1. User Account Control in Windows Vista
Daniel Moth
Developer & Platform Group
Microsoft Ltd

2. AGENDA Why, What, How Manifests Process Elevation Virtualisation
Compatibility Issues

3. UAC Goals
The Vista goal: enable users to run with standard user rights
Prevents deliberate (and accidental) modification of system settings
Reduces malware impact by preventing modification of security settings and hardware
Prevents compromise of sensitive information on shared computers

4. UAC Challenges
The Windows usage model has been one of administrative rights
Applications use them without knowing it
Those that need it don’t distinguish administrative from standard user actions
Users want administrative rights to easily perform operations that require them
Software installations
Changing the time zone
Changing firewall settings
Etc.

5. Administrative Rights
Problem: there are still operations that require administrative rights:
Installing applications
Modifying system-global settings
Parental controls
Solution: make it convenient to access administrative rights from standard user accounts
Identify operations that require administrative rights
Allow for “run as” functionality
Called Over The Shoulder (OTS) elevation

6. What UAC looks like to the end user
DEMO
What UAC looks like to the end user

7. OTS Dialogs

8. User Account Control Internals
Windows Vista Logon with UAC Enabled
An administrator
enters credentials
in WinLogon UI
Local Security
Authority (LSA)
verifies credentials
Administrator
Token
Windows XP
1.Token inspected for “elevated” privileges
Explorer.exe
created.
“Filtered” token
2. Elevated privileges removed.

9. UAC Internals² Defining Elevated Privileges
User will have a filtered token if they belong to any admin-type group e.g.:
Administrators
Controllers
Backup Operators
User will have a filtered token if they have any of these privileges:
Create Token, Debug, TCB, Take Ownership, Backup, Restore, Impersonate, Load Driver, Relabel

10. UAC Internals³ Administrator’s Standard User Identity
Administrator’s standard user token is subset of their full administrator token
Administrator groups are marked as “deny only” groups
Applies to Domain Administrators, Builtin\Administrators and others
Can only be used to deny access, never to grant
E.g. if file only allows administrator access, user is denied access
E.g. if allows a user’s group access, but denies administrators, user is denied access
All privileges except the following are stripped:
Change Notify, Shutdown, Undock, Reserve Processor, Time Zone
When authenticating to remote resources:
If system is non-domain joined, user authenticates as standard user
If domain-joined and an administrator of the remote resource, user authenticates as administrator

11. StandardUser-Friendly Windows
In Vista, many previously-admin operations are accessible by standard users:
View system clock and calendar
Change time zone
Configure Wired Equivalent Privacy (WEP) to connect to secure wireless networks
Change power management settings
Add printers and other devices that have the required drivers installed on computer or have been allowed by an IT administrator in Group Policy
Install ActiveX Controls from sites approved by an administrator
Create and configure a Virtual Private Network connection
Install critical Windows Updates

12. StandardUser-Friendly Your Application
Test your application when running as Standard User!!
Saving Per-User State as Standard User
%userprofile%
HKCU
Saving Per-Machine State as Standard User
%allusersprofile%
Embed Manifest with run level = “asInvoker”

13. Privileges in Manifests
Manifest files were introduced in Windows XP to support side-by-side DLLs
Used for XP’s Common Control v6 dialog
.NET uses it for managed code “assemblies”
Embedded in resources of binary file
New key in Vista,
requestedElevationLevel
asInvoker: Run with the user’s rights
highestAvailable: if standard user then don’t ask, but if user is an administrator, then ask
requireAdministrator: always ask

14. Embedding Manifest in VS
Create Manifest in source directory
Add following lines to .rc file for project
#define MANIFEST_RESOURCE_ID 1
MANIFEST_RESOURCE_ID RT_MANIFEST "AdminApp.exe.manifest"
Add additional manifest in project properties

15. DEMO
Manifests

16. Process Creation in Vista with UAC Enabled
CreateProcess* checks the following sources for privilege information about the process
1. Embedded Application Manifest
2. Side-by-Side External Manifest
3. App Compatibility Database
4. Installer Detection
If process requires elevated privileges and parent process token does not possess these privileges ERROR_REQUIRES_ELEVATION is returned.

17. UAC Prompt Internals CreateProcessAsUser ( Admin.exe)
CreateProcess( Admin.exe)
Explorer.exe
AppInfo Service
Admin.exe
2. RPC
ShellExecute
Consent.exe
1. ERROR_ELEVATION_REQUIRED
3. Re-parented
CreateProcess
Standard User
Local System
Administrator

18. DEMO Launching Elevated Shield
-Extract admin pieces as other manifested processes
-Re-launch ourselves elevated

19. COM Elevation COM Elevation Example: File Operation elevation
Accomplished using elevation moniker
Object class must contain elevation attributes
Example: File Operation elevation
HKCR\CLSID\{3ad b85bdb8e09}
\Elevation
REG_DWORD Enabled=1
REG_EXPAND_SZ LocalizedString=

20. Shell “access denied” to file
DEMO
Shell “access denied” to file

21. Common AppCompat Issue File and Registry Permissions
Many applications would run fine as standard user
…but they needlessly store data in HKLM\Software or %ProgramFiles%
They use these locations for per-user data, not global data
These locations are system-global and so only writeable by administrators
It’s always worked because Windows users have always been administrators

22. DEMO
Virtualisation
Modifications of most system-global locations go to per-user areas
Reads generally go to the per-user location and fall back to the global location

23. File Virtualisation Redirected file system locations:
%ProgramFiles% (\Program Files)
%SystemRoot% (\Windows)
%SystemRoot%\System32 (\Windows\System32)
%AllUsersProfile% (\ProgramData – what was \Documents and Settings\All Users)
Exceptions:
Files that have executable extensions (.exe, .bat, .vbs, .scr, etc)
Exceptions can be added in HKLM\System\CurrentControlSet\Services\Luafv\Parameters \ExcludedExtensionsAdd
Per-user virtual root:
%UserProfile%\AppData\Local\VirtualStore

24. Registry Virtualization
Redirected locations:
HKLM\Software
Exceptions:
HKLM\Software\Microsoft\Windows
HMLM\Software\Microsoft\Windows NT
Other subkeys under Microsoft
Per-user virtual root:
HKEY_CURRENT_USER\Software\Classes\VirtualStore

25. Virtualized Processes
Processes are virtualized unless
They are running with administrative rights
They are 64-bit
They have a requestedExecutionLevel in their executable manifest
Most Windows Vista executables
Can be turned off globally via local security policy setting (secpol.msc)

26. UAC: Local Security Policies
DEMO
UAC: Local Security Policies

27. Installation AppCompat Issues
Don’t Perform Administrator Operations on First Run
Configure all machine-wide state during install
Updating Application Binaries Usually Requires Administrator Privileges
Application binaries in %ProgramFile% cannot be overwritten by a Standard User.
MSI updating technology (MSPs) does elevated update based on the signature of the patch
Use Bootstrapper to Launch Application As Part of Install

28. Summary Understand UAC Act Now
Filtered Token, Elevation, Process creation, Prompts, Shields, Manifests, Virtualisation
Act Now
Test your applications as a Standard User
Use the Standard User Analyzer to help
Embed a manifest in your EXEs
Fix your installation programs (use MSI)

29. UAC Resources
User Account Control Resources for IT Professionals (TechNet Landing Page) 
Windows Vista Application Development Requirements for UAC Compatibility                    
UAC Team blog                                                                
COM Elevation Moniker  
Windows Vista UX Guidelines for UAC 
MSI Patching Technology
Service Security

30. Event slides will be posted at:

31. Get the latest technology previews, trial software, special offers
Get information tailored to your needs
Pick your RSS feeds
Sign up for MSDN Connection at:

32. Additional Information
UK MSDN Events
Post events page including slide decks
Upcoming events
UK MSDN Site & Flash Newsletter
Local news, events, nuggets & webcasts
Register to receive the bi-weekly MSDN Flash by

33. ©. 2006 Microsoft Corporation. All rights reserved
© 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.