How to check if every users on the system has administrator rights in C#

Question

I have a list of users created in my system:

• Administrator (by default)
• Guest
• User1 (Standard User)
• User2 (Administrator User)

I want to know the rights given to all these users in C# through WMI ,how is this possible??Is there any other way to find them. Even If one user has this right it must exit from the loop

I use the below code :

WindowsIdentity identity = WindowsIdentity.GetCurrent();
WindowsPrincipal principal = new WindowsPrincipal(identity);
bool isAdmin = principal.IsInRole(WindowsBuiltInRole.Administrator);
if (isAdmin == true)
{
    current_logged_user = "Yes";
}
else
{
    current_logged_user = "No";
}

This gives me only the currently logged info,but I need for all the users

link

The below link just give the members of administrartors link

Answer 1

You can try this:

bool IsInGroup(string user, string group)
{
    using (var identity = new WindowsIdentity(user))
    {
        var principal = new WindowsPrincipal(identity);
        return principal.IsInRole(group);
    }
}

You can change IsInRole(group) to IsInRole(WindowsBuiltInRole.Administrator)

Do you have a domain server ?

Answer 2

You should be able to return all users via WMI with

        string groupNameToSearchFor = "Administrators"; // can be any group,maybe better to use something like builtin.administrators

        using (PrincipalContext pc = new PrincipalContext(ContextType.Machine, null))
        {
            ManagementObjectSearcher usersSearcher = new ManagementObjectSearcher(@"SELECT * FROM Win32_UserAccount");
            ManagementObjectCollection users = usersSearcher.Get();

            foreach (ManagementObject user in users)
            {
                if ((bool)user["LocalAccount"] == true && int.Parse(user["SIDType"].ToString()) == 1)
                {
                    var userPrincipal = UserPrincipal.FindByIdentity(pc, IdentityType.SamAccountName, user["Name"].ToString());
                    GroupPrincipal gp = GroupPrincipal.FindByIdentity(pc, groupNameToSearchFor);
                    MessageBox.Show("Is User admin? -> " + (bool)userPrincipal.IsMemberOf(gp));

                }
            }
        }

You have to include the usings for

using System.DirectoryServices.AccountManagement;
using System.Management;

And also check if the user is really a user and not a different object (not sure if my checks are enough).

---

Edit: you can cast the users you need after you got the list with

        var localUsers = users.Cast<ManagementObject>().Where(
            u => (bool)u["LocalAccount"] == true &&
                 (bool)u["Disabled"] == false &&
                 (bool)u["Lockout"] == false &&
                 int.Parse(u["SIDType"].ToString()) == 1 &&
                 u["Name"].ToString() != "HomeGroupUser$");