How to detect if CMD is running as Administrator has elevated privileges

Question

From inside a batch file  I would like to test whether I m running with Administrator elevated privileges   The username doesn t change when  Run as Administrator  is selected  so that doesn t work   If there were a universally available command  which has no effect  but requires administrative privileges  then I could run that and check for an error code in order to test for privileges   So far  I haven t found such a command   The commands I have found seem to return a single  non-specific error code  which could indicate anything  and they re prone to failure for a variety of reasons   I only care about Windows 7  though support of earlier operating systems would be nice

User · Answer

the solution   at  gt nul if  ErrorLevel  equ 0   echo Administrator   else   echo NOT Administrator     does not work under Windows 10  for all versions of Windows can be do so   openfiles  gt nul 2 gt  amp 1 if  ErrorLevel  equ 0   echo Administrator   else   echo NOT Administrator

User · Answer

Works for Win7 Enterprise and Win10 Enterprise   if DEFINED SESSIONNAME        echo       echo You must right click to  Run as administrator       echo Try again      echo       pause      goto  EOF

User · Answer

A  not-a-one-liner  version of https   stackoverflow com a 38856823 2193477   echo off net exe session 1 gt NUL 2 gt NUL    goto  not admin echo SUCCESS goto  eof   not admin echo ERROR  Please run as a local administrator  exit  b 1

User · Answer

I like Rushyo s suggestion of using AT  but this is another option   whoami  groups   findstr  b BUILTIN Administrators   findstr  c  Enabled group   amp  amp  goto  isadministrator   This approach would also allow you to distinguish between a non-administrator and a non-elevated administrator if you wanted to   Non-elevated administrators still have BUILTIN Administrators in the group list but it is not enabled   However  this will not work on some non-English language systems   Instead  try  whoami  groups   findstr  c   S-1-5-32-544     findstr  c   Enabled group   amp  amp  goto  isadministrator    This should work on Windows 7 but I m not sure about earlier versions

User · Answer

The easiest way to do this on Vista  Win 7 and above is enumerating token groups and looking for the current integrity level  or the administrators sid  if only group memberhip is important    Check if we are running elevated   whoami  groups   find  S-1-16-12288   amp  amp  Echo I am running elevated  so I must be an admin anyway  -    Check if we belong to local administrators   whoami  groups   find  S-1-5-32-544   amp  amp  Echo I am a local admin   Check if we belong to domain admins   whoami  groups   find  -512    amp  amp  Echo I am a domain admin   The following article lists the integrity level SIDs windows uses  http   msdn microsoft com en-us library bb625963 aspx

User · Answer

This trick only requires one command  type net session into the command prompt   If you are NOT an admin  you get an access is denied message   System error 5 has occurred   Access is denied    If you ARE an admin  you get a different message  the most common being   There are no entries in the list    From MS Technet      Used without parameters  net session displays information about all   sessions with the local computer

User · Answer

If you are running as a user with administrator rights then environment variable SessionName will NOT be defined and you still don t have administrator rights when running a batch file   You should use  net session  command and look for an error return code of  0  to verify administrator rights   Example   - the first echo statement is the bell character  net session  gt nul 2 gt  amp 1 if not  errorlevel   0  echo  echo  You need to start over and right-click on this file   echo  then select  Run as administrator  to be successfull  echo  amp pause amp exit

User · Answer

Pretty much what others have put before  but as a one liner that can be put at the beginning of a batch command    Well  usually after  echo off    net exe session 1 gt NUL 2 gt NUL     Echo This script requires elevated rights   amp  Exit  b 1

User · Answer

Here s a simple method I ve used on Windows 7 through Windows 10  Basically  I simply use the  IF EXIST  command to check for the Windows System32 WDI LogFiles folder  The WDI folder exists on every install of Windows from at least 7 onward  and it requires admin privileges to access  The WDI folder always has a LogFiles folder inside it  So  running  IF EXIST  on the WDI LogFiles folder will return true if run as admin  and false if not run as admin  This can be used in a batch file to check privilege level  and branch to whichever commands you desire based on that result   Here s a brief snippet of example code   IF EXIST  SYSTEMROOT  SYSTEM32 WDI LOGFILES GOTO GOTADMIN  Commands for running with normal privileges    GOTADMIN  Commands for running with admin privileges    Keep in mind that this method assumes the default security permissions have not been modified on the WDI folder  which is unlikely to happen in most situations  but please see caveat  2 below   Even in that case  it s simply a matter of modifying the code to check for a different common file folder that requires admin access  System32 config SAM may be a good alternate candidate   or you could even create your own specifically for that purpose   There are two caveats about this method though    Disabling UAC will likely break it through the simple fact that everything would be run as admin anyway  Attempting to open the WDI folder in Windows Explorer and then clicking  Continue  when prompted will add permanent access rights for that user account  thus breaking my method  If this happens  it can be fixed by removing the user account from the WDI folder security permissions  If for any reason the user MUST be able to access the WDI folder with Windows Explorer  then you d have to modify the code to check a different folder  as mentioned above  creating your own specifically for this purpose may be a good choice     So  admittedly my method isn t perfect since it can be broken  but it s a relatively quick method that s easy to implement  is equally compatible with all versions of Windows 7  8 and 10  and provided I stay mindful of the mentioned caveats has been 100  effective for me

User · Answer

I know I m really late to this party  but here s my one liner to determine admin-hood   It doesn t rely on error level  just on systeminfo   for  f  tokens 1-6    a in    net user   username     find  i  Local Group Memberships     do  set admin yes  amp  if not    d       Administrators   set admin no   amp  echo  admin     It returns either yes or no  depending on the user s admin status     It also sets the value of the variable  admin  to equal yes or no accordingly

User · Answer

I read many  most   of the responses  then developed a bat file that works for me in Win 8 1  Thought I d share it   setlocal set runState user whoami  groups   findstr  b  c  Mandatory Label High Mandatory Level   gt  nul  amp  amp  set runState admin whoami  groups   findstr  b  c  Mandatory Label System Mandatory Level   gt  nul  amp  amp  set runState system echo Running in state    runState   if not   runState     user  goto notUser   echo Do user stuff      goto end  notUser if not   runState     admin  goto notAdmin   echo Do admin stuff      goto end  notAdmin if not   runState     system  goto notSystem   echo Do admin stuff      goto end  notSystem echo Do common stuff     end   Hope someone finds this useful

User · Answer

ADDENDUM  For Windows 8 this will not work  see this excellent answer instead     Found this solution here  http   www robvanderwoude com clevertricks php  AT  gt  NUL IF  ERRORLEVEL  EQU 0       ECHO you are Administrator   ELSE       ECHO you are NOT Administrator  Exiting        PING 127 0 0 1  gt  NUL 2 gt  amp 1     EXIT  B 1     Assuming that doesn t work and since we re talking Win7 you could use the following in Powershell if that s suitable    principal   new-object System Security Principal WindowsPrincipal  System Security Principal WindowsIdentity   GetCurrent     principal IsInRole  System Security Principal WindowsBuiltInRole   Administrator    If not  and probably not  since you explicitly proposed batch files  then you could write the above in  NET and return an exit code from an exe based on the result for your batch file to use

User · Answer

Here s a slight modification of Harry s answer that focuses on elevated status  I m using this at the start of an install bat file   set IS ELEVATED 0 whoami  groups   findstr  b  c  Mandatory Label High Mandatory Level    findstr  c  Enabled group   gt  nul   amp  amp  set IS ELEVATED 1 if  IS ELEVATED   0       echo You must run the command prompt as administrator to install      exit  b 1     This definitely worked for me and the principle seems to be sound  from MSFT s Chris Jackson      When you are running elevated  your token contains an ACE called Mandatory Label High Mandatory Level

[windows] How to detect if CMD is running as Administrator/has elevated privileges?

Examples related to windows

Examples related to command-line

Examples related to cmd