How to check if writing to a folder requires elevation

[Symbai]

I want to see if writing to a folder requires explicit administrator rights or not, completely independent from the current user's access level. For example writing to C:\Program Files\ requires administrator rights on Windows 10, writing to C:\ or C:\New Folder does not.

In C# a program cannot write into C:\Program Files\ when its not running elevated. There are many way to see if the CURRENT user has writes permissions to a folder. However most of these ways are using WindowsIdentity.GetCurrent() which returns different results if the app is ran elevated or not.

If it runs elevated and I'm using WindowsIdentity.GetCurrent() it would say that I have write permission to C:\Program Files\. But it wouldn't tell me if non-administrators cannot write to it.

My first thought was to modify this code and use WellKnownSidType.BuiltinUsersSid to see if generic users can write to it and this tells me that non-administrators cannot write to C:\Program Files\ but this again fails on C:\New Folders because the built-in user group "USERS" is not listed on permission section of this folder. And for some weird reason if you open the properties of this folder in Windows Explorer, you see that the non administrator local user account has no write permissions to it (admin has) but I dont get any UAC prompt when I copy files to it and non elevated programs can write to it as well.

So regardless of what my C# program is allowed or on which user it runs, how can I see if writing to a folder requires elevation or not? It should return true on C:\ and false on C:\Program Files without the code specifically look out for C:\Program Files. It should work on all folders everywhere, these two folders are just an example of the issue I ran into.

[deeprobin]

Hi Symbai,

you could try the following Win32 methods (required PInvoke):

• aclapi.h > GetFileSecurityA
• aclapi.h > GetNamedSecurityInfoA

I doubt if there is a direct C# API (without PInvoke) for this.

I hope I could help you with it :)

---

Edit: I found a C# API for this :)
https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.filesecurity?view=net-6.0