View source for Check if the current user is an Administrator

{{PageAuthor|CancerFace}}

<div style="background-color:#FFFFDD;border:1px solid #aaaa22;color:#333311;padding:0.4em"><b>Note:</b> NSIS v2.00 added the UserInfo plug-in, it allows you to detect the user type without any of the code on this page.</div>

NSIS forum [http://forums.winamp.com/showthread.php?s=&threadid=253904 thread]

== Description ==
I wanted to have the option of checking if a user belongs to the adminisrator's group without using a special plugin. This can be achieved using API calls with the System plugin.

There are 3 alternative implementations (2 macros and 1 function).

== Macros ==
The first macro works in Windows 2000 and later with correct UAC handling while the second one also works in NT but does not support UAC or restricted tokens.

=== Usage ===
Use the following code in your NSIS installer to find out if the user invoking it belongs to the administrator's group:
<highlight-nsis>
!insertmacro IsUserAdmin $0
; $0 = 1 if the user belongs to the administrator's group
; $0 = 0 if not
; $0 = -1 if there was an error (only for the 1st Macro)
</highlight-nsis>

=== Macro 1 (2k/XP/2k3)===
<highlight-nsis>
!macro IsUserAdmin RESULT
 !define Index "Line${__LINE__}"
   StrCpy ${RESULT} 0
   System::Call '*(&i1 0,&i4 0,&i1 5)i.r0'
   System::Call 'advapi32::AllocateAndInitializeSid(i r0,i 2,i 32,i 544,i 0,i 0,i 0,i 0,i 0, \
   i 0,*i .R0)i.r5'
   System::Free $0
   System::Call 'advapi32::CheckTokenMembership(i n,i R0,*i .R1)i.r5'
   StrCmp $5 0 ${Index}_Error
   StrCpy ${RESULT} $R1
   Goto ${Index}_End
 ${Index}_Error:
   StrCpy ${RESULT} -1
 ${Index}_End:
   System::Call 'advapi32::FreeSid(i R0)i.r5'
 !undef Index
!macroend
</highlight-nsis>

=== Macro 2 (NT/2k/XP/2k3) - doesn't work! ===
<highlight-nsis>
!define TOKEN_READ   0x00020008
!define TokenGroups  2

!macro IsUserAdmin RESULT
 !define Index "Line${__LINE__}"
 StrCpy ${RESULT} 0

 # Construct the SID for the Admin group - (S-1-5-32-544 for administrators) put in $R4
  System::Call "*(&i1 0,&i4 0,&i1 5)i.r0"
  System::Call  "advapi32::AllocateAndInitializeSid(i r0,i 2,i 32,i 544,i 0,i 0,i 0,i 0,i 0,\
  i 0,*i .R4)i.r5"
  System::Free $0

 # Get a psuedo-handle of the current process and place it on R0
  System::Call 'kernel32::GetCurrentProcess()i.R0'

 # Open the Token from the psuedo process and place the handle on R1
  System::Call 'advapi32::OpenProcessToken(i R0,i ${TOKEN_READ},*i .R1)i.R9'

 # Get info from the token and place it in $R2 (the size goes to $R3)
  System::Call 'advapi32::GetTokenInformation(i R1,i ${TokenGroups},*i .R2,i 0,*i .R3)i.R9'
  System::Alloc $R3
   Pop $R2
  System::Call 'advapi32::GetTokenInformation(i R1,i ${TokenGroups},i R2,i $R3,*i .R3)i.R9'

 # Check how many TOKEN_GROUPS elements are in $R2 (place the number in $R5)
  System::Call '*$R2(i.R5,i.R6)'

 # Compare the SID structures
  StrCpy $1 0
	
 ${Index}_Start:
  StrCmp $1 $R5 ${Index}_Stop
  System::Call 'advapi32::EqualSid(i R4,i R6)i.R9'
  StrCmp $R9 "" ${Index}_Increment
  StrCmp $R9 0 +1 +3
  StrCpy ${RESULT} 0
   Goto ${Index}_Increment
  StrCpy ${RESULT} 1
  System::Call 'advapi32::FreeSid(i R6)i.R8'
   Goto ${Index}_Stop
 ${Index}_Increment:
  System::Call 'advapi32::GetLengthSid(i R6)i.R9'
  System::Call 'advapi32::FreeSid(i R6)i.R8'
  IntOp $R6 $R6 + $R9
  IntOp $1 $1 + 1
  Goto ${Index}_Start

 ${Index}_Stop:
 # Close the token handle
  System::Call 'kernel32::CloseHandle(i R1)i.R9'

 # cleanup
  System::Call 'advapi32::FreeSid(i R4)i.r5'
  System::Free $R2
  System::Free 0

 !undef Index
!macroend
</highlight-nsis>

=== Macro 3 (Windows 2k or above) ===
I found that a Windows API can get the information of the specified user name, it's more easier than the above ways, I write it and so add it here. Any question please email jiake(at)vip.qq.com.
<highlight-nsis>
!define USER_PRIV_GUEST 0
!define USER_PRIV_USER  1
!define USER_PRIV_ADMIN 2

!include "Util.nsh"
!define GetUserLevel "!insertmacro Call_GetUserLevel"
!macro Call_GetUserLevel _level _username
    !verbose push
    !verbose 3
    Push ${_username}
    ${CallArtificialFunction} Func_GetUserLevel
    Pop ${_level}
    !verbose pop
!macroend
!macro Func_GetUserLevel
    Exch $R0
    Push $R1
    System::Call "*(i)i.R1"
    System::Call "netapi32::NetUserGetInfo(in,wR0,i1,iR1)i.R0"
    IntCmp $R0 0 +3
    Push error
    Goto lbl_end
    System::Call "*$R1(i.R0)"
    System::Call "*$R0(w,w,i,i.s)"
    System::Call "netapi32::NetApiBufferFree(iR0)"
lbl_end:
    System::Free $R1
    Exch
    Pop $R1
    Exch
    Pop $R0
!macroend
</highlight-nsis>
Usage example:
<highlight-nsis>
; ${GetUserLevel} VAR_USER_LEVEL_OUT STRING_OR_VAR_USERNAME
; STRING_OR_VAR_USERNAME:
;   A valid username.
; VAR_USER_LEVEL_OUT:
;   A variable to store the result, it can be:
;     ${USER_PRIV_GUEST} (0) A guest account.
;     ${USER_PRIV_USER}  (1) A limited account.
;     ${USER_PRIV_ADMIN} (2) An administrator account.
;     error                  An error ocurred while calling.
ReadEnvStr $R0 UserName
${GetUserLevel} $0 $R0
MessageBox MB_OK "The user $R0's level is $0."
${GetUserLevel} $0 Administrator
MessageBox MB_OK "The user Administrator's level is $0."
</highlight-nsis>

== Function (by Afrow UK) ==
Based on [http://vcfaq.mvps.org/sdk/21.htm this code]
<span style="color: #f00">Note: After testing in the field, this function does not always work. Use the other function or use the included NSIS UserInfo plug-in (UserInfo::GetAccountType).</span><highlight-nsis>!define SC_MANAGER_LOCK 8
!define ERROR_SERVICE_DATABASE_LOCKED 1055

Function IsUserAdmin
Push $R0
Push $R1
Push $R2

  StrCpy $R0 0

  System::Call `advapi32::OpenSCManager(i 0, i 0, i ${SC_MANAGER_LOCK}) i.R1`
  ${If} $R1 != 0
    System::Call `advapi32::LockServiceDatabase(i R1) i.R2`
    ${If} $R2 != 0
      System::Call `advapi32::UnlockServiceDatabase(i R2)`
      StrCpy $R0 1
    ${Else}
      System::Call `kernel32::GetLastError() i.R2`
      ${If} $R2 == ${ERROR_SERVICE_DATABASE_LOCKED}
        StrCpy $R0 1
      ${EndIf}
    ${EndIf}
    System::Call `advapi32::CloseServiceHandle(i R1)`
  ${EndIf}

Pop $R2
Pop $R1
Exch $R0
FunctionEnd</highlight-nsis>
=== Usage ===
<highlight-nsis>Call IsUserAdmin
Pop $0
; $0 = 1 if the user belongs to the administrator's group
; $0 = 0 if not</highlight-nsis>

== Resources and Links ==
* NSIS forum [http://forums.winamp.com/showthread.php?s=&threadid=253904 thread]
* [http://nsis.sourceforge.net/XtInfoPlugin_plug-in XtInfo Plugin]

API Functions used:
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/netmgmt/netmgmt/netuseradd.asp AllocateAndInitializeSid]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/getcurrentprocess.asp GetCurrentProcess]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/openprocesstoken.asp OpenProcessToken]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/gettokeninformation.asp GetTokenInformation]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/equalsid.asp EqualSid]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/freesid.asp FreeSid]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/getlengthsid.asp GetLengthSid]
* [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/closehandle.asp CloseHandle]


----


[[Category:User Accounts Related Functions]]