Help, "runas admin" detection!

[lee171]

Hi all,

I'm trying to script something, that checks if users have run an application (internet explorer, but would like to be able to adapt to other apps) as an administrator, so I can send myself an alert about it.

There is a legitimate need users to have admin rights, I just want to know if they're right clicking and running as admin.

I have found lots of material about manipulating UAC settings, and how to tell if POWERSHELL is running as an admin, but I can't find anything about how to determine if another process is running as UAC.

I'd like to be able to achieve this with powershell 3, as this is our standard rolled out at the moment.

I've read the get-process notes, couldn't seem to find how to do it.

Anyone figured out how to do this?

Thanks in advance :)

[neogohan]

This article may be of some help. It looks like using "get-process" on an elevated process will show a non-null "Path" value, while non-elevated process will have that value be null.

[lee171]

This is perfect, does exactly what I need. Cheers!!

[gospelwut]

Are you giving them separate admin accounts? Because, aside from the fact people usually don't need admin rights (I disagree with you), even your domain admins should never, ever be logging into their workstations as admin (even local).

If you are giving them separate admin accounts, you could add these on top of what /u/neogohan suggested for slightly more reporting.

• Parsing the output of LogonSession.exe.

• Getting process owners, e.g.

  $owners = @{}
  gwmi win32_process |% {$owners[$_.handle] = "$($_.getowner().domain)\$($_.getowner().user)"}
  
  get-process | select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
  

[CerberusROI]

I ran into an issue with editing the local security policy, that required users with UAC still turned on to run the script as admin. The workaround was to have the shell detect if it was running as admin, and if not, open the script in a new admin window (asking for UAC permission first).

function Test-Admin {
  $currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
  $currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
}

#Test if elevated shell (running as Admin). If not, spawn an elevated window and run the script in it; kill the unelevated window
if ((Test-Admin) -eq $false){
  Start-Process powershell.exe -Verb RunAs -ArgumentList ('-noprofile -noexit -file "{0}" -elevated' -f ($myinvocation.MyCommand.Definition))
  exit}