How does Windows establish whether application makes changes to device

matpop

5/27/23, 12:00 PM

For applications that trigger the UAC ("Do you want to allow this app to make changes to your device" dialog), which are the characteristics that are detected by Windows in order to decide to trigger UAC? Consider that "Run this program as an administrator" is disabled in the Compatibility tab of the executable/shortcut properties. Does Windows detect paticular data/metadata inside the executable file? Does Windows keep metadata about different applications, differentiating between apps that may "make changes to the device" and apps that don't?

0 + 0

windows

uac

administrative-privileges

Score:2

Server

Greg Askew

5/27/23, 12:37 PM

which are the characteristics that are detected by Windows in order to decide to trigger UAC

Attempting to access a resource that the account's standard user token does not have permission to access.

https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works

"When an administrator logs on, two separate access tokens are created for the user: a standard user access token and an administrator access token. The standard user access token contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed. The standard user access token is used to start apps that do not perform administrative tasks (standard user apps). The standard user access token is then used to display the desktop (explorer.exe). Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token."

0 + 0

matpop

5/27/23, 1:47 PM

Thank you for the documentation link. My problem is to understand what actually triggers all the UAC process. From what you point out, it seems that averything happens dynamically, i.e. the application is launched, the application attempts to access a resource that needs administrative privileges to be accessed, the UAC kicks in. But the problem is, somehow the app icon already has the Windows "security shield" mark on it! And it seems to be there even if I never launched the application yet. It seems Windows already "knows" (statically) that the application may access reserved resources

Greg Askew

5/27/23, 2:26 PM

It could be in the manifest of the target executable. Developers can specify if the application requires administrator requestedPrivileges/requestedExecutionLevel.

matpop

5/28/23, 12:43 PM

nope... it has the `asInvoker` option

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How does Windows establish whether application makes changes to device

TH: Windows กำหนดได้อย่างไรว่าแอปพลิเคชันทำการเปลี่ยนแปลงอุปกรณ์หรือไม่

RO: Cum stabilește Windows dacă aplicația face modificări dispozitivului

RU: Как Windows определяет, вносит ли приложение изменения в устройство

VI: Làm cách nào để Windows thiết lập liệu ứng dụng có thực hiện thay đổi đối với thiết bị hay không

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.