4/5/2010 Update: This script function has been superceded by the much more capable
"IsSession.vbs" available here.

Maybe you have come across some of the UAC VBScript snippets for figuring out whether the current user is an administrator and even whether they are elevated or not. I wanted a quick and lightweight solution to figure our whether a user was admin and whether they were elevated. Once I got started, it didn’t take much to add checks for all the other groups and special permissions. And it’s all done in 40 lines…

UPDATE: Need something even smaller and faster that works on XP/2003 as well? Need it for .CMD or .BAT? Check out CSI_IsAdmin.

The following are examples of calls that are possible:

These first two use aliases built into the script – they actually check for well known sids

If IfUserPerms("Admin") Then wscript.echo "User is Admin"
If IfUserPerms("Elevated") Then wscript.echo "User is Elevated"

The following calls check for actual text that is present in the output of “whoami /all”:

The following take advantage of a secondary check built into the function. If there is an “=” sign in the submitted text, then the part before the equal sign is checked (by itself) for existence in the output of “whoami /all” If it is found then the line of text returned by the first check, is checked for existence of the string after the equal sign. This simple technique allows the checking of not only the presence of special permissions, but their enabled/disabled status.

An interesting side effect of using this simple approach is the ability to use the more descriptive text for the permissions or groups if desired:

These two lines show the flexibility of the approach since they were devised after the script was complete:

Here is the workhorse code that is also in the attachment (explanations below):

Function IfUserPerms (PermissionQuery)          
 IfUserPerms = False  ' False unless proven otherwise           
 Dim CheckFor, CmdToRun, Parts, CheckStatus           
 Dim ParseChar : ParseChar = "="           
 
 Select Case Ucase(PermissionQuery)           
 'Setup aliases here           
 Case "ELEVATED"           
   CheckFor =  "S-1-16-12288"           
 Case "ADMIN"           
   CheckFor =  "S-1-5-32-544"           
 Case "ADMINISTRATOR"           
   CheckFor =  "S-1-5-32-544"           
 Case Else           
   If Instr(1,PermissionQuery,ParseChar,1) > 0 Then           
     Parts = split(PermissionQuery,ParseChar)           
     CheckFor = Parts(0)           
     CheckStatus = Parts(1)           
   Else           
     CheckFor = PermissionQuery           
   End If           
 End Select           
 
 CmdToRun = "%comspec% /c whoami /all | findstr /I /C:""" & CheckFor & """"  
 
 Dim oShell, oExec           
 Set oShell = CreateObject("WScript.Shell")           
 Set oExec = oShell.Exec(CmdToRun)           
 Do While oExec.Status = 0           
   WScript.Sleep 100           
 Loop           
 If oExec.ExitCode = 0 Then           
   If CheckStatus = "" Then           
     IfUserPerms = True           
   Else           
     If Instr(1,oExec.StdOut.ReadAll,CheckStatus,1) > 0 Then IfUserPerms = True           
   End IF           
 End If           
End Function

The code lines were also cut down by priming the function return value with “False” so that we only have to check for and set “True” for conditions that match the search.

Additional aliases – similar to “IfUserPerms(“Admin”)” - can be added by creating additional Case statements.

Stay tuned for more helper scripts for working with UAC and other Vista / Windows 7 technologies!

Like this script? Subscribe to our newsletter (without loosing your place in this article). (Please ensure that the confirmation email clears your spam filter so that you will see future mailings.)

Attachments:

IfUserPerms.zip

[ ]

2 Kb