21.7 Determining Whether the Current User Is an Administrator

21.7 Determining Whether the Current User Is an Administrator

You want to determine whether the current user is an administrator.

Technique

To determine whether the current user is an administrator, you obtain a WindowsPrincipal object that represents the Windows account and group under which the current thread is running and then use the WindowsPrincipal.IsInRole() method. The following code shows the technique:

 WindowsIdentity me = WindowsIdentity.GetCurrent(); WindowsPrincipal principal = new WindowsPrincipal(me); bool isAdministrator = principal.IsInRole(WindowsBuiltInRole.Administrator); if (isAdministrator)         Console.WriteLine("Running under an administrator account "); 

In this code, we first obtain a WindowsIdentity object, which represents the Windows account under which we are running. We easily obtain it using the static WindowsIdentity.GetCurrent() method. Given an identity, we can obtain the corresponding principal by passing the identity to the WindowsPrincipal constructor. Note that both WindowsPrincipal and WindowsIdentity are defined in the namespace System.Security.Principal :

 using System.Security.Principal; 

The previous code is useful for a single use of a principal object. However, if you want to repeatedly access role-based security information, you can gain a cumulative performance benefit by caching the information in the Thread object that represents the current thread. The following code illustrates this technique:

 AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal); WindowsPrincipal principal = (WindowsPrincipal)Thread.CurrentPrincipal; bool isAdministrator = principal.IsInRole(WindowsBuiltInRole.Administrator); if (isAdministrator)         Console.WriteLine("Running under an administrator account "); 

The use of the principal here is identical to that in the earlier code. However, you now directly obtain the principal from the Thread object, using the static System.Threading.Thread.CurrentPrincipal property. The first line of this code, which invokes the SetPrincipalPolicy() method of the AppDomain instance for the application domain in which the code is executing, is what instructs the current thread to retrieve and cache the current Windows principal. Note that Thread.CurrentPrincipal is explicitly cast to a WindowsPrincipal object. This property is defined to return an IPrincipal interface, reflecting the fact that it is possible to set other principal policies that do not link to Windows accounts.

Comments

You perform the test of whether you are running as an administrator using the WindowsBuiltInRole enumeration. You no doubt have guessed that this enumeration contains a value for each of the groups that can come out of the box with Windows. For example, to test whether the account you are running under is a power user, use the following:

 bool isAdministrator = principal.IsInRole(WindowsBuiltInRole.PowerUser); 

The possible values of the Windows BuiltInRole enum are AccountOperator , Administrator , BackupOperator , Guest , PowerUser , PrintOperator , Replicator , SystemOperator , and User .