Is there a way to determine if a program needs to run as administrator if you only know the filename?

Question

Is there a way to determine if a program needs to run as administrator if you only know the filename?

Devon Nullman 21

Example - I have a program called "Recuva" it is located ay C:\Program Files\Recuva\recuva64.exe - It asks for approval to run as an admin if I start it but I want to know that before I start it knowing only the filename. Same for several other programs.

RLWA32 49,541 Reputation points

2023-03-06T10:48:52.3833333+00:00

@Devon Nullman You received two answers to your question and both provided code. So has your issue been resolved?
Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2023-03-09T08:01:12.3833333+00:00

Hi @Devon Nullman ,

May I know if your problem has been solved or not?

If not, it will be great if you can share more detailed information for us to better investigate this issue.

If solved, you could accept the helpful answer to change its status to Answered. It will also help others to solve the similar issue.

Thanks for your cooperation.

2 answers

Your answer

RLWA32 49,541 Reputation points

2023-03-06T10:48:52.3833333+00:00

@Devon Nullman You received two answers to your question and both provided code. So has your issue been resolved?
Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2023-03-09T08:01:12.3833333+00:00

Hi @Devon Nullman ,

May I know if your problem has been solved or not?

If not, it will be great if you can share more detailed information for us to better investigate this issue.

If solved, you could accept the helpful answer to change its status to Answered. It will also help others to solve the similar issue.

Thanks for your cooperation.

Answer 1

RLWA32 49,541

It is possible to check if an executable requires elevated privileges as an Administrator before starting it. The most general case requires that the target executable has a manifest that contains -

and it is possible to examine the .exe to determine if requireAdministrator is present.

However, there are several variations. For example, if the manifest contains -

then elevation will only be requested if the application is started by a member of the Administrators group. Another possibility is for the the elevation request to be contained in a shortcut that starts the executable instead of in the executable's manifest. Yet another possibility is for the application to "self-elevate" after it begins running by restarting itself using ShellExecute and the "runas" verb.

So which of the above scenarios is applicable to your question?

RLWA32 49,541

Sample VB.Net Console Application to get runlevel from embedded manifest

Imports System

Module Program
    Public Const ACTCTX_FLAG_RESOURCE_NAME_VALID As UInteger = 8
    Public Const RunlevelInformationInActivationContext As UInteger = 5
    Public Const INVALID_HANDLE_VALUE As Integer = -1

    <StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
    Public Structure ACTCTX
        Public cbSize As Integer
        Public dwFlags As UInteger
        Public lpSource As String
        Public wProcessorArchitecture As System.UInt16
        Public wLangId As Int16
        Public lpAssemblyDirectory As String
        Public lpResourceName As IntPtr
        Public lpApplicationName As String
        Public hModule As IntPtr
    End Structure

    Enum ACTCTX_REQUESTED_RUN_LEVEL As Integer
        Unspecified = 0
        asInvoker = 1
        highestAvailable = 2
        requireAdministrator = 3
        RUN_LEVEL_NUMBERS = 4
    End Enum

    <StructLayout(LayoutKind.Sequential)>
    Public Structure ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION
        Public ulFlags As UInteger
        Public RunLevel As ACTCTX_REQUESTED_RUN_LEVEL
        Public UIAccess As UInteger
    End Structure

    <DllImport("kernel32.dll", CharSet:=CharSet.Unicode, SetLastError:=True)>
    Private Function CreateActCtx(ByRef actx As ACTCTX) As IntPtr

    End Function

    <DllImport("kernel32.dll", ExactSpelling:=True, SetLastError:=True)>
    Private Function QueryActCtxW(ByVal Flags As UInteger,
                                 ByVal hActCtx As IntPtr,
                                 ByVal pvSubInstance As IntPtr,
                                 ByVal ulInfoClass As UInteger,
                                 ByRef buffer As ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION,
                                 ByVal cbBuffer As IntPtr,
                                 ByRef cbWrittenOrRequired As IntPtr) As Boolean
    End Function

    Sub Main(args As String())
        Dim rli As ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION = New ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION()
        Dim actctx As ACTCTX = New ACTCTX()
        Dim cbSize As IntPtr = IntPtr.Zero
        Dim hActCtx As IntPtr = IntPtr.Zero
        Dim cbrli As IntPtr = Marshal.SizeOf(rli)

        If (args.Length < 1) Then
            Console.WriteLine("Fully qualified path to target .exe missing")
            Return
        End If

        actctx.cbSize = Marshal.SizeOf(actctx)
        actctx.dwFlags = ACTCTX_FLAG_RESOURCE_NAME_VALID
        actctx.lpResourceName = 1
        actctx.lpSource = args(0)

        hActCtx = CreateActCtx(actctx)
        If (hActCtx <> INVALID_HANDLE_VALUE) Then
            Dim fSuccess As Boolean = QueryActCtxW(0, hActCtx, IntPtr.Zero, RunlevelInformationInActivationContext,
                                        rli, cbrli, cbSize)
            If (fSuccess) Then
                Console.WriteLine($"RequestedExecutionLevel is {rli.RunLevel}")
            Else
                Console.WriteLine($"QueryActCtx failed: {New Win32Exception(Marshal.GetLastWin32Error()).Message}")
            End If
        Else
            Console.WriteLine($"CreateActCtx failed: {New Win32Exception(Marshal.GetLastWin32Error()).Message}")
        End If
    End Sub
End Module

Answer 2

Castorix31 90,681

A way to check is Elevation is required is with CheckElevation

nLevel returns > 0 is Elevation is required in this test :

            Dim nFlags = 8
            Dim nLevel = 0
            Dim nReason = 0           
            Dim nReturn As UInteger = CheckElevation("C:\Test.exe", nFlags, IntPtr.Zero, nLevel, nReason)

    <DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Unicode)>
    Public Shared Function CheckElevation(AppName As String, ByRef dwFlags As UInteger, hToken As IntPtr, ByRef dwLevel As UInteger, ByRef dwReason As UInteger) As UInteger
    End Function

RLWA32 49,541 Reputation points

2023-02-27T10:48:10.8166667+00:00

FWIW, CheckElevation is an undocumented function exported by kernel32.dll.

Share via

Is there a way to determine if a program needs to run as administrator if you only know the filename?

2 answers

Your answer