2

How can I use the command prompt (cmd.exe) to check if a process is running with UAC elevation / elevated privileges?

If I were to use the Task Manager (taskmgr.exe), I could check by adding the "UAC Virtualization" or, on Windows 8, the "Elevated" column. (This article explains it pretty well.)

But can I get this information via the command prompt, e.g. with tasklist or wmic? Are there any other command line tools built into Windows that allow me to check the elevation status?

My question applies to all Windows OS with UAC.

2

The cleanest way to check for admin privileges using a CMD script, that I have found, is something like this:

@echo off

REM  Calling verify with no args just checks the verify flag,
REM   we use this for its side effect of setting errorlevel to zero
verify >nul

REM  Attempt to read a particular system directory - the DIR
REM   command will fail with a nonzero errorlevel if the directory is
REM   unreadable by the current process.  The DACL on the
REM   c:\windows\system32\config\systemprofile directory, by default,
REM   only permits SYSTEM and Administrators.
dir %windir%\system32\config\systemprofile >nul 2>nul

REM  Use IF ERRORLEVEL or %errorlevel% to check the result
if not errorlevel 1 echo has Admin privs
if     errorlevel 1 echo has only User privs

This method only uses CMD.exe builtins, so it should be very fast. It also checks for the actual capabilities of the process rather than checking for SIDs or group memberships, so the effective permission is tested. And this works as far back as Windows 2003 and XP. Normal user processes or nonelevated processes fail the directory probe, where as Admin or elevated processes succeed.

1

I don't think there is anything built into Windows that can show this information on the command line. Even PowerShell doesn't seem to help without calling Win32 functions.

SysInternals AccessChk may work for you:

.\accesschk.exe -p powershell.exe -e

ran elevated, shows:

[3256] powershell.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW superUserPC2\peter
  RW NT AUTHORITY\SYSTEM
[3660] powershell.exe
  High Mandatory Level [No-Write-Up, No-Read-Up]
  RW BUILTIN\Administrators
  RW NT AUTHORITY\SYSTEM

You can see that the second PowerShell (3660) is running elevated because it has the High Mandatory Level

but if you run this command as standard user, you get:

[3256] powershell.exe
  Medium Mandatory Level [No-Write-Up, No-Read-Up]
  RW superUserPC2\peter
  RW NT AUTHORITY\SYSTEM
Error opening [3660] powershell.exe:
Access is denied.

still you kind of know the second PowerShell runs elevated because you got an Access denied for it.

.\accesschk.exe -p -f powershell -e

gives you even more information

0

You could check with tasklist command

Try tasklist /v which will give you the process which process have which rights

Syntax:

tasklist /v

Sample Usage:

tasklist.exe /FI "username eq system" /v

which will list processes run by the system user.

  • 1
    Thanks but I don't see any difference between how UAC elevated and non-elevated processes are being displayed. For example, I've started one calc.exe with and one without elevation, and "tasklist /v | findstr calc" is telling me: . calc.exe 3988 Console 1 12,916 K Running compname\username 0:00:00 Calculator . calc.exe 4704 Console 1 12,924 K Running compname\username 0:00:00 Calculator – kazhtaco Jun 30 '15 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.