2

What is the relationship between UAC and ACLs on Windows platforms? Are these two separate security schemes? Or is one a superset of the other?

Intuitively I would expect them to be related but I've been trying to figure this out for a few hours now but have not found any documentation via Google searches that talks about both topics much less providing a comparison/contrast/relationship discussion.

Any thoughts and links would be appreciated.

1
  • We may be able to provide more specific references if you can give us some idea of why you want to know. Nov 3, 2011 at 23:13

2 Answers 2

2

They are related in that UAC relies on the existence of ACLs (and all the related security apparatus) in order to function.

UAC works by removing (technically speaking, disabling) the Administrators token from non-elevated processes. This means that if the ACL for a particular file or folder only allows access to Administrators, non-elevated processes won't have access. That's why an installer can't write to Program Files without elevating first.

EDIT:

See this article for more information about UAC.

In particular: "When an administrator logs on to a computer that is running Windows 7 or Windows Vista, the user is assigned two separate access tokens. Access tokens, which contain a user's group membership and authorization and access control data, are used by the Windows operating system to control what resources and tasks the user can access."

I suppose you could argue that UAC depends on the Windows authorization model, of which ACLs are only a particular component, and that therefore UAC is not related to ACLs. I don't think that's a useful way of looking at it. Let me put it this way: if there weren't any ACLs, UAC would be pointless.

You should also read this article which addresses some common misconceptions about UAC, and in particular the misconception that it is a security feature: "The primary goal of UAC is to enable more users to run with standard user rights. However, one of UAC's technologies looks and smells like a security feature: the consent prompt. Many people believed that the fact that software has to ask the user to grant it administrative rights means that they can prevent malware from gaining administrative rights."

2
  • Some of your points contradict the answer I accepted above. Can you provide links to documentation that back up your statements?
    – Paul Sasik
    Nov 3, 2011 at 21:56
  • @Paul, I've edited my answer. Nov 3, 2011 at 22:51
1

They're separate security schemes. UAC flips the display and prompts you to separately authenticate the application you're trying to install/modify/etc.

ACLs determine what you can/can't access, etc. There is no commonality between the two.

As a thought experiment: you have an installer (install.exe) in a folder (C:\folder). If the user lacks permission to access the folder, the installer will never run, regardless of whether UAC is enabled or not. If the user does not have software installation rights, the installer will not run, regardless of whether UAC is enabled. If the user DOES have access to the folder, and can install software, the installer will run regardless of whether UAC is enabled.

UAC was not intended to replace ACLs. It was grafted onto Windows to try to prevent silent installs and program escalations.

xxxxxx

4
  • This sounds like a great answer. Would you mind providing a link or two to supporting documentation? This is related to a customer support issue and needs to be nailed down 100%. Thanks!
    – Paul Sasik
    Nov 3, 2011 at 16:55
  • technet.microsoft.com/en-us/library/cc709691%28WS.10%29.aspx - Check the descriptions under "What is User Access Control?" - it makes no reference to ACLs at all. ACLs for files/folders are a function of NTFS, which is entirely separate from administrative privileges with respect to launching applications. Nov 3, 2011 at 18:47
  • That's a bit misleading. The article you reference doesn't mention ACLs by name, but it certainly mentions access control, and ACLs are an essential part of the Windows access control system. Nov 3, 2011 at 22:48
  • Also I think your thought experiment is confusing, because there's no such thing as "software installation rights": whether or not you can install software is determined by the ACLs protecting the Program Files folder and/or the registry. Nov 3, 2011 at 22:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .