Is Domain User a Local Administrator?

Keywords: 	 Domain User Local Administrator

Question:

How do I determine if a domain user is in the local administrators group?

Answer:

wntUserProps only returns information for users with an account on "server", not for domain users. Make sure the user really have an account on the current machine, and not simply a domain user.

How about just using wntMemberGet() to see if they are a member of the Local Administrators group?

Question (cont'd):

If the user gets local admin rights via a global group (e.g. domain group) is there a way to tell? We do account administration via global groups, so there are really no members of the local groups directly. The local groups contain the global domain groups, which contain the users and the local groups are the ones that grant the appropriate permissions.

Answer:

That depends on what exactly you expect from the "administrator" to be able to accomplish. Because there is a whole bunch of user rights that may or may not be granted to any particular user. For example, the Grand Master Administrator of a huge network may grant some of his privileges to the so called "power users", which will be able, for instance, install new programs, but will not be able to install new drivers, or something like that. So the best way to answer the question whether the current user is powerful enough to perform the operation you need is to try to perform that operation and check the result for the errors.

Currently I don't think that WinBatch has any way of determining your "effective" rights.
You could use the network extender to determine what groups (global and local) that your user belongs to. You could then check to see if your user belongs to the local administrators group or if any of the global groups that the user belongs to are members of the local administrators group.
This could be implemented as a fairly simple list processing loop. Once the processing is done you have a yes/no answer as to whether or not there is a direct/indirect association between the user and the local administrators group.
The way I do it is to check and see if they have network access to an admin only share as follows:
```
If FileExist( "\\%ComputerName%\ADMIN$\System32\Services.EXE" ) Then Message( "xx", "They are an Admin" )
```
It's fairly reliable but does have problems.
- You must get the computername (snag it from the environment or use a net extender call).
- Some users (who are admins) delete the admin share. I fix this by trying to put it back (with a RUN NET SHARE ADMIN$) before testing if they are an admin or not. Sharing it back will fail if they aren't an admin but the end result is that you get the answer you're looking for.
Of course, some times it is easier to determine your level of rights by attempting to perform some administrative action and being prepared to trap any errors that occur due to lack of privileges. This works sort of like saying, "If I can do this one task then I know that I am privileged for all other admin tasks." This is not the best way but some times it is the only sure way to know.
Another user reported:
We created a specific user account which is a local admin on all workstations. Our deployment procedure includes insuring that this user is added to the local admin group.
We then autolog this user in conjunction with the runonce command for Software Delivery purposes.
And yet another user offered the following:
I would like to contribute my technique for simply determining if the current NT user has admin rights:
```
Admin = 0                                     ; Initialize Flag to false
AddExtender('WWWNT34I.DLL')                   ; WinNT Network Functions
username = StrTrim(wntGetUser(@default))      ; Current user logged on network
;************************** AdminTest
BoxCaption(1,'Checking Admin Privileges for %username%')
RegKey = 'SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce[AdminTest]'

ErrorMode(@OFF)    ; Suppress error if attempt fails
RegSetValue(@REGMachine, RegKey, 'cmd.exe')   ; Key can only be written by an Administrator
ErrorMode(@NOTIFY)

if RegExistValue(@REGMachine, RegKey) 
   Admin = 1
   RegDelValue(@REGMachine, RegKey)
endif 
```
One of our developers commented on the above suggestion as follows:
I use this method also. It works on default windows installations, but it can easily be broken by modifying the security entries on the registry keys.
Being an admin does not mean oyu have security access to everything, but it does generally mean that you can alter the security access so that you can.
However the breaking is theoretical, I've never seen a machine where someone had managed to break the above trick, so I think it is pretty safe.

Article ID:   W14266

Filename:   Is Domain User a Local Admin.txt

File Created: 2001:11:21:11:44:28

Last Updated: 2001:11:21:11:44:28

Database Search

TechHome

Is Domain User a Local Administrator?

Question:

Answer:

Question (cont'd):

Answer: