COMMAND
whoamiShow the current user, groups and privileges
whoami prints the current user account in domain\user form. With options it shows much more: /groups lists the security groups the token carries, /priv lists privileges, and /all shows everything including the security identifier (SID). It is the quick way to confirm who a process is running as.
Purpose
whoami answers "who is this process running as, and what can it do?". Beyond the account name it exposes the token's groups and privileges, which determines what the session is allowed to access. It pairs with the authentication basics and file permissions records.
Basic use
whoamidomain\aliceUseful options
| Option | Shows |
|---|---|
/user | Account name and SID |
/groups | Group memberships and the integrity level |
/priv | Privileges and whether each is enabled |
/all | Everything above |
/fo list or /fo csv | Output format |
Check for elevation
whoami /groups | findstr /C:"Mandatory Label"Mandatory Label\High Mandatory Level Label S-1-16-12288High Mandatory Level means the session is elevated (running as administrator); Medium means a standard session. This is the reliable programmatic check, since group membership in Administrators does not by itself mean the current token is elevated.
List privileges
whoami /privPrivileges such as SeDebugPrivilege, SeBackupPrivilege and SeShutdownPrivilege appear as Enabled or Disabled. Many powerful privileges are present but disabled until a program explicitly enables them, and several are absent entirely in a non-elevated token.
Common mistakes
- Assuming Administrators membership equals elevation. With User Account Control, a normal prompt runs with a filtered token even for an administrator; check the integrity level.
- Reading only
whoamiwhen the question is really about groups or privileges; use/all.
PowerShell equivalent
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name gives the name; a WindowsPrincipal with IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) tests elevation.
Frequently asked questions
How do I tell if my command prompt is running as administrator?
whoami /groups | findstr /C:"High Mandatory Level" shows a High integrity level in an elevated session and Medium in a standard one. whoami /priv also lists privileges such as SeDebugPrivilege that only appear when elevated.
What does whoami /user show?
The account name and its SID, the unique security identifier Windows uses internally. It is useful when a permission entry shows a raw SID instead of a name.