Check if process is elevated?

x13

Nov 9, 2016
76
1
Netherlands
Hi.

Sorry if this question has already been asked.

Suppose a program starts as admin. How can that be queried with TCC?
The %_ELEVATED system variable only applies to TCMD/TCC itself.

A function like %@ELEVATED[pid] = 0 | 1 (1= admin, 0=not) would be very handy.

Unless there's another cunning way I'm not seeing?

Thanks.
x¹³
 
  • Like
Reactions: Alpengreis
May 20, 2008
11,520
102
Syracuse, NY, USA
If the CURRENT process IS NOT ELEVATED, this will work because , unelevated, WMI can't get the command line of an elevated process.

Code:
v:\> function elevated `%@if[*%@instr[0,1,%@wmi[.,"Select CommandLine from Win32_Process where ProcessId=%1"]]* == **,1,0]`

v:\> echo %@elevated[%_pid]
0

v:\> start /elevated

v:\> echo %@elevated[%_startpid]
1

And it will fail if the current process is elevated.
 

Charles Dye

Super Moderator
Staff member
May 20, 2008
4,491
90
Albuquerque, NM
prospero.unm.edu
Here's what I use:

Code:
int ProcessElevated( DWORD Pid )
{
    HANDLE ProcessHandle        = NULL;
    HANDLE ProcessToken         = NULL;
    TOKEN_ELEVATION Elevated    = { 0 };
    DWORD ReturnSize            = 0;

    int rv                      = -1;


    ProcessHandle = OpenProcess( PROCESS_QUERY_LIMITED_INFORMATION, FALSE, Pid );
    if ( ProcessHandle ) {

        if ( OpenProcessToken( ProcessHandle, TOKEN_QUERY, &ProcessToken ) ) {

            if ( GetTokenInformation( ProcessToken, TokenElevation, &Elevated, sizeof( TOKEN_ELEVATION ), &ReturnSize ) )
                rv = Elevated.TokenIsElevated ? 1 : 0;

            CloseHandle( ProcessToken );
        }

        CloseHandle( ProcessHandle );
    }

    return rv;
}

Returns 1 for elevated, 0 for not elevated, and -1 on any error (invalid PID?)

I suspect the internal _ELEVATED variable uses something similar.
 
  • Like
Reactions: Joe Caverly
May 20, 2008
11,520
102
Syracuse, NY, USA
Yes. That's why I'm using PROCESS_QUERY_LIMITED_INFORMATION instead of the more obvious PROCESS_QUERY_INFORMATION.
I'm a little surprised since the documentation for the latter specifically mentions OpenProcessToken while the documentation for the former doesn't.

PROCESS_QUERY_INFORMATION (0x0400)Required to retrieve certain information about a process, such as its token, exit code, and priority class (see OpenProcessToken).
PROCESS_QUERY_LIMITED_INFORMATION (0x1000)Required to retrieve certain information about a process (see GetExitCodeProcess, GetPriorityClass, IsProcessInJob, QueryFullProcessImageName). A handle that has the PROCESS_QUERY_INFORMATION access right is automatically granted PROCESS_QUERY_LIMITED_INFORMATION.Windows Server 2003 and Windows XP: This access right is not supported.
 

x13

Nov 9, 2016
76
1
Netherlands
@vefatica :

I tried your function, but I get an error :

function elevated `%@if[*%@instr[0,1,%@wmi[.,"Select CommandLine from Win32_Process where ProcessId=%1"]]* == **,1,0]`

echo %@elevated[%_pid]
TCC: (Sys) The parameter is incorrect.
"%@if[*"* == **,1,0]"
 
May 20, 2008
11,520
102
Syracuse, NY, USA
@vefatica :

I tried your function, but I get an error :

function elevated `%@if[*%@instr[0,1,%@wmi[.,"Select CommandLine from Win32_Process where ProcessId=%1"]]* == **,1,0]`

echo %@elevated[%_pid]
TCC: (Sys) The parameter is incorrect.
"%@if[*"* == **,1,0]"
I didn't consider that the command line might start with a quote. Actually, MaximumWorkingSetSize works also and it will either be empty or contain just numbers. So this should work as long as the current TCC in not elevated. Note that it will give "1" if the PID doesn't exist.

Code:
function elevated `%@if[*%@wmi[.,"Select MaximumWorkingSetSize from Win32_Process where ProcessId=%1"]* == **,1,0]`
 
Similar threads
Thread starter Title Forum Replies Date
bwawsc2 Check for updates fails to complete Support 9
MikeBaas How to check if label exists? Support 3
gentzel "Check for Updates" appears to be checking for old version Support 2
D check for network tcstart.btm and load if newer Support 3
jfalch WAD internal "which" should check for FILEEXIST when using AppPaths entry Support 8
D Dir History file check Support 18
A Help | Check for updates "old news" Support 13
H Is "Check for updates" supposed to work in v10? Support 1
vefatica SETP usually fails with a 32 bit process Support 4
Alpengreis Remaining TCMD background process (v26) ... Support 19
vefatica Tmp files from in-process pipes not deleted Support 6
Jay Sage TASKLIST Command Process Count Support 5
Joe Caverly PSHELL and out-of-process servers Support 2
CWBillow Upgrade process Support 7
Joe Caverly SETP and 32-bit process Support 2
rps V20 In-process pipes problem Support 8
R Fixed Internal ZIP command fails to process multiple files Support 3
C Determine process svchost is running Support 13
fpefpe WAD Python support does not process command line Support 14
M WAD tcmd.exe crashes and leaves an orphaned tcc.exe process Support 6
Stefano Piccardi replace tcc process space? Support 8
Q TCC: (Sys) The process cannot access the file because it is being used by another process. Support 0
D Environment in elevated process Support 1
cgunhouse ProcessMonitor Does Not Work With Quoted Process Name Support 5
cgunhouse ProcessMonitor Does Not Work With Quoted Process Name Support 0
Phileosophos ren /s does not process subdirectories Support 3
T Starting a process blocks TCC window... Support 2
nikbackm Find out when a process has stopped Support 5
N Unable to end tcc.exe process Support 1
E CPU usage of a process Support 2
I TCC in Elevated mode? Support 6
vefatica BTM, elevated, console window caption? Support 4
vefatica START /elevated and PcaSvc? Support 5
CWBillow TCMD PowerShell Tab elevated Support 6
P Run as Admin tab in non-elevated Take Command session? Support 9
D WAD START /ELEVATED "Title" /PGM "job.btm" Support 6
C How to? run a BTM in elevated, inv tcc tab window Support 9
vefatica TCC window caption in elevated session? Support 5
M WAD /elevated failure... Support 13
M Start "/Elevated" failure... Support 3
C OT: Registry OPEN verb to start elevated... Support 2
vefatica Caption when running elevated? Support 4
M How to? Start a program on log on elevated abovenormal Support 5
M How to? /Elevated doesn't do it for me... Support 8
vefatica Elevated session and UpdateTitle? Support 3
Dan Glynhampton Problem with Start /elevated Support 2
vefatica _STARPID & @PID[] after START /ELEVATED Support 10
Jay Sage How to Run Non-Elevated From Elevated TCC Support 1
J start /elevated /inv not invisible Support 4
Y Elevated tab Support 4

Similar threads