Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Windows Vista, with UAC enabled. I've installed an application, and the installer required admin privileges. The installer then started the application. I'd like to know if the application is continuing to run with admin privileges.

I've tried Windows Task Manager and Process Explorer, and neither appear to show this information.

share|improve this question
up vote 31 down vote accepted

In Process Explorer, double click the process to open its properties. Go to the Security tab. In the group listing, find BUILTIN\Administrators and look at what it says in the Flags column.

Deny = Not Elevated (not admin)

alt text

Owner = Elevated (is admin)

alt text

share|improve this answer
    
On my Windows 7 system, I had to run Process Explorer with elevated permissions in order to be able to see certain details (such as the Security permissions) of processes running with administrator permissions. When running Process Explorer as a regular user, the contents of the Security tab were blank. – Anthony Geoghegan Apr 14 at 12:16

In Process Explorer you can change the columns displayed and add the "Integrity level" column:

enter image description here

This is apparently the technical term for what is changed when you run a process with administrator privileges. If you run Process Explorer as an Administrator it will show ordinary processes as 'medium' integrity level and elevated processes as 'high'.

Note that if you run process explorer as an ordinary user, it will show processes that have admin privileges with a blank entry in the integrity level column.

share|improve this answer

If you prefer to use command-line tools, the Accesschk utility from the MS Sysinternals suite can be used to check if a process is running with administrator permissions.

The following flags are useful for this purpose:

  • The -p (process) option accepts either the name or PID of a running process.

  • The -v (verbose) option prints the Windows Integrity Level

  • The -q (quiet) option prevents version information from being printed.

  • The -f (full) option can also be used to provide even more information on the process(es) (security token details of users, groups and privileges) but this level of additional details is not required to check for elevated privileges.

Example

List the privileges of the all the running cmd processes:

> accesschk.exe -vqp cmd

[5576] cmd.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW ICS\Anthony
        PROCESS_ALL_ACCESS
  RW NT AUTHORITY\SYSTEM
        PROCESS_ALL_ACCESS
[8224] cmd.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW ICS\Anthony
        PROCESS_ALL_ACCESS
  RW NT AUTHORITY\SYSTEM
        PROCESS_ALL_ACCESS
Error opening [6636] cmd.exe:
Access is denied.

Here, we can see that there are three cmd processes that I started. The first two have a Medium Mandatory (Integrity) Level and are shown as running under my domain account, indicating that these processes were started without administrator privileges.

However, the last process (PID 6636) was started with elevated permissions so my non-privileged command can’t read information about that process. Running with elevated permissions accesschk and explicitly specifying its PID prints the following information:

> accesschk.exe -vqp 6636

[6636] cmd.exe
  High Mandatory Level [No-Write-Up, No-Read-Up]
  RW BUILTIN\Administrators
        PROCESS_ALL_ACCESS
  RW NT AUTHORITY\SYSTEM
        PROCESS_ALL_ACCESS

Now we can see that the Integrity Level is High and that this process is running under the Administrators built-in security group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.