-5-32-544
Value: S-1-5-32-545
Value: S-1-5-4
Value: S-1-2-1
Value: S-1-5-11
Value: S-1-5-15
Value: S-1-5-5-0-179095
Value: S-1-2-0
Value: S-1-5-64-10
Value: S-1-16-12288

which is strange because S-1-5-32-544 represent Administrators group. I searched to find if someones has similar problem, but could not find anything (I'm running windows 7). Maybe you can help me. Any help would be appreciated.

Answer 1

which is strange because S-1-5-32-544 represent Administrators group.

really Win32::IsAdminUser() internally call CheckTokenMembership function with SidToCheck == S-1-5-32-544 and return you IsMember as result. but

If the SID is present and has the SE_GROUP_ENABLED attribute, IsMember returns TRUE; otherwise, it returns FALSE.

and

Even if a SID is present in the token, the system may not use the SID in an access check. The SID may be disabled or have the SE_GROUP_USE_FOR_DENY_ONLY attribute.

really if you user is member of admin group ( S-1-5-32-544 ) but run without elevation (under UAC ) S-1-5-32-544 is present in token but with SE_GROUP_USE_FOR_DENY_ONLY attribute only

in contrast elevated admins have this SID with SE_GROUP_ENABLED attribute

so i guess you run as not elevated admin. Win32::IsAdminUser() and must return false in this case

Answer 2

As documented in Win32 :

On Windows Vista it will only return non-zero if the process is actually running with elevated privileges.

I'd understand "Vista" as "Vista and newer".