Public Function GetSecurityPermissions(ByVal pszObjName As String, _
   ByVal ObjectType As SE_OBJECT_TYPE, ByVal pszTrustee As String, _
   ByRef dwAccessRights As Integer) As Integer

    Dim dwRes As Integer
    Dim pCurDACL As IntPtr
    Dim pSD As IntPtr
    Dim tR As New TRUSTEE

    If (pszObjName = "") Then
      GetSecurityPermissions = ERROR_INVALID_PARAMETER
      'Debug.Print("ERROR_INVALID_PARAMETER")
      Exit Function
    End If

    'Get a pointer to the existing DACL.
    dwRes = GetNamedSecurityInfo(pszObjName, ObjectType, _
     DACL_SECURITY_INFORMATION, _
     IntPtr.Zero, IntPtr.Zero, pCurDACL, IntPtr.Zero, pSD)
    If dwRes <> ERROR_SUCCESS Then
      'Debug.Print("GetNamedSecurityInfo Error " & CStr(dwRes))
      GoTo Cleanup
    End If

    'Initialize a TRUSTEE structure for the specified trustee name.
    'BuildTrusteeWithName(tR, pszTrustee) '-по каким-то причинам эта ф-ция вызывает crash
    'поэтому инициализируем tR-структуру вручную согласно описанию ф-ции
    'pszTrustee-A pointer to a null-terminated string that contains the name of the trustee for the ptstrName member of the TRUSTEE structure.
    'The BuildTrusteeWithName function sets the other members of the TRUSTEE structure as follows.
    'pMultipleTrustee    NULL
    'MultipleTrusteeOperation    NO_MULTIPLE_TRUSTEE
    'TrusteeForm    TRUSTEE_IS_NAME
    'TrusteeType    TRUSTEE_IS_UNKNOWN
    With tR
      .pMultipleTrustee = IntPtr.Zero
      .MultipleTrusteeOperation = MULTIPLE_TRUSTEE_OPERATION.NO_MULTIPLE_TRUSTEE
      .TrusteeForm = TRUSTEE_FORM.TRUSTEE_IS_NAME
      .TrusteeType = TRUSTEE_TYPE.TRUSTEE_IS_UNKNOWN
      .ptstrName = pszTrustee
    End With

    dwRes = GetEffectiveRightsFromAcl(pCurDACL, tR, dwAccessRights)
    If dwRes <> ERROR_SUCCESS Then
      'Debug.Print("GetEffectiveRightsFromAcl Error " & CStr(dwRes))
      GoTo Cleanup
    End If

Cleanup:
    If pSD <> IntPtr.Zero Then LocalFree(pSD)

    GetSecurityPermissions = dwRes
  End Function

  Public Function ConstructUniversalAndNTWellKnownSidsNS(GroupName As String) As String
    'возвращает имя стандартной группы пользователей на языке OS (рус,английский)
    'НЕ включает имя домена: СИСТЕМА; Все; Администраторы; Пользователи

    ConstructUniversalAndNTWellKnownSidsNS = ""

    Dim siaNtAuthority As New SID_IDENTIFIER_AUTHORITY
    Dim lSid As IntPtr

    Select Case GroupName
      Case "NetworkService"
        ' Construct SID for System "NT well-known SID" ("NetworkService")
        siaNtAuthority.Value = {0, 0, 0, 0, 0, SECURITY_NT_AUTHORITY}
        'siaNtAuthority.Value(5) = SECURITY_NT_AUTHORITY
        If AllocateAndInitializeSid(siaNtAuthority, 1, _
         SECURITY_NETWORK_SERVICE_RID, 0, 0, 0, 0, 0, 0, 0, lSid) Then
          'AddLog("  Calling AllocateAndInitializeSid... Done.")
          AddLog("  " & Trim(strL_Authorization_CallingDoneFailed_Calling & " AllocateAndInitializeSid... " & strL_Authorization_CallingDoneFailed_Done))
          ' Use the constructed SID in the application
          ConstructUniversalAndNTWellKnownSidsNS = DisplayNameOfSid(lSid)
          ' Free the memory allocated for the SID using FreeSid() API
          FreeSid(lSid)
        Else
          'AddLog("  Calling AllocateAndInitializeSid... Failed. Error code: " & RaiseAPIError())
          AddLog("  " & Trim(strL_Authorization_CallingDoneFailed_Calling & " AllocateAndInitializeSid... " & _
           strL_Authorization_CallingDoneFailed_Failed & " " & strL_Authorization_ErrorCode) & ": " & RaiseAPIError())
        End If

      Case Else
    End Select
    If ConstructUniversalAndNTWellKnownSidsNS <> "" Then _
     AddLog("    " & strL_Authorization_UsersGroupName & ": " & ConstructUniversalAndNTWellKnownSidsNS & " ...OK") ' "    UsersGroupName: " " ...OK"
  End Function

  Public Const STANDARD_RIGHTS_ALL = &H1F0000

  Public Function IsFullAccessAPI(ByVal the_folder As String) As Boolean
    Dim AccessMask As Integer
    GetSecurityPermissions(the_folder, SE_OBJECT_TYPE.SE_FILE_OBJECT, _
     ConstructUniversalAndNTWellKnownSidsNS("NetworkService"), AccessMask)
    Return ((AccessMask Or STANDARD_RIGHTS_ALL) = AccessMask)
  End Function

          If ((accessRule.InheritanceFlags And InheritanceFlags.ObjectInherit) = InheritanceFlags.ObjectInherit) And _
           ((accessRule.PropagationFlags And PropagationFlags.InheritOnly) <> PropagationFlags.InheritOnly) And _
           ((accessRule.PropagationFlags And PropagationFlags.NoPropagateInherit) <> PropagationFlags.NoPropagateInherit) Then

  Public Function DoFullAccessFileFolderNetworkService(ByVal FileFolderPath As String) As Integer
    DoFullAccessFileFolderNetworkService = AddAceToObjectsSecurityDescriptor(FileFolderPath, _
     SE_OBJECT_TYPE.SE_FILE_OBJECT, _
     ConstructUniversalAndNTWellKnownSidsNS("NetworkService"), _
     GENERIC_ALL, _
     ACCESS_MODE.GRANT_ACCESS, _
     CONTAINER_INHERIT_ACE Or OBJECT_INHERIT_ACE)
    If DoFullAccessFileFolderNetworkService <> ERROR_SUCCESS Then
      'AddLog("  Calling AddAceToObjectsSecurityDescriptor... Failed. Error code: " & RaiseAPIErrorByNumber(DoFullAccessFileFolder))
      AddLog("  " & Trim(strL_Authorization_CallingDoneFailed_Calling & " AddAceToObjectsSecurityDescriptor... " & _
       strL_Authorization_CallingDoneFailed_Failed & " " & strL_Authorization_ErrorCode) & ": " & RaiseAPIErrorByNumber(DoFullAccessFileFolderNetworkService))
    Else
      'AddLog("  Calling AddAceToObjectsSecurityDescriptor... Done.")
      AddLog("  " & Trim(strL_Authorization_CallingDoneFailed_Calling & " AddAceToObjectsSecurityDescriptor... " & strL_Authorization_CallingDoneFailed_Done))
    End If
  End Function

public bool IsUserInGroup(string userName, string groupName)
{
    using (var context = new PrincipalContext(ContextType.Machine))
    {
        using (var searcher = new PrincipalSearcher(new UserPrincipal(context) { SamAccountName = userName }))
        {
            using (var user = searcher.FindOne() as UserPrincipal)
            {
                return user != null && user.IsMemberOf(context, IdentityType.SamAccountName, groupName);
            }
        }
    }
}

using (var searcher = new PrincipalSearcher(new UserPrincipal(context) { SamAccountName = userName }))