X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B205C385800A
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1692902848;
	bh=DZiarE3Mo6YSXB6lEX31vQw1wXssgrnRweUzVnwTHdc=;
	h=References:In-Reply-To:Date:Subject:To:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	 From;
	b=n2rzrQaFntzDSc9o6k52kDHoN1TyWK4vKWETptFc7UjklbI/d7EfN/R7S8CxSYxXp
	 WfiL6P/XmNHgSwAjT5UHPCV5UuvoIYQrzqSqu4fUpGfpHpLrmqdOUexY+qnsopdGM/
	 rTHDF7IrBa34ReadKBc9B+aHFcxFFJckPjBlUXTo=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9D4DB3858C53
X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a
X-Gm-Message-State: AOJu0YyQLGYW8bfcYRE4ItDOtAbO8plYTpy4AyksSl06Wx4YWFf7j7od
 Rnl1oZ8r38YTcTHIoxaCjoSUQj3DNj8ri6RtWuk=
X-Google-Smtp-Source: AGHT+IF5D0WFOqWwUQlCbY0X6uBCjbr5ALyH8tczSq2lh0Vsd+1TFraVtPq7FK/nPFpXWYnhCin8xXk5brVoapKX7HE=
X-Received: by 2002:a05:6512:2092:b0:500:9a15:9054 with SMTP id
 t18-20020a056512209200b005009a159054mr3383996lfr.20.1692902805616; Thu, 24
 Aug 2023 11:46:45 -0700 (PDT)
MIME-Version: 1.0
References: <CANH4o6OpsvT99AeJ2uTcqyajWQHmffYJqV=RR4HBxoFaveR7sQ AT mail DOT gmail DOT com>
 <74leei1djvvgnbtvrkpctgnp9jc2kqtsjf AT 4ax DOT com>
 <CANV9t=RTASguS8Bog8Ha8kWTebeU6ub5AsjnUv_3LQ=cXXH96Q AT mail DOT gmail DOT com>
In-Reply-To: <CANV9t=RTASguS8Bog8Ha8kWTebeU6ub5AsjnUv_3LQ=cXXH96Q@mail.gmail.com>
Date: Thu, 24 Aug 2023 12:46:19 -0600
X-Gmail-Original-Message-ID: <CANV9t=Tm0gozZaYw1a3iZwDzuMoSjS8yVwhkby_go=823oGTRA AT mail DOT gmail DOT com>
Message-ID: <CANV9t=Tm0gozZaYw1a3iZwDzuMoSjS8yVwhkby_go=823oGTRA@mail.gmail.com>
Subject: Re: Test for Windows Administrator permissions from Cygwin
 terminal|script?
To: cygwin AT cygwin DOT com
X-Provags-ID: V03:K1:qlbi6w1B6zHULWWfDkJembE6hb86AKw5dPozVFWpP37bzAqza5f
 fv3e3n8s7p6KzDUmcJnF+XUOYMn30Yn3ex/6L7wvsJaFKeJ0wKHrjzbw8zTO61H4s5yTdXG
 Ga8l3eX9svTUi2N0+DU2OAkq+B8q5Ul8e4ZxJ88c/p72YmQtXfwdf27zBX+yKlFh13sayU/
 mWtiQGQNopKc+xF6fY98Q==
UI-OutboundReport: notjunk:1;M01:P0:48lyqp1outU=;Pw3jYUTiIRKmLnWCe3+ixb++lZL
 45VVtRTwLLvmDTSsY+ZecYPeYn+j4G3wG4MT/w0iYbVIuS+ak/JybF6potLWtLQPDJMt4xK+Q
 uT+k1D6jwzJweM0Bs2nQkdHwTFnL6is1chTa6InkrdruuMakacLJgRcRbK7vsHHZ9FDM7+qEi
 KRtBTEbBevXjbElBagJs0QcwfgfvBaBHC91USuwsObw9CYogd5PRn5qJoa9DPnH331ijBzuai
 /SFp3l0IRc6yBDYfPnlfWbCAbB22/vpHQ0QOrJdjOyy3t66Xtou2gDBaq12n+x6E7yF/0cneo
 /bl+kIbX036hH0tNCb7gemksMowBUnBLuGBd8kXnnnsZRcNI+f7uhtG+JHD9xuH8h+16PYsbY
 35wSTCU0Cr0Z31rF5Aj24mua/V3VGOD/eLPnD44Hp23V9gTAQXQSfctjZUyWWGahbHnsiq+fR
 GOhnwVQnqrusIGSLi41Ee0Y0Jpho93FjxqebfRS+nPJl4CE7KAiz08Lxlyi2f70JTBO333bWW
 mJi5n0BRuukV6wOBdtihjuTjiXwUHDvNMiE314PlCGUrB443D3hwYCCwCxnkqlLsiQIAU/I4y
 kL2MBcHCI4cj+7WkQ/FVmlT5CknwRG0QzDII+E1I6pXrQzkzZDTBSrrTdFZ2KopBbPefRU77J
 Vzby2Z+TNk6021vRNGRjTLj5roInu7JAcPIhPQlidRA7uvoSYBhozycpURc0WxMjTHT01a1IU
 Pnfk/dNk0GYTsAg1VtsAt2NRWGWBf6YxORHRCybFFURhu5j1ZlHdWlHrtxEgh8LA1+Y30sNB1
 2FytDtH19uj8eGby7o9+a4oxQYuhd/ekPRelWwI+wIAjA9zcevspmJaDIFD+0CTATdIqep6g2
 UFL3vQYHoKgsDKKU2qmy52FT9Cu2lCzH7+a1wDKAro/CNaweGfzBd/7Z/VZOsLhW8TW4xUrBk
 2FdwDVVBkSsBTLmvMXLBC7NhDh0=
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, HTML_MESSAGE,
 RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS,
 TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-Content-Filtered-By: Mailman/MimeDel 2.1.29
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Bill Stewart via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Bill Stewart <bstewart AT iname DOT com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 37OIlTQS014763

On Thu, Aug 24, 2023 at 8:52 AM Bill Stewart wrote:

On Thu, Aug 24, 2023 at 7:01 AM Andrew Schulman wrote:
>
> > How can I find out whether the current Cygwin terminal has
>> > Administrator rights? I want to safeguard our admin scripts with a
>> > simple test and bail out with an error if someone wants to do admin
>> > stuff (say: regtool) without admin privileges.
>>
>>
>> https://superuser.com/questions/660191/how-to-check-if-cygwin-mintty-bash-is-run-as-administrator/874615#874615
>>
>
> This answer may be misleading. For example, when I log on using an account
> that's a member of Administrators, my account is a member of the group, but
> the Administrators group token is not enabled. For example, if I log on as
> a member of the Administrators group and open a PowerShell window, I can
> run the following, and it will output the local Administrators group (there
> will be no output if the account is not a member of Administrators):
>
> PS C:\> whoami /groups /fo csv | ConvertFrom-Csv | Where-Object { $_.SID
> -eq "S-1-5-32-544" }
>
> That is, while it is true that the process is a member of the
> Administrators group, the group isn't enabled, so the process isn't
> actually running with administrative permissions. In Windows-speak we would
> say the process isn't "elevated" ("elevated" = "running with administrative
> permissions"). In other words, logging on as a member of Administrators
> doesn't mean that processes you start are elevated.
>
> IME, what is normally being asked for is whether the current process is
> elevated (i.e., the group is both present and enabled). The usual Windows
> API way to check this is the CheckTokenMembership() function:
>
>
> https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-checktokenmembership
>
> In that reference: "The CheckTokenMembership function simplifies the
> process of determining whether a SID is both present and enabled in an
> access token."
>
> As an example, I wrote a little Windows program called 'elevate' that has
> a '-t' option to test whether the current process is elevated:
>
> https://github.com/Bill-Stewart/elevate
>

To elaborate on the above, the cygwin 'id -G' command looks like it takes
this into account and only outputs enabled group IDs.

I should have checked this before I responded, of course.

In other words, 'id -G' outputs a 544 in its list if the current process is
elevated ("run as administrator"). The 544 won't be in there if the process
is not elevated. I just tested from an elevated PowerShell console:

PS C:\Windows\System32> ((id -G) -split ' ') -contains '544'
True

Sorry for any confusion.

Bill

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple