In server 2008 R2, if I run an app in administrator's mode, will the child process still be in the same mode?
I raise this question because I suspect the child process from the app is not running in administrator's mode.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Yes, child processes inherit the access token of the parent process (from UAC Process and Interactions on TechNet):
Each application that requires the administrator access token must prompt the administrator for consent. The one exception is the relationship that exists between parent and child processes. Child processes inherit the user access token from the parent process. Both the parent and child processes, however, must have the same integrity level.
Somewhat related bonus info:
runas utility has two poorly documented switch called
/trustlevel that seemingly allows you to launch (from an elevated process) a new process with a standard user token rather than your admin token, without lowering the integrity level of the child process:
runas /trustlevel:0x20000 cmd.exe
You'll find that the Window title contains
(running as [username] with restricted privileges), and whoami will show a restricted privilege and group list, compared to the elevated prompt:
Yes, it will execute with Administrator privileges.
You can test this by opening the app as an Administrator and opening notepad.exe from the app. Try saving a blank text file to C:\Windows. If it does not throw a permissions error, then you know the child process (Notepad) is running with elevated privileges.
Yes, the child will be in admin mode.
This is why running cmd.exe as admin allows you to start other programs in admin mode.