Is there any description, from Windows user perspective, of what UAC exactly does to user privileges anywhere? And what is elevation exactly.
I'm looking for something like this article but not so hopelessly dated.
Here is a scenario that I can not explain via online resources. The puzzling bit is that UAC seems to be interfering with access rights granted through a different group than Administrators.
An application and a service use shared memory to communicate with each another. (The app creates it, the service opens it). Since Windows Vista the shared memory object is created as global because services now have a separate session. Hence each user of that app needs the corresponding privilege (SeCreateGlobalPrivilege). The way to get the privilege is either through membership in Administrators (default Windows behavior) or through membership in MyAppUsers (specifically granted).
The app is not UAC aware.
As expected, if I am in neither group, the app fails on denied permission when attempting to create the global object.
As expected, a plain Administrator has the same problem unless elevated.
As expected, a standard User who is in MyAppUsers does get the privilege, no need to elevate. The app works. The shared memory shares memory.
Entirely unexpected, if a user is both in Administrators and in MyAppUsers, they don't get the privilege unless elevated; so, effectively, membership in Administrators takes away the privileges available through MyAppUsers. Here I'm paradoxically being forced to run as an elevated administrator - I should not need elevation, right?
I thought the purpose of UAC is to stop running everything as an Administrator in favor of specific accounts, groups, and explicitly granted permissions. So I would expect it should be interfering with rights obtained through being a member of Administrators, but not with rights obtained through being a member of Users, or MyAppUsers, or any other group.
