GetProcessIntegrityLevel

Gets the integrity level for an access token.

Declaration

HRESULT 
GetProcessIntegrityLevel (
    HANDLE hToken, 
    DWORD *pdwIntegrityLevel); 

Parameters

The hToken argument is a handle to an access token, or is NULL to denote the token for the current process.

The pdwIntegrityLevel argument is the address of a variable that is to receive the integrity level.

Return Value

The function returns zero for success, else an error code.

A return of S_FALSE has special meaning, to indicate that the failure is not with the indicated token but with the operating system (for not supporting integrity levels).

Note that the variable at pdwIntegrityLevel is typically defaulted to SECURITY_MANDATORY_MEDIUM_RID if the function fails, but not reliably if the returned value is S_FALSE.

Behaviour

Integrity levels are not supported until Windows Vista. Unless running on Windows Vista or higher, the function fails (returning S_FALSE).

If no token handle is given, the function opens the process token for the current process (asking for MAXIMUM_ALLOWED access rights).

The function queries the token for the TokenIntegrityLevel information class, at first to find how much information is available. This is expected to fail due to having an insufficient buffer. If instead it succeeds, the function fails (returning E_UNEXPECTED). If it fails because of an invalid information class, the function infers that the operating system does not support integrity levels, and returns S_FALSE. Any other failure is failure for the function. If the function cannot obtain memory for a sufficient buffer, it fails (returning E_OUTOFMEMORY). Otherwise, it repeats the query and requires success. From the mandatory integrity level so obtained, the function extracts the returned integrity level as the last subauthority, e.g., SECURITY_MANDATORY_LOW_RID if the token has low integrity.

Availability

The GetProcessIntegrityLevel function is exported from IERTUTIL as ordinal 35 in version 7.0 and higher.