SecurityUtilities.cs

using System;
using System.Security.Principal;

namespace IoMonitor
{
    /// <summary>
    /// Helper methods for interacting with the current Windows security context.
    /// </summary>
    internal static class SecurityUtilities
    {
        /// <summary>
        /// Returns true when the current process is running as an Administrator.
        /// </summary>
        public static bool IsAdministrator()
        {
            try
            {
                using var identity = WindowsIdentity.GetCurrent();
                var principal = new WindowsPrincipal(identity);
                return principal.IsInRole(WindowsBuiltInRole.Administrator);
            }
            catch
            {
                return false;
            }
        }

        /// <summary>
        /// Attempts to enable SeDebugPrivilege for the current process.
        /// </summary>
        public static bool EnableDebugPrivilege()
        {
            try
            {
                IntPtr processHandle = NativeMethods.GetCurrentProcess();

                if (!NativeMethods.OpenProcessToken(
                        processHandle,
                        NativeMethods.TOKEN_ADJUST_PRIVILEGES | NativeMethods.TOKEN_QUERY,
                        out var token))
                {
                    return false;
                }

                try
                {
                    if (!NativeMethods.LookupPrivilegeValue(null, "SeDebugPrivilege", out var luid))
                    {
                        return false;
                    }

                    var tp = new NativeMethods.TOKEN_PRIVILEGES
                    {
                        PrivilegeCount = 1,
                        Privileges = new[]
                        {
                            new NativeMethods.LUID_AND_ATTRIBUTES
                            {
                                Luid = luid,
                                Attributes = NativeMethods.SE_PRIVILEGE_ENABLED
                            }
                        }
                    };

                    bool result = NativeMethods.AdjustTokenPrivileges(
                        token,
                        disableAllPrivileges: false,
                        ref tp,
                        bufferLength: 0,
                        previousState: IntPtr.Zero,
                        returnLength: IntPtr.Zero);

                    return result;
                }
                finally
                {
                    NativeMethods.CloseHandle(token);
                }
            }
            catch
            {
                return false;
            }
        }
    }
}