I am trying to understand some behavior I am seeing with Windows User Account Control (UAC). We have an application that is being run with the manifest requestedExecutionLevel
highestAvailable
.
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
</requestedPrivileges>
I have full UAC enabled on my machine. When I run this application as a local user, Windows does not prompt me to elevate privileges. This is expected behavior.
When I run this application as an administrator, Windows prompts me to elevate privileges. This is also expected behavior.
However, when I login to my workstation as a domain user that is a standard user account, the domain user is also prompted to elevate privileges. This is what I am trying to understand.
According to several sources I have read, the UAC consent behavior is slightly different for users that have additional privileges. For example, from Windows Vista Application Development Requirements for User Account Control Compatibility, "A standard user with additional privileges (such as backup operator)" (emphasis mine) will be prompted for consent if the consent policy is to prompt for credentials.
I want to get more information about which "additional privileges" would cause the user to be prompted for UAC consent. I can imagine some of them are Power users, Backup Operators, Domain Admins, Account Operators, etc. Ideally, there is a list or table somewhere out there of what would trigger this consent behavior.
What "additional privileges" would trigger UAC consent popups for standard user accounts?