Function IsElevated

platform/windows/privilege.go:45–62

IsElevated reports whether the current process has the Administrators group in its effective token — i.e. WinDivertOpen will succeed (modulo driver state). We check via CheckTokenMembership against the well-known SECURITY_BUILTIN_DOMAIN_RID \ DOMAIN_ALIAS_RID_ADMINS SID. This is the standard Win32

()

// standard Win32 pattern and works for both Run-as-admin sessions and
// services running under LocalSystem.
func IsElevated() (bool, error) {
	var sid *windows.SID
	err := windows.AllocateAndInitializeSid(
		&windows.SECURITY_NT_AUTHORITY,
		2,
		windows.SECURITY_BUILTIN_DOMAIN_RID,
		windows.DOMAIN_ALIAS_RID_ADMINS,
		0, 0, 0, 0, 0, 0,
		&sid,
	)
	if err != nil {
		return false, err
	}
	defer windows.FreeSid(sid)

	// Passing a zero token uses the impersonation token of the calling thread.
	return checkTokenMembership(0, sid)
}