1. Raiders of the Elevated Token: Understanding User Account Control and Session Isolation Raymond P.L. Comvalius Independent IT Infrastructure Architect NEXTXPERT WCL325

2. @nextxpert

5. The Administrator The account named ‘administrator’ An Administrator Your name with administrator privileges Protected Administrator AKA: ‘Administrator in Admin Approval Mode’ Standard User Your name without administrator privileges

6. Administrators Backup Operators Power Users Network Configuration Operators Cryptographic Operators Domain Admins Schema Admins Enterprise Admins Group Policy Creator Owners Domain Controllers Enterprise Read-Only Domain Controllers Account Operators Print Operators Server Operators RAS Servers Pre-Windows 2000 Compatible Access Remove all except: Bypass traverse checking Shutdown the System Remove computer from Docking station Increase a process working set Change the Time zone

7. With or without administrative privileges Analyzing the User Token Demo

11. Configuring UAC Demo

14. SystemHigh Medium (Default) Low Services AdministratorsStandard Users IE Protected Mode

15. Integrity Level: Medium (Restricted Token) Integrity Level: High (Elevated Token)

16. Internet Explorer 8 Internet Explorer 9/10

17. iexplore.exe (management process) iexplore.exe (content process) Protected-mode Broker Object UI Frame Favorites Bar Command Bar Browser Helper Objects ActiveX Controls Toolbar Extensions Browser Helper Objects ActiveX Controls Toolbar Extensions

18. Integrity Levels Demo

21. File & Registry Virtualization Demo

26. File Names & Manifests Demo

28. Compatibility Settings Demo

31. Session 0 Isolation Demo

33. DD D Kernel Drivers D D User-mode Drivers D DD Service 1 Service 2 Service 3 Service … Service … Service A Service B

36. Concluding

38. WCL301: Case of the Unexplained 2012 www.microsoft.com/springboard www.nextxpert.com Find Me Later At the Technical Learning Center WCL402: App Compat for Nerds

39. Resources for Developers http://msdn.microsoft.com/en-us/windows/apps http://msdn.microsoft.com/en-us/windows/apps Windows 8 is ready for Business http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/windows-8/default.aspx http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/windows-8/default.aspx Microsoft Desktop Optimization Pack: www.microsoft.com/MDOP www.microsoft.com/MDOP Microsoft Desktop Virtualization: www.microsoft.com/dv www.microsoft.com/dv

41. Download http://windows.microsoft.com/en-US/windows-8/release-preview Download the Windows 8 Release Preview Today

42. Connect. Share. Discuss. http://northamerica.msteched.com Learning Microsoft Certification & Training Resources www.microsoft.com/learning TechNet Resources for IT Professionals http://microsoft.com/technet Resources for Developers http://microsoft.com/msdn

43. Required Slide Complete an evaluation on CommNet and enter to win!