3

I am trying to understand some behavior I am seeing with Windows User Account Control (UAC). We have an application that is being run with the manifest requestedExecutionLevel highestAvailable. 

<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
  <requestedExecutionLevel level="highestAvailable" uiAccess="false" />
</requestedPrivileges>

I have full UAC enabled on my machine. When I run this application as a local user, Windows does not prompt me to elevate privileges. This is expected behavior.

When I run this application as an administrator, Windows prompts me to elevate privileges. This is also expected behavior.

However, when I login to my workstation as a domain user that is a standard user account, the domain user is also prompted to elevate privileges. This is what I am trying to understand.

According to several sources I have read, the UAC consent behavior is slightly different for users that have additional privileges. For example, from Windows Vista Application Development Requirements for User Account Control Compatibility, "A standard user with additional privileges (such as backup operator)" (emphasis mine) will be prompted for consent if the consent policy is to prompt for credentials.

I want to get more information about which "additional privileges" would cause the user to be prompted for UAC consent. I can imagine some of them are Power users, Backup Operators, Domain Admins, Account Operators, etc. Ideally, there is a list or table somewhere out there of what would trigger this consent behavior.

What "additional privileges" would trigger UAC consent popups for standard user accounts?

Improve this question

1 Answer 1

Reset to default
1

According to this TechNet article by Mark Russinovich, Security: Inside Windows Vista User Account Control, the list of additional privileges is:

  • Built-In Administrators
  • Certificate Administrators
  • Domain Administrators
  • Enterprise Administrators
  • Policy Administrators
  • Schema Administrators
  • Domain Controllers
  • Enterprise Read-Only Domain Controllers
  • Read-Only Domain Controllers
  • Account Operators
  • Backup Operators
  • Cryptographic Operators
  • Network Configuration Operators
  • Print Operators
  • System Operators
  • RAS Servers
  • Power Users
  • Pre-Windows 2000 Compatible Access
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .