DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8460A3858C1F
MIME-Version: 1.0
References: <CANH4o6OpsvT99AeJ2uTcqyajWQHmffYJqV=RR4HBxoFaveR7sQ@mail.gmail.com>
 <87cyzj4fep.fsf@Rainer.invalid>
In-Reply-To: <87cyzj4fep.fsf@Rainer.invalid>
Date: Sat, 19 Aug 2023 11:33:58 -0600
Message-ID: <CANV9t=SzZXU-1xt8XXfyrhqU0nyWv_G0v527mUsmnF3ANL28yg@mail.gmail.com>
Subject: Re: Test for Windows Administrator permissions from Cygwin
 terminal|script?
To: cygwin@cygwin.com
UI-OutboundReport: notjunk:1;M01:P0:0Dkt8YDEJlM=;GYzMb9o53AVAOnJlszKBrF+7ClA
 QP8BO9jvhCWNfZPlz91ROjBMeWa90r2OhVYuALa0QQ27ItlpEBJkPTcFTWc9QX3PZXXfWzu6O
 BUjRojPqm12wyg34kfoB5iGrX98TKOwnt/7HhOT/x6Ifp5fVX4VH2LhX0P4I/se2EPvubqVyy
 WC06iIKuEi3VBdwkbtSuO8n1ZzVGghizgth0L4Sw6UsD308UIrZNxab/W+AcUsG25s5BJBWYD
 QGANREuQSNta1tk2TatIT0d5FD51ble7bJNaESp1Ji2wRupcqnWu4zu4Fbo/gYDqdJkPdAMvC
 p+zPK7nMYwiGWUfhhxwaI/ayio8g2yhewLUuUeVmM3mmzeCnpMVa7ETubT5TAISg/9pPHCIcs
 obebFJDIPppsfsd4s8dPOhCRQwIDqtyqHykVw4agKble1mnTtjEYfRHuaOIZUh7Q2Iv4yGIZQ
 VX0o39MmXN53IUfV/F243MgEq4maCsm36dIIn8LGuFiEv5FTY0Ajw7H3ydmKspVgO2PAObzvG
 +oDQ91Xg/E4VQQPGs3h0VwsBHN5rMZQIkw9L/124X/jthxCz+9VPWSj9PhrDpnRJ1DE9R8Qlp
 KOliwY+ogYLPegbsWhm5oFomId9WZKmV/fVnWmoLGGoE6E+rBRRv+EhKPaf1XeSrDmcqEZMFN
 xjSVMuMfJ6FmLAk4hQfXDwhtOmxryEF96nXEzUAwF2aIUiw2TgEm843xqNNhkmeHqBqp/ErCc
 9gIriwQTq1dFdYGri4a4nGwD7cQaocqIhvl8/XX8SN/U6iCcu4NfYYIywS5U+PJpF8XOtQTa0
 Gc0qlbXkd/WI79TETuzEwaqHzJ8s+J9A14J0FsyU5wftanSdCKw4gKCOzqaGXVSTTwq1gXyc0
 XO5f1BIhTqrzpwrvwL6ZTRN9EE5sJOI74y09NmUy7VOIzbluf326k1O7XIpAjO5cpMqIUI27M
 eGCq4fsk62oqqSnxVIbSak+T+KM=
From: Bill Stewart via Cygwin <cygwin@cygwin.com>
Reply-To: Bill Stewart <bstewart@iname.com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On Sat, Aug 19, 2023 at 2:15 AM ASSI wrote:

Windows really doesn't have a defined notion of what is or is not an
> "administrator".  Each particular definition will be insufficient or
> invalid in certain contexts.
>

There is a definition of administrator in Windows: Your account is a
member, either directly or indirectly, of the Administrators group (SID
1-5-32-544).

With the introduction of User Account Control (UAC) in Windows Vista, if
you log on as a member of this group, processes are normally started with
the Administrators group disabled (i.e, the process is not running as a
member of Administrators). The "run as administrator" action starts a
process with the group enabled. This is commonly referred to as
"elevation." [Side note: As I understand it, one of the reasons UAC was
introduced was made was to break (some?) software developers' habits of
assuming their programs run as administrator, and to choose better data
storage paths, registry paths, etc. See
https://techcommunity.microsoft.com/t5/windows-blog-archive/faq-why-can-8217-t-i-bypass-the-uac-prompt/ba-p/701510
for a nice summary. Also helpful is the current docs on SIDs:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
]

On a domain, the Domain Admins group (which has a relative identifier, or
RID, of 512) is by default a member of the Administrators group. The
Administrators group is still there (same SID, S-1-5-32-544), and is called
a "Domain Local Security Group" (i.e., it's a local group that's shared by
all domain controllers.)

Hope this helps clarify.

Bill

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple