5

In server 2008 R2, if I run an app in administrator's mode, will the child process still be in the same mode?

I raise this question because I suspect the child process from the app is not running in administrator's mode.

  • Without knowing what type of "app" you're running and the way it launches child processes, I don't think we're going to be able to help you further – Mathias R. Jessen Jun 24 '15 at 22:43
7

Yes, child processes inherit the access token of the parent process (from UAC Process and Interactions on TechNet):

Each application that requires the administrator access token must prompt the administrator for consent. The one exception is the relationship that exists between parent and child processes. Child processes inherit the user access token from the parent process. Both the parent and child processes, however, must have the same integrity level.


Somewhat related bonus info:

The runas utility has two poorly documented switch called /showtrustlevels and /trustlevel that seemingly allows you to launch (from an elevated process) a new process with a standard user token rather than your admin token, without lowering the integrity level of the child process:

runas /trustlevel:0x20000 cmd.exe

You'll find that the Window title contains (running as [username] with restricted privileges), and whoami will show a restricted privilege and group list, compared to the elevated prompt:

enter image description here

2

Yes, it will execute with Administrator privileges.

Simple test:

You can test this by opening the app as an Administrator and opening notepad.exe from the app. Try saving a blank text file to C:\Windows. If it does not throw a permissions error, then you know the child process (Notepad) is running with elevated privileges.

1

Yes, the child will be in admin mode.

This is why running cmd.exe as admin allows you to start other programs in admin mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.