Best way to know if a user has administrative priv

Question

I need to check whether the user executing the script has administrative privileges on the machine.

I have specified the user executing the script because the script could have been executed with a user other than the logged on using something similar to "Runas".

@Javier: Both solutions work in a PC with an English version of Windows installed but not if the installed is in different language. This is because the Administrators group doesn't exist, the name is different for instance in Spanish. I need the solution to work in all configurations.

Answer 1

What about checking for "\\computername\Admin$\system32"?

function IsLoggedInAsAdmin()
    isAdmin = false
    set shell = CreateObject("WScript.Shell")
    computername = WshShell.ExpandEnvironmentStrings("%computername%")
    strAdmin = "\\" & computername & "\Admin$\System32"

    isAdmin = false

    set fso = CreateObject("Scripting.FileSystemObject")

    if fso.FolderExists(strAdmin) then
        isAdmin = true
    end if

    IsLoggedInAsAdmin = isAdmin
end function

Answer 2

By doing this you break scenarios where the user has the required privs for your script but does not belong to Administrators. Instead of checking for group membership, check for the specific abilities you require.

Answer 3

Using "localhost" instead of the real hostname increases the script runtime about 10x!
My final code is:

' get_admin_status.vbs
Option Explicit

Dim oGroup:   Set oGroup   = GetObject("WinNT://localhost/Administrators,group")
Dim oNetwork: Set oNetwork = CreateObject("Wscript.Network")

Dim sSearchPattern: sSearchPattern = "WinNT://" & oNetwork.UserDomain & "/" & oNetwork.UserName

Dim sMember
For Each sMember In oGroup.Members
  If sMember.adsPath = sSearchPattern Then
    ' Found...
    Call WScript.Quit(0)
  End If
Next

' Not found...
Call WScript.Quit(1)

This script returns exit code 0 if the current user is a local admin.
Usage: cscript.exe get_admin_status.vbs

Answer 4

I know this thread is very old and marked answered but the answer isn't really giving what the OP asked about.

For anyone else searching and finding this page, here is an alternative that does report based on rights not group membership so Runas Administrator shows admin rights as True.

Option Explicit 

msgbox isAdmin(), vbOkonly, "Am I an admin?"

Private Function IsAdmin()
    On Error Resume Next
    CreateObject("WScript.Shell").RegRead("HKEY_USERS\S-1-5-19\Environment\TEMP")
    if Err.number = 0 Then 
        IsAdmin = True
    else
        IsAdmin = False
    end if
    Err.Clear
    On Error goto 0
End Function

Answer 5

This article has a nice chunk of code on how to enumerate the members of a group (copied here for convenience and edited to not use email address):

Function RetrieveUsers(domainName,grpName)

dim GrpObj
dim mbrlist
dim mbr

'-------------------------------------------------------------------------------
' *** Enumerate Group Members ***
'-------------------------------------------------------------------------------

' Build the ADSI query and retrieve the group object
Set GrpObj = GetObject("WinNT://" & domainName & "/" & grpName & ",group")

' Loop through the group membership and build a string containing the names
for each mbr in GrpObj.Members
   mbrlist = mbrlist & vbTab & mbr.name & vbCrLf
Next

RetrieveUsers=mbrlist

End Function

You can then write a function to see if a user is in the list...

Function IsAdmin(user)
    IsAdmin = InStr(RetrieveUsers("MachineName", "Administrators"), user) > 0
End Function

...and call it like this:

If IsAdmin("LocalAccount") Then
    Wscript.Echo "LocalAccount is an admin"
Else
    Wscript.Echo "LocalAccount is not an admin"
End If

Answer 6

User may be not in local administrator group. For example - domain admins. UAC usually blocks admin access to registry, shares e.t.c. even for administrators(onl y manual "run as admin" gets right)...

Here is my crazy way:

Set Shell = CreateObject("WScript.Shell")
set fso = CreateObject("Scripting.FileSystemObject")
strCheckFolder = Shell.ExpandEnvironmentStrings("%USERPROFILE%") 
strCheckFolder = strCheckFolder+"\TempFolder"

if fso.FolderExists(strCheckFolder) then
        fso.DeleteFolder(strCheckFolder)
end if

fso.CreateFolder(strCheckFolder)
tempstr = "cmd.exe /u /c chcp 65001 | whoami /all >" & strCheckFolder & "\rights.txt"
Shell.run tempstr

tempstr = strCheckFolder & "\rights.txt"
WScript.Sleep 200
Set txtFile = FSO.OpenTextFile(tempstr,1)

IsAdmin = False

Do While Not txtFile.AtEndOfStream
  x=txtFile.Readline
  If InStr(x, "S-1-5-32-544") Then
      IsAdmin = True
  End If
Loop

txtFile.Close