2

My goal is to understand at the lower level what actually happens when you initiate a program "as administrator".

  1. Does it load the program into the Kernel land memory range?
  2. Or is it still loaded in user land and the API calls just no longer prompt you for access request?

1 Answer 1

1

When you log on Windows creates an access token. This identifies you, the groups you are a member of and your privileges. And note that whether a user is an administrator or not is determined by whether the user is a member of the Administrators group.

Without UAC, when you run a program it gets a copy of the access token, and this controls what the program can access.

With UAC, when you run a program it gets a restricted access token. This is the original access token with "Administrators" removed from the list of groups (and some other changes). Even though your user is a member of the Administrators group, the program can't use Administrator privileges.

When you select "Run as Administrator" and your user is an administrator the program is launched with the original unrestricted access token. If your user is not an administrator you are prompted for an administrator account, and the program is run under that account.

3
  • Thank you for your answer, I do get those concepts, perhaps i didn't express my question that well. What i am asking essentially is, when you "run as administrator" is that program loaded in userland memory range or kernelland
    – sahar q
    Dec 20, 2018 at 14:07
  • 1
    With UAC enabled, LSA creates two logon sessions associated with a token pair, one with limited access and one with full access, and it returns the limited token. For a new Windows session, the limited token is set as the session token and gets used by default. It has administrator privileges removed; medium integrity level (lowered from high); no-write-up and new-process minimum integrity policy; and the administrators group set to deny only (not removed) so deny ACEs remain in effect. Elevating creates a process with the full-access linked token, with the new-process minimum policy disabled.
    – Eryk Sun
    Dec 20, 2018 at 18:49
  • 1
    The new-process minimum policy, if enabled in a token, sets the integrity level of a child process to the minimum integrity level of the parent and the executable file. The integrity level of a file is implicitly medium, so if the elevated token enables this policy, child processes of an elevated process will almost always have medium integrity instead of the expected high integrity. One interesting consequence with it disabled, however, is that if we run an executable with a manually set low integrity level, it will still run with high integrity if the parent is elevated.
    – Eryk Sun
    Dec 20, 2018 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.