Missing Group Built-in Administrators (SID: S-1-5-32-544) in HttpContext.User.Identity

Question

I am using windows authentication and want to know if an logged in user belongs to the group 'Built-in Administrators'. I am using the following code snipped to find that out in my MVC4-Application:

   // user identity
    var lIdentity = HttpContext.User.Identity as WindowsIdentity;

    // get all Group-Sids, the current users belongs to.
    var lSids = lIdentity.Groups;

The group Built-in Administrators (SID S-1-5-32-544) is not listed in lSids .

But when I use the cmd whoami /groups on the same user, it shows the SID S-1-5-32-544.

How can I find out in my MVC4, if an logged-in user belongs to the Build-In Administrators group.

Answer 1

You can achieve that by accessing Claims instead of Groups.

Here is how to do that:

var claims = lIdentity.Claims;
var claimSids = claims.Select(claim => claim.Value).ToList();