X-Recipient: archive-cygwin AT delorie DOT com DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B205C385800A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com; s=default; t=1692902848; bh=DZiarE3Mo6YSXB6lEX31vQw1wXssgrnRweUzVnwTHdc=; h=References:In-Reply-To:Date:Subject:To:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=n2rzrQaFntzDSc9o6k52kDHoN1TyWK4vKWETptFc7UjklbI/d7EfN/R7S8CxSYxXp WfiL6P/XmNHgSwAjT5UHPCV5UuvoIYQrzqSqu4fUpGfpHpLrmqdOUexY+qnsopdGM/ rTHDF7IrBa34ReadKBc9B+aHFcxFFJckPjBlUXTo= X-Original-To: cygwin AT cygwin DOT com Delivered-To: cygwin AT cygwin DOT com DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9D4DB3858C53 X-UI-Sender-Class: f2cb72be-343f-493d-8ec3-b1efb8d6185a X-Gm-Message-State: AOJu0YyQLGYW8bfcYRE4ItDOtAbO8plYTpy4AyksSl06Wx4YWFf7j7od Rnl1oZ8r38YTcTHIoxaCjoSUQj3DNj8ri6RtWuk= X-Google-Smtp-Source: AGHT+IF5D0WFOqWwUQlCbY0X6uBCjbr5ALyH8tczSq2lh0Vsd+1TFraVtPq7FK/nPFpXWYnhCin8xXk5brVoapKX7HE= X-Received: by 2002:a05:6512:2092:b0:500:9a15:9054 with SMTP id t18-20020a056512209200b005009a159054mr3383996lfr.20.1692902805616; Thu, 24 Aug 2023 11:46:45 -0700 (PDT) MIME-Version: 1.0 References: <74leei1djvvgnbtvrkpctgnp9jc2kqtsjf AT 4ax DOT com> In-Reply-To: Date: Thu, 24 Aug 2023 12:46:19 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: Test for Windows Administrator permissions from Cygwin terminal|script? To: cygwin AT cygwin DOT com X-Provags-ID: V03:K1:qlbi6w1B6zHULWWfDkJembE6hb86AKw5dPozVFWpP37bzAqza5f fv3e3n8s7p6KzDUmcJnF+XUOYMn30Yn3ex/6L7wvsJaFKeJ0wKHrjzbw8zTO61H4s5yTdXG Ga8l3eX9svTUi2N0+DU2OAkq+B8q5Ul8e4ZxJ88c/p72YmQtXfwdf27zBX+yKlFh13sayU/ mWtiQGQNopKc+xF6fY98Q== UI-OutboundReport: notjunk:1;M01:P0:48lyqp1outU=;Pw3jYUTiIRKmLnWCe3+ixb++lZL 45VVtRTwLLvmDTSsY+ZecYPeYn+j4G3wG4MT/w0iYbVIuS+ak/JybF6potLWtLQPDJMt4xK+Q uT+k1D6jwzJweM0Bs2nQkdHwTFnL6is1chTa6InkrdruuMakacLJgRcRbK7vsHHZ9FDM7+qEi KRtBTEbBevXjbElBagJs0QcwfgfvBaBHC91USuwsObw9CYogd5PRn5qJoa9DPnH331ijBzuai /SFp3l0IRc6yBDYfPnlfWbCAbB22/vpHQ0QOrJdjOyy3t66Xtou2gDBaq12n+x6E7yF/0cneo /bl+kIbX036hH0tNCb7gemksMowBUnBLuGBd8kXnnnsZRcNI+f7uhtG+JHD9xuH8h+16PYsbY 35wSTCU0Cr0Z31rF5Aj24mua/V3VGOD/eLPnD44Hp23V9gTAQXQSfctjZUyWWGahbHnsiq+fR GOhnwVQnqrusIGSLi41Ee0Y0Jpho93FjxqebfRS+nPJl4CE7KAiz08Lxlyi2f70JTBO333bWW mJi5n0BRuukV6wOBdtihjuTjiXwUHDvNMiE314PlCGUrB443D3hwYCCwCxnkqlLsiQIAU/I4y kL2MBcHCI4cj+7WkQ/FVmlT5CknwRG0QzDII+E1I6pXrQzkzZDTBSrrTdFZ2KopBbPefRU77J Vzby2Z+TNk6021vRNGRjTLj5roInu7JAcPIhPQlidRA7uvoSYBhozycpURc0WxMjTHT01a1IU Pnfk/dNk0GYTsAg1VtsAt2NRWGWBf6YxORHRCybFFURhu5j1ZlHdWlHrtxEgh8LA1+Y30sNB1 2FytDtH19uj8eGby7o9+a4oxQYuhd/ekPRelWwI+wIAjA9zcevspmJaDIFD+0CTATdIqep6g2 UFL3vQYHoKgsDKKU2qmy52FT9Cu2lCzH7+a1wDKAro/CNaweGfzBd/7Z/VZOsLhW8TW4xUrBk 2FdwDVVBkSsBTLmvMXLBC7NhDh0= X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: cygwin AT cygwin DOT com X-Mailman-Version: 2.1.29 List-Id: General Cygwin discussions and problem reports List-Archive: List-Post: List-Help: List-Subscribe: , From: Bill Stewart via Cygwin Reply-To: Bill Stewart Content-Type: text/plain; charset="utf-8" Sender: "Cygwin" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 37OIlTQS014763 On Thu, Aug 24, 2023 at 8:52 AM Bill Stewart wrote: On Thu, Aug 24, 2023 at 7:01 AM Andrew Schulman wrote: > > > How can I find out whether the current Cygwin terminal has >> > Administrator rights? I want to safeguard our admin scripts with a >> > simple test and bail out with an error if someone wants to do admin >> > stuff (say: regtool) without admin privileges. >> >> >> https://superuser.com/questions/660191/how-to-check-if-cygwin-mintty-bash-is-run-as-administrator/874615#874615 >> > > This answer may be misleading. For example, when I log on using an account > that's a member of Administrators, my account is a member of the group, but > the Administrators group token is not enabled. For example, if I log on as > a member of the Administrators group and open a PowerShell window, I can > run the following, and it will output the local Administrators group (there > will be no output if the account is not a member of Administrators): > > PS C:\> whoami /groups /fo csv | ConvertFrom-Csv | Where-Object { $_.SID > -eq "S-1-5-32-544" } > > That is, while it is true that the process is a member of the > Administrators group, the group isn't enabled, so the process isn't > actually running with administrative permissions. In Windows-speak we would > say the process isn't "elevated" ("elevated" = "running with administrative > permissions"). In other words, logging on as a member of Administrators > doesn't mean that processes you start are elevated. > > IME, what is normally being asked for is whether the current process is > elevated (i.e., the group is both present and enabled). The usual Windows > API way to check this is the CheckTokenMembership() function: > > > https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-checktokenmembership > > In that reference: "The CheckTokenMembership function simplifies the > process of determining whether a SID is both present and enabled in an > access token." > > As an example, I wrote a little Windows program called 'elevate' that has > a '-t' option to test whether the current process is elevated: > > https://github.com/Bill-Stewart/elevate > To elaborate on the above, the cygwin 'id -G' command looks like it takes this into account and only outputs enabled group IDs. I should have checked this before I responded, of course. In other words, 'id -G' outputs a 544 in its list if the current process is elevated ("run as administrator"). The 544 won't be in there if the process is not elevated. I just tested from an elevated PowerShell console: PS C:\Windows\System32> ((id -G) -split ' ') -contains '544' True Sorry for any confusion. Bill -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple