uses
  JwaWindows;

var
  GenericFileMapping : TGenericMapping = (
    GenericRead: FILE_GENERIC_READ;
    GenericWrite: FILE_GENERIC_WRITE;
    GenericExecute: FILE_GENERIC_EXECUTE;
    GenericAll: FILE_ALL_ACCESS
    );

function CheckAccessToFile(DesiredAccess: DWORD; const FileName: WideString;
    const OpenAsSelf : Boolean = true): Boolean;

var
  LengthNeeded : DWORD;
  SecurityDescriptor : PSecurityDescriptor;
  ClientToken2,
  ClientToken : THandle;
  AccessMask : DWORD;
  PrivilegeSet : TPrivilegeSet;
  PrivilegeSetLength : DWORD;
  GrantedAccess : DWORD;
  AccessStatus : BOOL;
begin
  Result := False;
  SetLastError(0);

  if not GetFileSecurityW(PWideChar(FileName), OWNER_SECURITY_INFORMATION or
    GROUP_SECURITY_INFORMATION or DACL_SECURITY_INFORMATION, nil, 0,
    LengthNeeded) and (GetLastError <> ERROR_INSUFFICIENT_BUFFER) then
    Exit;

  GetMem(SecurityDescriptor, LengthNeeded);
  try
    if not GetFileSecurityW(PWideChar(FileName), OWNER_SECURITY_INFORMATION or
      GROUP_SECURITY_INFORMATION or DACL_SECURITY_INFORMATION,
      SecurityDescriptor, LengthNeeded, LengthNeeded) then
      Exit;

    //first try token assigned to the current thread
    if not OpenThreadToken(GetCurrentThread, TOKEN_QUERY or
        TOKEN_IMPERSONATE or TOKEN_DUPLICATE, OpenAsSelf, ClientToken) then
    begin
      //otherwise use process token
      if (GetLastError() = ERROR_NO_TOKEN) and
         (not OpenProcessToken(GetCurrentProcess, TOKEN_QUERY or
        TOKEN_IMPERSONATE or TOKEN_DUPLICATE, ClientToken)) then
        Exit;

      //convert to thread token.
      if not DuplicateToken(ClientToken, SecurityImpersonation, @ClientToken2) then
        exit;

      //close process token and switch them for further processing
      CloseHandle(ClientToken);

      ClientToken := ClientToken2;
    end;

    AccessMask := DesiredAccess;
    MapGenericMask(AccessMask, GenericFileMapping);
    PrivilegeSetLength := SizeOf(TPrivilegeSet);

    if AccessCheck(SecurityDescriptor, ClientToken, AccessMask,
      GenericFileMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess,
      AccessStatus) then
      Result := AccessStatus;

    CloseHandle(ClientToken);
  finally
    FreeMem(SecurityDescriptor);
  end;
end;