diff --git a/speakeasy/winenv/api/usermode/advapi32.py b/speakeasy/winenv/api/usermode/advapi32.py
index 7eeaf21..3a0bdf5 100644
--- a/speakeasy/winenv/api/usermode/advapi32.py
+++ b/speakeasy/winenv/api/usermode/advapi32.py
@@ -1255,8 +1255,8 @@ class AdvApi32(api.ApiHandler):
             rv = False
             emu.set_last_error(windefs.ERROR_INSUFFICIENT_BUFFER)
 
-        if info_class == 20 and info and emu.config.user.is_admin:
-            self.mem_write(info, (1).to_bytes(4, "little"))
+        if info_class == 20 and info and info_len >= 4:
+            self.mem_write(info, int(emu.config.user.is_admin).to_bytes(4, "little"))
         if ret_len:
             self.mem_write(ret_len, (4).to_bytes(4, "little"))
 
diff --git a/tests/test_advapi32_handlers.py b/tests/test_advapi32_handlers.py
index 3bf35aa..72c4f70 100644
--- a/tests/test_advapi32_handlers.py
+++ b/tests/test_advapi32_handlers.py
@@ -410,3 +410,19 @@ def test_lookup_account_name_small_domain_buffer(sid_emu: Speakeasy) -> None:
         len(domain) + 1,
     )
     assert sid_emu.mem_read(dom, 4) == b"\xcc" * 4
+
+
+@pytest.fixture(params=[False, True], ids=["user", "admin"])
+def admin_emu(
+    request: pytest.FixtureRequest, config: dict[str, Any], load_test_bin: Callable[[str], bytes]
+) -> Iterator[Speakeasy]:
+    config["user"]["is_admin"] = request.param
+    yield from load_emu(config, load_test_bin("dll_test_x86.dll.xz"))
+
+
+def test_get_token_information_writes_the_elevation(admin_emu: Speakeasy) -> None:
+    assert admin_emu.emu is not None
+    info = alloc(admin_emu, b"\xcc" * 4)
+    ret_len = alloc(admin_emu, b"\xcc" * 4)
+    rv, _ = call(admin_emu, "advapi32", "GetTokenInformation", [0x1234, 20, info, 4, ret_len])
+    assert (rv, _dword(admin_emu, info), _dword(admin_emu, ret_len)) == (1, int(admin_emu.emu.config.user.is_admin), 4)