If you prefer to use command-line tools, the Accesschk utility from the MS Sysinternals suite can be used to check if a process is running with administrator permissions.
The following flags are useful for this purpose:
The -p
(process) option accepts either the name or PID of a running process.
The -v
(verbose) option prints the Windows Integrity Level
The -q
(quiet) option prevents version information from being printed.
The -f
(full) option can also be used to provide even more information on the process(es) (security token details of users, groups and privileges) but this level of additional details is not required to check for elevated privileges.
Example
List the privileges of the all the running cmd
processes:
> accesschk.exe -vqp cmd
[5576] cmd.exe
Medium Mandatory Level [No-Write-Up, No-Read-Up]
RW ICS\Anthony
PROCESS_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
PROCESS_ALL_ACCESS
[8224] cmd.exe
Medium Mandatory Level [No-Write-Up, No-Read-Up]
RW ICS\Anthony
PROCESS_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
PROCESS_ALL_ACCESS
Error opening [6636] cmd.exe:
Access is denied.
Here, we can see that there are three cmd
processes that I started. The first two have a Medium Mandatory (Integrity) Level and are shown as running under my domain account, indicating that these processes were started without administrator privileges.
However, the last process (PID 6636) was started with elevated permissions so my non-privileged command can’t read information about that process. Running with elevated permissions accesschk
and explicitly specifying its PID prints the following information:
> accesschk.exe -vqp 6636
[6636] cmd.exe
High Mandatory Level [No-Write-Up, No-Read-Up]
RW BUILTIN\Administrators
PROCESS_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
PROCESS_ALL_ACCESS
Now we can see that the Integrity Level is High and that this process is running under the Administrators
built-in security group.