Telemetry/Helpers/Win32Uac.cs
/// <summary>
/// The function gets the elevation information of the current process. It 
/// dictates whether the process is elevated or not. Token elevation is only 
/// available on Windows Vista and newer operating systems, thus 
/// IsProcessElevated throws a C++ exception if it is called on systems prior 
/// to Windows Vista. It is not appropriate to use this function to determine 
/// whether a process is run as administartor.
/// </summary>
/// <returns>
/// Returns true if the process is elevated. Returns false if it is not.
/// </returns>
/// <exception cref="System.ComponentModel.Win32Exception">
/// When any native Windows API call fails, the function throws a Win32Exception 
/// with the last error code.
/// </exception>
/// <remarks>
/// TOKEN_INFORMATION_CLASS provides TokenElevationType to check the elevation 
/// type (TokenElevationTypeDefault / TokenElevationTypeLimited / 
/// TokenElevationTypeFull) of the process. It is different from TokenElevation 
/// in that, when UAC is turned off, elevation type always returns 
/// TokenElevationTypeDefault even though the process is elevated (Integrity 
/// Level == High). In other words, it is not safe to say if the process is 
/// elevated based on elevation type. Instead, we should use TokenElevation. 
/// </remarks>
The function gets the elevation information of the current process. It
dictates whether the process is elevated or not. Token elevation is only
available on Windows Vista and newer operating systems, thus
IsProcessElevated throws a C++ exception if it is called on systems prior
to Windows Vista. It is not appropriate to use this function to determine
whether a process is run as administartor.
The function gets the elevation information of the current process . It dictates whether the process is elevated or not . Token elevation is only available on Windows Vista and newer operating systems thus IsProcessElevated throws a C ++ exception if it is called on systems prior to Windows Vista . It is not appropriate to use this function to determine whether a process is run as administartor .
public static bool IsProcessElevated()
        {
            bool fIsElevated;
            SafeTokenHandle hToken = null;
            IntPtr pTokenElevation = IntPtr.Zero;
            try
            {
                if (!NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle,
                    NativeMethods.TOKEN_QUERY, out hToken))
                {
                    throw new Win32Exception();
                }
                int cbTokenElevation = Marshal.SizeOf(typeof(TOKEN_ELEVATION));
                pTokenElevation = Marshal.AllocHGlobal(cbTokenElevation);
                if (pTokenElevation == IntPtr.Zero)
                {
                    throw new Win32Exception();
                }
                if (!NativeMethods.GetTokenInformation(hToken,
                    TOKEN_INFORMATION_CLASS.TokenElevation, pTokenElevation,
                    cbTokenElevation, out cbTokenElevation))
                {
                    throw new Win32Exception();
                }
                TOKEN_ELEVATION elevation = (TOKEN_ELEVATION)Marshal.PtrToStructure(
                    pTokenElevation, typeof(TOKEN_ELEVATION));
                fIsElevated = (elevation.TokenIsElevated != 0);
            }
            finally
            {
                hToken?.Close();
                if (pTokenElevation != IntPtr.Zero)
                    Marshal.FreeHGlobal(pTokenElevation);
            }
            return fIsElevated;
        }
public static bool IsProcessElevated ( ) { bool fIsElevated ; SafeTokenHandle hToken = null ; IntPtr pTokenElevation = IntPtr . Zero ; try { if ( ! NativeMethods . OpenProcessToken ( Process . GetCurrentProcess ( ) . Handle , NativeMethods . TOKEN_QUERY , out hToken ) ) { throw new Win32Exception ( ) ; } int cbTokenElevation = Marshal . SizeOf ( typeof ( TOKEN_ELEVATION ) ) ; pTokenElevation = Marshal . AllocHGlobal ( cbTokenElevation ) ; if ( pTokenElevation == IntPtr . Zero ) { throw new Win32Exception ( ) ; } if ( ! NativeMethods . GetTokenInformation ( hToken , TOKEN_INFORMATION_CLASS . TokenElevation , pTokenElevation , cbTokenElevation , out cbTokenElevation ) ) { throw new Win32Exception ( ) ; } TOKEN_ELEVATION elevation = ( TOKEN_ELEVATION ) Marshal . PtrToStructure ( pTokenElevation , typeof ( TOKEN_ELEVATION ) ) ; fIsElevated = ( elevation . TokenIsElevated != 0 ) ; } finally { hToken ? . Close ( ) ; if ( pTokenElevation != IntPtr . Zero ) Marshal . FreeHGlobal ( pTokenElevation ) ; } return fIsElevated ; }
The function gets the elevation information of the current process.
The function gets the elevation information of the current process .
// Open the access token of the current process with TOKEN_QUERY. // Allocate a buffer for the elevation information. // Retrieve token elevation information. // When the process is run on operating systems prior to Windows  // Vista, GetTokenInformation returns false with the error code  // ERROR_INVALID_PARAMETER because TokenElevation is not supported  // on those operating systems. // Marshal the TOKEN_ELEVATION struct from native to .NET object. // TOKEN_ELEVATION.TokenIsElevated is a non-zero value if the token  // has elevated privileges; otherwise, a zero value. // Centralized cleanup for all allocated resources. 
Returns true if the process is elevated. Returns false if it is not.
Returns true if the process is elevated . Returns false if it is not .
When any native Windows API call fails, the function throws a Win32Exception
with the last error code.
When any native Windows API call fails the function throws a Win32Exception with the last error code .
remarks
TOKEN_INFORMATION_CLASS provides TokenElevationType to check the elevation
type (TokenElevationTypeDefault / TokenElevationTypeLimited
TokenElevationTypeFull) of the process. It is different from TokenElevation
in that, when UAC is turned off, elevation type always returns
TokenElevationTypeDefault even though the process is elevated (Integrity
Level == High). In other words, it is not safe to say if the process is
elevated based on elevation type. Instead, we should use TokenElevation.
TOKEN_INFORMATION_CLASS provides TokenElevationType to check the elevation type ( TokenElevationTypeDefault / TokenElevationTypeLimited TokenElevationTypeFull ) of the process . It is different from TokenElevation in that when UAC is turned off elevation type always returns TokenElevationTypeDefault even though the process is elevated ( Integrity Level == High ) . In other words it is not safe to say if the process is elevated based on elevation type . Instead we should use TokenElevation .