windows-vista - vbscript检测UAC是否提升

Question

我的 vbscript 如何检测它是否在 UAC 提升的上下文中运行？

我没有问题检测用户，并查看用户是否在管理员组内。但这仍然没有回答在 Vista 或 Windows 2008 下运行时进程是否已提升 privs 的问题。请注意，我只需要检测此状态；不要试图提升或(错误..)降低提升。

Answer 1

我最终确定的方法取决于 Vista 和 Windows 2008 具有 whoami.exe 实用程序这一事实，它会检测拥有该进程的用户的完整性级别。几个屏幕截图在这里有帮助:

WHOAMI, normal and elevated, on Vista http://lh3.ggpht.com/_Svunm47buj0/SQ6ql4iNjPI/AAAAAAAAAeA/iwbcSrAZqRg/whoami%20-%20adminuser%20-%20groups%20-%20cropped.png?imgmax=512

您可以看到，当 cmd 运行提升时，whoami/groups 报告“高”强制完整性级别和与非提升运行时不同的 SID。在图片中，顶部 session 是正常的，下面的 session 在 UAC 提示后运行提升。

知道这一点，这是我使用的代码。它主要检查操作系统版本，如果是 Vista 或 Server 2008，则调用运行 whoami.exe/groups 的 CheckforElevation，并在输出中查找字符串 S-1-16-12288。在这个例子中，我只是回显状态；在实际脚本中，我根据结果分支到不同的操作。

sub GetOSVersion
Dim strComputer, oWMIService, colOSInfo, oOSProperty, strCaption, strOSFamily
strComputer = "."
Set oWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colOSInfo = oWMIService.ExecQuery("Select * from Win32_OperatingSystem")
'I hate looping through just to get one property. But dunno another way!
For Each oOSProperty in colOSInfo 
  strCaption = oOSProperty.Caption 
Next
If InStr(1,strCaption, "Vista", vbTextCompare) Then strOSFamily = "Vista"
If InStr(1,strCaption, "2008", vbTextCompare) Then strOSFamily = "2008"
If InStr(1,strCaption, "XP", vbTextCompare) Then strOSFamily = "XP"
If InStr(1,strCaption, "2003", vbTextCompare) Then strOSFamily = "2003"
If InStr(1,strCaption, "2000", vbTextCompare) Then strOSFamily = "2000"
If strOSFamily = "" Then 
    Wscript.Echo "No known OS found. (Script can detect Windows 2000, 2003, XP, Vista, 2008.)" 
Else 
    Wscript.Echo "OS Family = " & strOSFamily
End If
Select Case strOSFamily 'if Vista/2008 then call CheckforElevation
Case "Vista"
    CheckforElevation
Case "2008"
    CheckforElevation
Case Else
    Exit Sub
End Select
end sub

sub CheckforElevation 'test whether user has elevated token 
Dim oShell, oExecWhoami, oWhoamiOutput, strWhoamiOutput, boolHasElevatedToken
Set oShell = CreateObject("WScript.Shell")
Set oExecWhoami = oShell.Exec("whoami /groups")
Set oWhoamiOutput = oExecWhoami.StdOut
strWhoamiOutput = oWhoamiOutput.ReadAll
If InStr(1, strWhoamiOutput, "S-1-16-12288", vbTextCompare) Then boolHasElevatedToken = True
If boolHasElevatedToken Then
    Wscript.Echo "Current script is running with elevated privs."
Else
    Wscript.Echo "Current script is NOT running with elevated privs."
End If
end sub