2

Is there any description, from Windows user perspective, of what UAC exactly does to user privileges anywhere? And what is elevation exactly.

I'm looking for something like this article but not so hopelessly dated.

Here is a scenario that I can not explain via online resources. The puzzling bit is that UAC seems to be interfering with access rights granted through a different group than Administrators.

An application and a service use shared memory to communicate with each another. (The app creates it, the service opens it). Since Windows Vista the shared memory object is created as global because services now have a separate session. Hence each user of that app needs the corresponding privilege (SeCreateGlobalPrivilege). The way to get the privilege is either through membership in Administrators (default Windows behavior) or through membership in MyAppUsers (specifically granted).

The app is not UAC aware.

  • As expected, if I am in neither group, the app fails on denied permission when attempting to create the global object.

  • As expected, a plain Administrator has the same problem unless elevated.

  • As expected, a standard User who is in MyAppUsers does get the privilege, no need to elevate. The app works. The shared memory shares memory.

  • Entirely unexpected, if a user is both in Administrators and in MyAppUsers, they don't get the privilege unless elevated; so, effectively, membership in Administrators takes away the privileges available through MyAppUsers. Here I'm paradoxically being forced to run as an elevated administrator - I should not need elevation, right?

I thought the purpose of UAC is to stop running everything as an Administrator in favor of specific accounts, groups, and explicitly granted permissions. So I would expect it should be interfering with rights obtained through being a member of Administrators, but not with rights obtained through being a member of Users, or MyAppUsers, or any other group.

  • The most restrictive rights always applies. That's why you need right elevation, even if the user is member of Administrators. Plus, Administrator group members are not "full admin" anymore and still need an elevation for some operations. Last point regarding your link, as far as I know it might be dated but it still describe how it currently works. In a perfect world, the application you describe should be rewritten to meet the UAC requirements. – nex84 Mar 30 '16 at 13:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.