SeTokenIsAdmin
UINT8 __stdcall SeTokenIsAdmin(VOID *Token){
VOID *v2;
UINT8 v3;
if( (*((_DWORD *)Token + 50) & 0x4000) != 0 || *((_DWORD *)Token + 48) == 2 && *((int *)Token + 49) < 2 )
return 0;
v2 = SeAliasAdminsSid;
v3 = SepSidInToken(Token, 0i64, SeAliasAdminsSid, 0, 0, 0);
if( v3 )
{
if( SeTokenIsRestricted(Token) )
return SepSidInToken(Token, 0i64, v2, 0, 1u, 0);
}
return v3;
}Referenced by:
EtwpCoverageUserIsAdmin
IoComputeRedirectionTrustLevel
IopParseDevice
MiIsUserQueryVmCallerTrusted
PspDisablePrimaryTokenExchange
PspIsContextAdmin
SepMandatorySubProcessToken