Current releases of Windows make it easy to determine which tasks standard users can perform and which tasks administrators can perform. You might have noticed the multicolored shield icon next to certain options in windows, wizards, and dialog boxes. This is the Permissions icon. It indicates that the related option requires administrator permissions to run. That doesn’t mean you’ll see a prompt, though. The way the prompt works depends on the following:

By default, when you are logged on to a computer as a standard user, you see a User Account Control (UAC) prompt when programs try to make changes to the computer that require administrator permissions and when programs try to change Windows settings. In a workgroup, the prompt shows the accounts of administrators. If you tap or click an account, you must then enter the password for that account and then tap or click Yes.

In a domain, as shown in Figure 9-1, the prompt shows the logon domain and provides user name and password boxes. To proceed, you must enter the name of an administrator account, type the account’s password, and then tap or click Yes. The task or application then runs with administrator permissions.

Whether the computer is in a workgroup or domain, the prompt shows the name of the program requesting elevation, the publisher of that program, and the file origin. If you have any question about the authenticity of the request, tap or click Show Details. You then see the program location, which shows the full path to the program’s executable. For verified publishers, display their verification certificate by clicking the link provided.

Figure 9-1. User Account Control requires a password to run certain applications when the user is not logged on with an administrator account.

The prompt works differently when you are logged on with an administrator account. Here, it doesn’t matter whether the computer is in a workgroup or a domain, and the prompt doesn’t require an account selection or a password. Instead, your current credentials are used, and you are simply prompted to confirm that you want to allow the task or program to make changes to the computer. If you click Yes, the task or application then runs with administrator permissions. (See Figure 9-2.)

Figure 9-2. User Account Control prompts users when they are already logged on with an administrator account.

The process of getting approval prior to running an application in administrator mode and prior to performing actions that change system-wide settings is known as elevation. Elevation enhances security by reducing the exposure and attack surface of the operating system. It does this by providing notification when you are about to perform an action that could affect system settings, such as installing an application, and it eliminates the ability of malicious programs to invoke administrator privileges without your knowledge and consent.

Prior to the elevation and display of the User Account Control (UAC) prompt, Windows Server performs several background tasks. The key task you need to know about is that Windows Server switches to a secure, isolated desktop prior to displaying the prompt. The purpose of switching to the secure desktop is to prevent other processes or applications from providing the required permissions or consent. All other running programs and processes continue to run on the interactive user desktop, and only the prompt itself runs on the secure desktop.

Elevation, prompts, and the secure desktop are aspects of User Account Control that affect you the most. Although they seem restrictive at first, these features prevent users from making inadvertent changes to system settings, and they lock down the computer to prevent unauthorized applications from installing or performing malicious actions.

The key component of UAC that determines whether and how administrators are prompted is Admin Approval Mode. By default, all administrators, except the built-in local administrator account, run in and are subject to Admin Approval Mode. Therefore, all administrators, except the built-in local administrator account, see the elevation prompt whenever they run administrator applications.

In Group Policy under Local PoliciesSecurity Options, five security settings determine how Admin Approval Mode and elevation prompting works. Table 9-1 summarizes these security settings. Remember, Group Policy gives you the flexibility to configure UAC as needed for specific environments. For example, if servers at a remote office are in a separate GPO from workstations at that office, you could configure UAC for servers one way and UAC for workstations another way.

In a domain environment, you can use Active Directory–based Group Policy to apply the desired security configuration to a particular set of computers. Just configure the desired settings to a Group Policy Object (GPO) that applies to those computers.

For workgroup configurations or for a special case, you can configure these security settings on a per-computer basis, using local security policy. To access local security policy and configure UAC settings, follow these steps:

Applications are said to be either compliant or noncompliant. Any application written specifically for Windows Server 2008 or later is considered a compliant application. Any application written for an earlier version of Microsoft Windows or not certified as compliant is considered a noncompliant application.

Distinguishing between compliant and noncompliant applications is important because of the architecture changes required to support UAC. Compliant applications use UAC to reduce the attack surface of the operating system. They do this by preventing unauthorized programs from installing or running without the user’s consent and by restricting the default privileges granted to applications. This, in turn, makes it harder for malicious programs to take over a computer.

The Application Information service facilitates running interactive applications with an administrator access token. By default, this service is stopped and configured for manual startup. When this service is stopped, you will be unable to start interactive applications with the additional administrator privileges you might require to perform tasks.

Applications derive their security context from the current user’s access token. By default, the Local Security Authority (LSA) turns all users into standard users even if they are members of the Administrators group. When a member of an administrator group logs on to a computer on which UAC is enabled, the LSA creates two access tokens for two logon sessions: one with administrator rights and one with administrator rights filtered out. The filtered access token is used to start the user’s desktop. The other logon session runs as an administrator and is accessed when tasks are elevated. Thus, if an administrator user has consented to the use of her administrator privileges, the unfiltered access token (which contains all the user’s privileges) is used to start the application or process rather than the user’s standard access token. Also, note that the access tokens contain separate logon IDs because they are related to different logon sessions.

Most applications can run using a standard user access token. Whether applications need to run with standard or administrator privileges depends on the actions the applications perform. Applications that require administrator privileges, referred to as administrator applications, differ in several ways from user applications that require standard user privileges, referred to as user applications.

Administrator applications require elevated privileges to run and perform core tasks. When started in elevated mode, an application with a user’s administrator access token can perform tasks that require administrator privileges and write to system locations of the registry and the file system.

Standard user applications do not require elevated privileges to run and perform core tasks. When started in standard user mode, an application with a user’s standard access token must request elevated privileges to perform administration tasks. For all other tasks, the application should not run using elevated privileges. Further, the application should write data only to nonsystem locations of the registry and the file system.

Because of UAC, the processes related to installing and running applications have also changed. In earlier versions of Windows, the Power Users group gave users specific administrator privileges to perform basic system tasks when installing and running applications. Compliant applications do not require the use of the Power Users group; this group is maintained only for compatibility with older, noncompliant applications.

Windows Server detects application installations and prompts users for elevation to continue the installation by default. Installation packages for Windows Server–compliant applications use application manifests that contain run-level designations to help track required privileges. Application manifests define the application’s desired privileges as one of the following:

Windows Server protects application processes by labeling them with integrity levels ranging from high to low. Applications that modify system data, such as Disk Management, are considered high integrity, whereas those performing tasks that could compromise the operating system, such as Internet Explorer, are considered low integrity. Applications with lower integrity levels cannot modify data in applications with higher integrity levels.

Windows Server identifies the publisher of any application that attempts to run with an administrator’s full access token. Then, depending on that publisher, Windows Server marks the application as a compliant application, a publisher verified (signed) application, or a publisher not verified (unsigned) application. When you are installing or running an application, the elevation prompt is designed to help identify the potential security risk of installing or running the application. First, the prompt is color-coded. Second, the elevation prompt displays a unique message depending on the category to which the application belongs.

When working with the elevation prompt, keep the following in mind:

Only core Windows processes can access the secure desktop prompt. This serves to secure the elevation process further by preventing spoofing of the elevation prompt. The secure desktop is enabled by default in Group Policy.

By default, only applications running with a user’s administrator access token run in elevated mode. Sometimes, you want an application running with a user’s standard access token to be in elevated mode. For example, you might want to start the command prompt window in elevated mode so that you can perform administrator tasks.

In addition to application manifests discussed previously, Windows Server provides three ways to set the run level for applications. You can choose to perform one of the following:

Figure 9-6. The option always to run a program as an administrator is selected.

In Group Policy under Local PoliciesSecurity Options, six security settings determine how application installation and run behavior work. Table 9-2 summarizes these security settings.

For workgroup configurations or for a special case, you can configure these security settings on a per-computer basis by using local security policy. To access local security policy and configure UAC settings, follow these steps:

In a domain environment, you can use Active Directory–based Group Policy to apply the desired security configuration to a particular set of computers. Just apply the desired settings to a GPO that applies to those computers.