1

I'm trying to find a way to authoritatively show whether a command prompt is running elevated or not, from the command prompt (CMD.exe), on a stock Windows installation. Most methods I've seen rely on non-native tools, third-party software, or proxy indicators which may not necessarily be reliable or compatible across all systems. I'm looking for something more along the lines of getting the system itself to explicitly state that the current session is elevated, or to show via command line that the current process is being run at an Integrity Level of High.

An example (but not necessarily absolute definition) of something that would be acceptable, would be a command that gets and displays the current PID followed by another command (if not same) that shows the Integrity Level for that PID. Commands which rely on the implications of a given output (e.g.: assuming the session is elevated if you can run certain commands, or determining elevation status based on the window's title bar) are not acceptable for this purpose.

Solutions should be compatible down to Windows 7 Pro SP0. Though these systems do have PowerShell, it is not an option for this purpose. Software not built-in to the OS is not an option.

7
  • @Ƭᴇcʜιᴇ007 Not quite exactly a duplicate, as this question has more strict limitations. However, one of the answers on the other question - the one that uses whoami /groups - appears to be appropriate for this one.
    – Iszi
    Sep 10, 2014 at 18:41
  • It's still a duplicate, IMO. It asked the question you wanted (just a little more broadly), and gave you an answer that works. Regardless, takes more than my vote to close it. :) Sep 10, 2014 at 18:43
  • @Ƭᴇcʜιᴇ007 I don't disagree. I've taken the whoami /groups answer and expanded upon it a bit here for future reference, and also voted to close as duplicate.
    – Iszi
    Sep 10, 2014 at 18:56
  • Sounds good to me. Just to set the record straight, none of the down votes on this question and answers are from me. Just one of the close as dupe votes... Sep 10, 2014 at 18:58
  • @Ƭᴇcʜιᴇ007 Thanks for the feedback. Don't know why anyone is down-voting the question. The existence of a duplicate is not an SE-appropriate reason for down-vote. As for my answer, the down-vote came in before I finished fully fleshing it out. So, I wouldn't really blame anyone for that since it was effectively a link-only answer at the time. (Though, technically, that should be a flag - not a down-vote.)
    – Iszi
    Sep 10, 2014 at 19:04

2 Answers 2

2

Found a good answer in the duplicate, here.

You can use whoami with the /groups parameter to see the the permissions assigned to the current user. These permissions will also be session-specific - i.e.: if the sesson is not elevated, whoami /groups will lack the group that is given to elevated sessions. Usage of the whoami command, and the /groups parameter, is documented in the TechNet article for Whoami.

The group you need to look for is SID S-1-16-12288, also known as "High Mandatory Level". You can find more details in the TechNet article, Well-Known Security Identifiers in Windows Operating Systems.

If you want to simplify the task for yourself, instead of having to visually search through all the groups listed, you can pipe the output to find with the syntax below:

whoami /groups | find "S-1-16-12288"

This will output the line that includes the SID if found, or produce blank output if the SID is not found. (In the latter case, this would indicate a non-elevated session.) In a script, you can also check the error level of find to determine whether or not the group was found. An error level of zero indicates a successful find (elevated session), while an error level of one indicates the group was not found (non-elevated session).

0
0

If you clearly want to see if the session is elevated, and not use it in a script, just check the title. It will say Administrator: in the title as well, indicated that the commandprompt is running elevated.

In addition, a cmd that is started elevated will not start in your user directory, but in the c:\windows\system32 folder.

enter image description here

enter image description here

Scriptwise, you can run system commands that require elevation, such as "at". It will fail with a message Access is denied. and %errorlevel% will be set to 1 which allows you to check it using a batch script as well. Otherwise %errorlevel% will be 0.

10
  • @joeqwerty I'm sorry. Did it hurt? XD
    – LPChip
    Sep 10, 2014 at 18:22
  • Alex beat you both by a year. ;) Sep 10, 2014 at 18:22
  • @Ƭᴇcʜιᴇ007 Yeah, and it still hurts. LOL
    – LPChip
    Sep 10, 2014 at 18:23
  • The difference here is that I also mention how the user can see it, rather than using a script which seems different from Alex's answer.
    – LPChip
    Sep 10, 2014 at 18:24
  • 1
    @LPChiip No, you're answering the question differently than what was asked. This question even specifically says "determining elevation status based on the window's title bar) are not acceptable for this purpose", so you've just added unwanted information, and now claim it (the question itself) is different because of the info you chose to introduce in your answer? Doesn't make sense to me, but hey, it's a free world. ;) Sep 10, 2014 at 18:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.