Identify elevated process for non-admin

Question

Although it is unusual, unpriviledged users can run elevated under their normal credentials (not with admin creds).  This most commonly occurs with logon scripts run from GPO. 
Running elevated messes some things up (particularly drive mapping).  Thus, I'm looking for a way for a script to identify if it is running elevated.  I know how to find elevated status for administrators:
$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object System.Security.Principal.WindowsPrincipal( $identity )
$admin = [System.Security.Principal.WindowsBuiltInRole]::Administrator
if ($principal.IsInRole( $admin )) {
# script is running as an admin
But this doesn't work (obviously) for non-admins.
This article
is helpful for testing for elevated processes, but it doesn't work if run elevated itself.
Anyone have any suggestions? 
Thanks.

Answer 1

Hi Cascomp,
In addition, Please also check the script below to determine running elevated or not.
[bool]((whoami /groups) -match "S-1-16-12288")
The SID "S-1-16-12288" imply the group the current user belong to has a High Mandatory Level Label, and the elevated user has the high level, which can be found HERE.
For more detailed information about Windows Integrity Mechanism, please also refer to this article:
http://msdn.microsoft.com/en-us/library/bb625963.aspx
Q: How can I quickly tell if my PowerShell window is running elevated?
http://windowsitpro.com/powershell/q-how-can-i-quickly-tell-if-my-powershell-window-running-elevated
If you have any feedback on
our support, please click here.
Best Regards,
Anna
TechNet Community Support