Question:
I needed to check whether the currently logged on user is an administrator however found that just using ‘net localgroup administrators’ was insufficient when it came to AD groups being a member of the administrators group.
[Edit:] It is easy to confuse administrator privilege in general with elevated privileges of a specific instance and I just want to highlight that this question/answer does not deal with process elevation status checking. The requirement is to generally ascertain whether or not a logged on user is an administrators group member. Much more common is the need to determine whether or not your script is running with administrator privileges. If this is what you require then please look here instead: Administrative privileges
In this particular case, there is a policy disabling the admin shares (ruling out a previous technique I used with Windows XP of testing for the existence of the admin share using \127.0.0.1\admin$ to determine if the current user is an administrator).
[/Edit]
Below is the code I gathered and wrote see if the logged on user is an administrator.
I hope this helps someone else who requires the same thing that I did.
If anyone can provide a more elegant solution it would be appreciated!
Answer:
If you want to determine if the current user is a member of the local Administrators group (even if not elevated), here are some options.
1 2 3 4 |
$null -ne (whoami /groups /fo csv | ConvertFrom-Csv | Where-Object { $_.SID -eq "S-1-5-32-544" }) |
You can also use isadmin.exe (https://westmesatech.com/?page_id=23) and check for an exit code of 2 (member of administrators, but not enabled, hence not elevated).