Checking UAC Elevation of Running Process from Command Prompt

Question

How can I use the command prompt (cmd.exe) to check if a process is running with UAC elevation / elevated privileges?

If I were to use the Task Manager (taskmgr.exe), I could check by adding the "UAC Virtualization" or, on Windows 8, the "Elevated" column. (This article explains it pretty well.)

But can I get this information via the command prompt, e.g. with tasklist or wmic? Are there any other command line tools built into Windows that allow me to check the elevation status?

My question applies to all Windows OS with UAC.

Answer 1

The cleanest way to check for admin privileges using a CMD script, that I have found, is something like this:

@echo off

REM  Calling verify with no args just checks the verify flag,
REM   we use this for its side effect of setting errorlevel to zero
verify >nul

REM  Attempt to read a particular system directory - the DIR
REM   command will fail with a nonzero errorlevel if the directory is
REM   unreadable by the current process.  The DACL on the
REM   c:\windows\system32\config\systemprofile directory, by default,
REM   only permits SYSTEM and Administrators.
dir %windir%\system32\config\systemprofile >nul 2>nul

REM  Use IF ERRORLEVEL or %errorlevel% to check the result
if not errorlevel 1 echo has Admin privs
if     errorlevel 1 echo has only User privs

This method only uses CMD.exe builtins, so it should be very fast. It also checks for the actual capabilities of the process rather than checking for SIDs or group memberships, so the effective permission is tested. And this works as far back as Windows 2003 and XP. Normal user processes or nonelevated processes fail the directory probe, where as Admin or elevated processes succeed.

Answer 2

I don't think there is anything built into Windows that can show this information on the command line. Even PowerShell doesn't seem to help without calling Win32 functions.

SysInternals AccessChk may work for you:

.\accesschk.exe -p powershell.exe -e

ran elevated, shows:

[3256] powershell.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW superUserPC2\peter
  RW NT AUTHORITY\SYSTEM
[3660] powershell.exe
  High Mandatory Level [No-Write-Up, No-Read-Up]
  RW BUILTIN\Administrators
  RW NT AUTHORITY\SYSTEM

You can see that the second PowerShell (3660) is running elevated because it has the High Mandatory Level

but if you run this command as standard user, you get:

[3256] powershell.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW superUserPC2\peter
  RW NT AUTHORITY\SYSTEM
Error opening [3660] powershell.exe:
Access is denied.

still you kind of know the second PowerShell runs elevated because you got an Access denied for it.

.\accesschk.exe -p -f powershell -e

gives you even more information

Answer 3

You could check with tasklist command

Try tasklist /v which will give you the process which process have which rights

Syntax:

tasklist /v

Sample Usage:

tasklist.exe /FI "username eq system" /v

which will list processes run by the system user.

Answer 4

I'm late to the party, but here's a PowerShell cmdlet: Test-ProcessElevated

Usage:

# from a pipeline:
Get-Process notepad | Test-ProcessElevated

# from a parameter:
Test-ProcessElevated $(Get-Process notepad)

# it returns boolean
if (ps notepad | Test-ProcessElevated)
{
    Write-Host 'notepad.exe is running elevated!'
}

# dwm.exe usually runs in a different session:
ps dwm | Test-ProcessElevated