Section 7: User Account Control (UAC)

The Big Picture: Locking the Powerful Key in a Drawer

Imagine a house key that opens every door, including the safe. If you carried it in your hand all day, you could drop it, or someone could grab it. Better: keep it in a drawer, carry an ordinary key, and fetch the master key only when you truly need it, after asking "Do I really want to open the safe?"

That is User Account Control (UAC). Even if you are an administrator, Windows keeps your full power locked away until a program asks for it and you agree.

7.1 Why UAC Exists (Limiting Standing Admin Privilege)

What it is: UAC is a Windows feature (introduced in Windows Vista) that stops programs from using administrator power silently.

The problem it solves. Before UAC, many people used an administrator account for everything. Every program they started, including a virus hidden in an email attachment, got full administrator power automatically. It could change system files, install drivers and hide itself, with no warning.

The idea: no "standing" privilege. Standing privilege means power that is always switched on. UAC removes it. Your programs start with ordinary rights. Only a program that asks for more, and gets your OK, runs with full power, and only that one program.

A fair warning. UAC reduces risk, but it is not a full security wall. A determined attacker or a tricked user can still get past it (for example, by clicking "Yes" without reading). Treat it as one useful layer among many, not as a lock that can never be picked.

Standard users and administrators. UAC works for both:

• A standard user who triggers a prompt must type an administrator's password.
• An administrator just clicks Yes (this is called Admin Approval Mode).

7.2 Elevation Prompts

What it is: Elevation means starting a program with full administrator power instead of limited power. The pop-up window that asks you is the elevation prompt (or consent prompt).

How you know a program wants elevation. In Explorer, its icon often has a small shield (blue and yellow on Windows 10/11). That shield means "this will ask for administrator rights".

The two kinds of prompt:

Reading the prompt. The window shows:

• The program name and its verified publisher (if the file is digitally signed). A yellow or red banner warns when the publisher is unknown.
• Show more details, to see the full file path.

The secure desktop. When the prompt appears, the rest of your screen usually goes dark. This is the secure desktop: a separate, protected screen that normal programs cannot draw on or click. The prompt is shown by a Windows program called consent.exe. Because ordinary programs cannot reach the secure desktop, a bad program cannot fake a click on "Yes" for you.

   A program asks for admin rights
              │
              ▼
   ┌──────────────────────────────┐
   │ consent.exe shows the prompt │  ← on the secure desktop (dimmed screen)
   └──────────────┬───────────────┘
        you click │ Yes / No
                  ▼
   Yes → program starts with the FULL token
   No  → program does not start (or stays limited)

Ways to ask for elevation on purpose:

• Right-click a program → Run as administrator.
• In the Start menu: search for PowerShell → Run as administrator.
• A program can also request it itself, through a setting inside its file (its manifest).

The UAC slider. In Settings, search for "UAC" or open Change User Account Control settings. A slider has four positions (names can differ slightly between versions):

Leave it on the default. Turning UAC off weakens the protections that depend on it.

Integrity levels. UAC is built on a second idea: every program and file also has an integrity level, a trust label. A program may not change something at a higher level than itself, even if the ACL says yes.

Check yours: run whoami /groups and look for the line Mandatory Label.... In a normal window it says Medium Mandatory Level. In an elevated window it says High Mandatory Level.

Old programs and virtualization. Some old programs try to save settings in places like C:\Program Files or HKEY_LOCAL_MACHINE\Software, which a limited program may not write to. UAC can quietly redirect those writes into a private copy under your user profile (for example C:\Users\<you>\AppData\Local\VirtualStore). This is called file and registry virtualization. It is just a compatibility help for very old programs; new programs should not rely on it.

7.3 Split Token for Administrators

What it is: When an administrator signs in with UAC on, Windows creates two access tokens (Chapter 24) for the same person. This is called a split token.

How they are used:

         You sign in as an administrator
                       │
          Windows creates TWO tokens
        ┌──────────────┴──────────────┐
        ▼                             ▼
 ┌───────────────────┐       ┌────────────────────┐
 │ Filtered token    │       │ Full token         │
 │ (Medium)          │       │ (High)             │
 │ used by default   │       │ used only after    │
 │ for Explorer and  │       │ you click Yes on   │
 │ all your programs │       │ the UAC prompt     │
 └───────────────────┘       └────────────────────┘

• Your desktop, Explorer, your browser and most programs get the filtered token.
• When you approve an elevation prompt, the new program is started with the full token.
• The full token is never handed to a running program. A program starts either with one token or the other.

Why this is clever: Your normal programs do not need administrator power, so they never get it. A virus in a normal program only has the filtered token, so the damage is limited.

How to see the difference yourself:

1. Open a normal Command Prompt. Type whoami /groups. Find BUILTIN\Administrators. It will say Group used for deny only. Also check the Mandatory Label: Medium.
2. Open Command Prompt as administrator. Type whoami /groups again. Now Administrators is Enabled, and the Mandatory Label is High.
3. Type whoami /priv in both windows. The elevated one shows many more privileges.

What "deny only" means. In the filtered token, the Administrators SID is still present, but it can only be used to match Deny entries. It cannot match Allow entries. So an ACL that says "Administrators: Allow Full control" does not help the filtered token; but an ACL that says "Administrators: Deny" would still apply.

Elevated vs non-elevated, a common confusion:

(The last row surprises many people: each token has its own set of drive letters, so a drive you mapped in a normal window may be missing in an elevated one.)

Summary