Sunday, July 22, 2018

Most privileges will be removed by UAC

Extra privileges can be assigned to non-administrative users with User Rights Assignment or the NTRights utility. However, UAC will remove all privileges from the user's token except the standard five (shutdown, change-notify, undock, increase working set, and change timezone). Just like with normal administrator accounts, getting the extra privileges requires elevation. If a user is not a member of any UAC-protected groups, though, the UAC elevation dialog will prompt for the credentials of an administrator instead of elevating the current account, making it impossible to take advantage of the privileges. It may also be necessary to be interactively logged on, as opposed to started in a different user's session with "run as different user."

No comments:

Post a Comment