Geoff Chappell - Software Analyst
Determines whether the current process is a protected mode process.
HRESULT IsProtectedModeProcess (VOID);
The function returns zero for success, else an error code.
This function’s question is evaluated just the once. If the function has been called before, it returns whatever it knows from the first execution.
The function succeeds if Protected Mode is enabled for the current process (see IsProtectedModeEnabled) and this process has low integrity (see IsMICLowProcess). Otherwise, the error code will be S_FALSE unless the operating system supports integrity levels but the function failed to determine the integrity level.
The IsProtectedModeProcess function is exported from IERTUTIL as ordinal 32 in version 7.0 and higher.