检测另一个进程是否以“以管理员身份运行”启动

Question

我们的应用程序需要通过COM接口与另一个程序进行通信。如果其他程序以“以管理员身份运行”启动，该界面将不起作用。想要检测这个其他进程是否处于这种状态并警告用户。有任何想法吗？

寻找.NET语言（C＃或VB.NET）。

TIA

Answer 1

你可以尝试这样的事情：

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Runtime.InteropServices; 
using System.Diagnostics; 
using System.Security.Principal; 
using System.Reflection; 

namespace WindowsFormsApplication2 
{ 

    public class ProcessHelper 
    { 
     [DllImport("advapi32.dll", SetLastError = true)] 
     private static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle); 

     [DllImport("kernel32.dll", SetLastError = true)] 
     private static extern bool CloseHandle(IntPtr hObject); 

     private const int STANDARD_RIGHTS_REQUIRED  = 0xF0000; 
     private const int TOKEN_ASSIGN_PRIMARY   =0x1; 
     private const int TOKEN_DUPLICATE     = 0x2; 
     private const int TOKEN_IMPERSONATE    = 0x4; 
     private const int TOKEN_QUERY      = 0x8; 
     private const int TOKEN_QUERY_SOURCE    = 0x10; 
     private const int TOKEN_ADJUST_GROUPS   = 0x40; 
     private const int TOKEN_ADJUST_PRIVILEGES  = 0x20; 
     private const int TOKEN_ADJUST_SESSIONID   = 0x100; 
     private const int TOKEN_ADJUST_DEFAULT   = 0x80; 
     private const int TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_SESSIONID | TOKEN_ADJUST_DEFAULT); 

     public static bool IsProcessOwnerAdmin(string processName) 
     { 
      Process proc = Process.GetProcessesByName(processName)[0]; 

      IntPtr ph = IntPtr.Zero; 

      OpenProcessToken(proc.Handle, TOKEN_ALL_ACCESS, out ph); 

      WindowsIdentity iden = new WindowsIdentity(ph); 

      bool result = false; 

      foreach (IdentityReference role in iden.Groups) 
      { 
       if (role.IsValidTargetType(typeof(SecurityIdentifier))) 
       { 
        SecurityIdentifier sid = role as SecurityIdentifier; 

        if (sid.IsWellKnown(WellKnownSidType.AccountAdministratorSid) || sid.IsWellKnown(WellKnownSidType.BuiltinAdministratorsSid)) 
        { 
         result = true; 
         break; 
        } 
       } 
      } 

      CloseHandle(ph); 

      return result; 
     } 
    } 

    static class Program 
    { 
     [STAThread] 
     static void Main() 
     { 
      bool isAdmin = ProcessHelper.IsProcessOwnerAdmin("outlook"); 
     } 
    } 
} 

这也可能是一个很好的事情有：Well-known security identifiers in Windows operating systems

这应该是一个很好的起点:-)