TOPIC:

program IsAdmin;

{$mode objfpc}{$H+}

uses
  {$IFDEF UNIX}{$IFDEF UseCThreads}
  cthreads,
  {$ENDIF}{$ENDIF}
  Classes, SysUtils, Windows, CustApp

type

  { TCheckIsAdmin }

  TCheckIsAdmin = class(TCustomApplication)
  protected
    function IsAdmin: Boolean;
    procedure DoRun; override;
  public
    constructor Create(TheOwner: TComponent); override;
    destructor Destroy; override;
  end;

{ TCheckIsAdmin }

function TCheckIsAdmin.IsAdmin: Boolean;
const
  SECURITY_NT_AUTHORITY: TSIDIdentifierAuthority = (Value: (0, 0, 0, 0, 0, 5));
  SECURITY_BUILTIN_DOMAIN_RID = $00000020;
  SE_GROUP_ENABLED            = $00000004;
  SE_GROUP_USE_FOR_DENY_ONLY  = $00000010;
  DOMAIN_ALIAS_RID_ADMINS     = $00000220;
var
  Sid: PSID;
  CheckTokenMembership: function(TokenHandle: THandle; SidToCheck: PSID; var IsMember: BOOL): BOOL; stdcall;
  IsMember: BOOL;
  Token: THandle;
  GroupInfoSize: DWORD;
  GroupInfo: PTokenGroups;
  I: Integer;
begin
  Result := False;

  if Win32Platform <> VER_PLATFORM_WIN32_NT then // Windows 9x/Me
  begin
    Result:=True;
    Exit;
  end;

  if not AllocateAndInitializeSid(SECURITY_NT_AUTHORITY, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, Sid) then
    Exit;

  try
    CheckTokenMembership:=nil;
    if Lo(GetVersion) >= 5 then
      Pointer(CheckTokenMembership):=GetProcAddress(GetModuleHandle(advapi32), 'CheckTokenMembership');

    if Assigned(CheckTokenMembership) then
    begin
      if CheckTokenMembership(0, Sid, IsMember) then
        Result:=IsMember;
    end
    else
    begin
      GroupInfo := nil;
      if not OpenThreadToken(GetCurrentThread, TOKEN_QUERY, True, Token ) then
      begin
        if GetLastError <> ERROR_NO_TOKEN then
          Exit;
        if not OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, Token) then
          Exit;
      end;

      try
        GroupInfoSize := 0;
        if not GetTokenInformation(Token, TokenGroups, nil, 0, GroupInfoSize) and
           (GetLastError <> ERROR_INSUFFICIENT_BUFFER) then
          Exit;

        GetMem(GroupInfo, GroupInfoSize);
        if not GetTokenInformation(Token, TokenGroups, GroupInfo, GroupInfoSize, GroupInfoSize) then
          Exit;

        for I := 0 to GroupInfo^.GroupCount-1 do
         if EqualSid(Sid, GroupInfo^.Groups[I].Sid) and
            (GroupInfo^.Groups[I].Attributes and (SE_GROUP_ENABLED or SE_GROUP_USE_FOR_DENY_ONLY) = SE_GROUP_ENABLED) then
         begin
           Result:=True;
           Break;
         end;
      finally
        FreeMem(GroupInfo);
        CloseHandle(Token);
      end;
    end;
  finally
    FreeSid(Sid);
  end;
end;

procedure TCheckIsAdmin.DoRun;
begin
  if IsAdmin then
  begin
   WriteLn('Admin');
   ExitProcess(0);
  end
  else
  begin
   WriteLn('User');
   ExitProcess(1);
  end;
end;

constructor TCheckIsAdmin.Create(TheOwner: TComponent);
begin
  inherited Create(TheOwner);
end;

destructor TCheckIsAdmin.Destroy;
begin
  inherited Destroy;
end;

var
  Application: TCheckIsAdmin;
begin
  Application:=TCheckIsAdmin.Create(nil);
  Application.Title:='CheckIsAdmin';
  Application.Run;
  Application.Free;
end.