IsAdminUser 返回不正确的值

问题描述

我正在使用 Win32::IsAdminUser() 函数(无法粘贴代码，因为要使其可运行，我必须粘贴整个代码).它返回 0，我很好奇为什么因为运行它的用户是管理员组的成员，所以我创建了一个小测试函数(c++)并在运行之前运行它 IsAdminUser 这里是代码:

I'm using Win32::IsAdminUser() function (Can't paste code because to make it runnable I would have to paste whole code). It returns 0, I was curious why because the user with which this is run is member of Administrators group, so I created a little test function (c++) and run it right before running IsAdminUser Here is the code:

int davai()
{
FILE * fp;

fp = fopen ("C:\\tmp\\davai.txt", "a");
fprintf(fp, "shevedi davai");
fflush(fp);

HANDLE token = NULL;
HANDLE dupToken = NULL;

if(!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_DUPLICATE, &token))
{
  fprintf(fp, "davai: OpenProcessToken cheijva. %d\n", (int)GetLastError());
  fflush(fp);
}

if (DuplicateTokenEx(token, MAXIMUM_ALLOWED, NULL, SecurityDelegation,
                          TokenPrimary, &dupToken) == 0)
{
  fprintf(fp, "davai: OpenProcessToken DuplicateTokenEx. %d\n", (int)GetLastError());
  fflush(fp);
}

PTOKEN_GROUPS pPrivilegesToken = NULL;
DWORD cbSize = 0;

GetTokenInformation(dupToken, TokenGroups, NULL, 0, &cbSize);

pPrivilegesToken = (PTOKEN_GROUPS) LocalAlloc(LPTR, cbSize);

if (GetTokenInformation(dupToken, TokenGroups,
                             pPrivilegesToken, cbSize, &cbSize) == FALSE)
{
  fprintf(fp, "davai: GetTokenInformation cheijva. %d\n", (int)GetLastError());
  fflush(fp);
}

char * gio;

for (ULONG i = 0; i < pPrivilegesToken->GroupCount; i++)
{
  if (ConvertSidToStringSid(pPrivilegesToken->Groups[i].Sid, &gio) == 0)
  {
    fprintf(fp, "davai: ConvertSidToStringSid cheijva. %d\n", (int)GetLastError());
    fflush(fp);
  }

  fprintf(fp, "Value: %s\n",gio);
  fflush(fp);
}

LocalFree (gio);

return 1;
}

它只是打开当前进程令牌，并列出用户参与的所有组.这是我得到的输出:

which just opens current processes token, and lists all the groups that user is involved in. Here is the ouput I get:

shevedi davaiValue: S-1-5-21-1018819917-2920201817-244685803-513
Value: S-1-1-0
Value: S-1-5-21-1018819917-2920201817-244685803-1000
Value: S-1-5-32-544
Value: S-1-5-32-545
Value: S-1-5-4
Value: S-1-2-1
Value: S-1-5-11
Value: S-1-5-15
Value: S-1-5-5-0-179095
Value: S-1-2-0
Value: S-1-5-64-10
Value: S-1-16-12288

这很奇怪，因为 S-1-5-32-544 代表 Administrators 组.我搜索了是否有人有类似的问题，但找不到任何东西(我正在运行 Windows 7).也许你可以帮助我.任何帮助将不胜感激.

which is strange because S-1-5-32-544 represent Administrators group. I searched to find if someones has similar problem, but could not find anything (I'm running windows 7). Maybe you can help me. Any help would be appreciated.

推荐答案

真的 Win32::IsAdminUser() 在内部调用 CheckTokenMembership 函数和 SidToCheck == S-1-5-32-544 并返回给你 IsMember 结果.但是

really Win32::IsAdminUser() internally call CheckTokenMembership function with SidToCheck == S-1-5-32-544 and return you IsMember as result. but

如果 SID 存在并且具有 SE_GROUP_ENABLED 属性，IsMember 返回 TRUE；否则返回 FALSE.

和

即使令牌中存在 SID，系统也可能不会使用该 SID在访问检查中.SID 可能被禁用或具有SE_GROUP_USE_FOR_DENY_ONLY 属性.

真的，如果您的用户是管理员组的成员 (S-1-5-32-544) 但在没有提升的情况下运行(在 UAC 下)S-1-5-32-544 存在于令牌中，但仅具有 SE_GROUP_USE_FOR_DENY_ONLY 属性

really if you user is member of admin group (S-1-5-32-544) but run without elevation (under UAC) S-1-5-32-544 is present in token but with SE_GROUP_USE_FOR_DENY_ONLY attribute only

相比之下，提升的管理员具有此 SID 和 SE_GROUP_ENABLED 属性

in contrast elevated admins have this SID with SE_GROUP_ENABLED attribute

所以我猜你运行的不是提升的管理员.Win32::IsAdminUser() 并且在这种情况下必须返回 false

so i guess you run as not elevated admin. Win32::IsAdminUser() and must return false in this case

这篇关于IsAdminUser 返回不正确的值的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！