C# Signature:

[DllImport("advapi32.dll", SetLastError=true)]
static extern bool CheckTokenMembership(IntPtr TokenHandle, IntPtr SidToCheck, out bool IsMember);

User-Defined Types:

None.

VB.Net Signature

    Declare Function CheckTokenMembership Lib "advapi32.dll" ( _
    ByVal TokenHandle As IntPtr, _
    ByVal SidToCheck As IntPtr, _
    ByRef IsMember As Boolean _
    ) As Boolean

Notes:

    'BOOL CheckTokenMembership(
    '  HANDLE TokenHandle,
    '  PSID SidToCheck,
    '  PBOOL IsMember
    ');

None.

Tips & Tricks:

Please add some!

VB.Net Sample Code:

    Dim LogonProvider, LogonType As Integer
    Dim Token, ImpersonatedToken, AdminGroup As IntPtr
    Dim NtAuthority As SID_IDENTIFIER_AUTHORITY
    Dim IsAdmin As Boolean

Sample Code:

Please add some!

    LogonType = LOGON32_LOGON_INTERACTIVE
    LogonProvider = LOGON32_PROVIDER_DEFAULT
    ReDim NtAuthority.Value(6)
    NtAuthority.Value(5) = SECURITY_NT_AUTHORITY

Alternative Managed API:

Do you know one? Please contribute it!

    ' First step is to validate the credentials
    If Not LogonUser(strUser, strDomain, strPassword, LogonType, LogonProvider, Token) Then
        MsgBox("Couldn't validate user with provided credentials")
        Exit Sub
    End If

    ' Next we create an impersonation token
    If Not DuplicateToken(Token, SECURITY_IMPERSONATION, ImpersonatedToken) Then
        MsgBox("Yikes, couldn't impersonate the user")
        Exit Sub
    End If

    ' Next we build the SID for the local Administrators group
    If Not AllocateAndInitializeSid(NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, AdminGroup) Then
        MsgBox("Yikes, couldn't create the Local Admininstrator Group's SID")
        Exit Sub
    End If

    ' Lastly, we check to see if the impersonated token is in the Admin Group
    If Not CheckTokenMembership(ImpersonatedToken, AdminGroup, IsAdmin) Then
        MsgBox("Yikes, couldn't check membership")
        Exit Sub
    End If

    FreeSid(AdminGroup)
    MsgBox("IsAdmin=" & IsAdmin)

Alternative Managed API:

Do you know one? Please contribute it!

Please edit this page!

Do you have...

• helpful tips or sample code to share for using this API in managed code?
• corrections to the existing content?
• variations of the signature you want to share?
• additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).