Determine if user can obtain admin privileges if needed

Question

I have an In-house C# application that will be run on lap-tops in several remote locations. The most common users will have admin rights to the lap-tops, but sometimes it will be run by users without admin rights. For operational reasons, we want just one copy of the application per computer, so it will be installed under Program Files instead of the user accounts.

I am creating an auto-update routine. I would like it to have this behavior:

1. It checks if there are any updates available.
2. If there are updates and the user has no admin rights, They will be informed of the updates.
3. If the user has admin rights, the updates will be loaded.
4. In all cases, the application will be launched. Non-admin users can decide if the updates warrant shutting down and finding someone with admin rights.

99% of the time, there will be no updates, and I would prefer not to request privileges in the manifest when they usually will not be needed. So I plan on starting a separate process to actually load the updates. But in that case, I'd rather not bother non-admin users with requests for admin privileges that they cannot provide (no - they will not have another account they themselves can log into that has admin privileges).

Is there some reliable way I can have it determine - once it has found updates - whether the current user is in the administrators group, so that it will know whether to bother with launching the update process, or just report updates available and move on?

I've been searching for hours, but have only turned up one method (checking if the user has a split token) that is apparently unreliable and warned against.

Edit:

For completeness, the final solution I found based on Wheels73's post with corrections for the error I was getting is:

  bool CurrentUserIsAdmin() 
  {
     UserPrincipal user = UserPrincipal.Current;
     using (IEnumerator<Principal> groups = user.GetAuthorizationGroups().GetEnumerator()) 
     {
        while (groups.MoveNext()) 
        {
           try 
           {
              if (groups.Current.ToString() == "Administrators") 
              {
                 return true;
              }
           } 
           catch (NoMatchingPrincipalException) 
           {
              continue;
           }
        }
        return false;
     }
  }

Answer 1

As discussed, this is the routine I use to list all the AD directories for a given login.

 public List<string> GetUsersActiveDirectoryGroups(string windowsUserName)
 {
            var allUserGroups = new List<string>();
            var domainConnection = new DirectoryEntry();

            var samSearcher = new DirectorySearcher
            {
                SearchRoot = domainConnection,
                Filter = "(samAccountName=" + windowsUserName + ")"
            };
            samSearcher.PropertiesToLoad.Add("displayName");

            var samResult = samSearcher.FindOne();

            if (samResult == null) //User not found
                return allUserGroups;

            //Get groups
            var theUser = samResult.GetDirectoryEntry();
            theUser.RefreshCache(new[] {"tokenGroups"});

            foreach (byte[] resultBytes in theUser.Properties["tokenGroups"])
            {
                var mySid = new SecurityIdentifier(resultBytes, 0);

                var sidSearcher = new DirectorySearcher
                {
                    SearchRoot = domainConnection,
                    Filter = "(objectSid=" + mySid.Value + ")"
                };
                sidSearcher.PropertiesToLoad.Add("name");

                var sidResult = sidSearcher.FindOne();
                if (sidResult != null)
                {
                    allUserGroups.Add(sidResult.Properties["name"][0].ToString());
                }
            }

            return allUserGroups;
}

You could then check the contents of the groups to return a bool based upon the group name you are looking for.

 var myUsersGroups = GetUsersActiveDirectoryGroups("YOURLOGINNAME");
 var usersIsInAdmin = myUsersGroups.Any(g => g == "Administrator");

To detect if a user simply has loca admin rights, you can use the below

            WindowsIdentity user = null;

            user = WindowsIdentity.GetCurrent();
            var principal = new WindowsPrincipal(user);
            var isAdmin = principal.IsInRole(WindowsBuiltInRole.Administrator);

OK.. final shout :)

To find out if another user has local admin rights, you can do the below

var usersPrincipal = UserPrincipal.FindByIdentity(UserPrincipal.Current.Context, IdentityType.SamAccountName, "YOURLOGINNAME");
var otherUserIsAdmin = usersPrincipal.GetAuthorizationGroups().Any(p => p.ToString() == "Administrators");

Hope that helps.