UAC: which rights are elevated?
When you "run as Administrator" using the credentials of a different (administrator) account does it run with the rights of the second (administrator) account, or with the rights of the normal (non-administrator) account PLUS those of the second?
September 14th, 2011 5:45pm

Well since you're running it using the admin's credentials, it should have the rights of the admin whos credentials you used. It really wouldn't be logical for it to combine the credentials, cause then for example if it's like a restricted admin account, if you were to do that, then suddenly the restricted account isn't as restricted, which wouldn't be very secure.
Free Windows Admin Tool Kit Click here and download it now
September 15th, 2011 4:48pm

Since the process run with elevated rights is using User Interface Privilege Isolation it is still pretty secure. I admit that the way you describe seems most sensible to me as well and was the way I thought it worked. However tasks I was doing when I posted had forced me to question my assumptions. The terminology 'elevated' also indicates that it takes existing rights and adds to them.
September 16th, 2011 11:25am

I didn't really fully explain my example, here's what I mean. Say you have a restricted admin account user only for a very specific purpose, and as such, it only has write priveleges, (so it can move/copy files or something in a domain) so it can't read or execute anything. Then you have a regular user account with read/write, execute, etc, but it's not an admin. If the rights were added together, if you go on that user and run something as the admin, now that restricted admin that was only supposed to have write permissions now has read/write, execute, etc. He normally doesn't have execute so he wouldn't even be able to run anything, but since the rights are added, he now can execute stuff, and has rights he's not supposed to have. That doesn't seem right or very secure to me. If instead the rights were just taken from the restricted admin, you would put in his credentials and it would say something like "this user doesn't have execute permissions bla bla", so the account functions like it's supposed to. To give you a terrible analogy, if you were hitting a tree with a knife (obviously not gonna do much) and then you got an axe, you wouldn't continue hitting it with the axe and the knife, you'd throw away the knife and use the axe. I think that's kinda how the rights system is supposed to work, but with not as much chopping down trees.
Free Windows Admin Tool Kit Click here and download it now
September 21st, 2011 5:57pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics