There are many processes for different programs that run with administrative rights or elevated privileges. While some processes need elevated privileges to run programs properly, other processes don’t need such privileges. If you want to check which processes are running with admin rights, then this post will guide you.
A few days back, we saw how to open Explorer as admin in elevated mode. Building upon the tip we gave in that post, you can use the same native feature to find out processes that are running as administrative privileges. Once you find such processes, you can close them or keep them running based on the needs.
Check if a Program or Application is running as Administrator
To check if a process is running with admin rights in Windows 11/10, do the following:
- Open Task Manager
- Access the Details tab
- Access Select columns box
- Select Elevated option
- Save the change.
At first, right-click on the taskbar and use the Task Manager option. Or else, you can use other options to open the Task Manager window.
Task Manager should open with More details view mode that shows all the tabs of Task Manager.
If it doesn’t open with that mode, then click on the More details option on the bottom left part and it will open with More details view mode.
Now access the Details tab. After that, access the Select columns box. For that, right-click on any column name (like username, CPU, memory, etc.) available in the Details tab, and click on the Select columns option.
In the Select columns box, scroll down, and click on the Elevated option. Save this change using the OK button.
Now, in the Details tab, you will notice that an elevated name column is visible for all the running processes.
If there is Yes for a particular process, that means that process is running with elevated privileges. If there is a No, that simply means it is not running with admin rights.
There are two more ways you can use to check if a program is running as Administrator in Windows 11.
Using Process Explorer
You can also use Sysinternals Process Explorer. Run it as Administrator, right-click the process, open its Properties and check the Security tab. Here, look at the Integrity Level field:
- Low means sandboxed apps.
- Medium means normal user processes.
- High means Administrator rights.
- System means core Windows processes.
Using Command Prompt
If you know the SID of the program or process, you can use CMD. For instance, the SID for CMD is S-1-16-12288. So if you execute whoami /groups | findstr "S-1-16-12288" in an elevated command prompt, you should see High Mandatory Level or High Integrity (Administrator).
Hope this simple trick is helpful.
Read next: How to log in as an Administrator in Windows 11.
