There are a few ways it can know. Generally it will put the UAC icon there anytime clicking the icon will result in a UAC prompt confirmation. However, you may not always see it because after a recent change, the icon cache won't immediately be updated.
The ways it knowns:
- It knows because you modify the shortcut, or the application compatibility properties,or
- because the application has alerted the OS that it requires admin priviledge.
What you are probably seeing... In the shortcut properties "advanced..." button dialog, choosing run as administrator will make the sheild appear (after your icon cache is refreshed.) The same thing with "run as administrator" setting on the compatibility tab. (again, after the icon cache is refreshed.) How to force a refresh of your icon cache in windows 7, you ask? I'm not sure... a reboot should do it.)
Windows can also know to put the UAC icon there to begin with because an app that is "ready" for (is programmed to behave well with) UAC, can let the OS know that it needs admin permissions, this can be done through a "manifest" that is embeded into the exe.