Checking for privileges
Windows maintains two different security related information: permissions and privileges
Permissions apply to particular objects. They control if a user can read, write, delete, etc.
a particular file, manage a certain printer, or access a specifc registry key. Permissions never apply to
some abstract group, but always to a very specifc object. To manage permissions, Windows uses ACLs.
Privileges, on the other hand, are enforced system wide. They define if a user or group has the
right to perform some kind of operation independed of the object. For example, a user might have the
right to install any driver, debug any program, shutdown the entire system. You can't limit a user
to only install a particular driver, debug a specific program, etc.
A user (called Token in Microsoft security speak) has a certain set of privileges. However, this
doesn't mean that a privilege is enabled. A privilege that is assigned to a user can be enabled, disabled
or removed. Disabled privileges can be enabled. Privileges that have been removed or never have been assigned
cannot be added to the list of privileges for that user. If your application depends on a partiular privilege,
such as installing a printer (SeLoadDriverPrivilege), you have to check if the privilege is available and
There are only a limited number of privileges defined in Windows. You cannot add your own ones:
To check whether a user has got a particular privilege, I wrote a little utility