This isn't a healthy attitude to have, in my opinion. Even experts make mistakes. Also, there are thousands of server admins in the world who I wouldn't exactly call "experts." You don't hear many *nix admins saying things like, "man, what BS, I'm an expert, I shouldn't have to
But anyway, on to your question.
First of all, you ask, (paraphrased) "if I disable UAC, will I still have a restricted token?"
Well that depends. Who are you? Not everyone on the system will have a restricted token. Only users who log on to the system who are members of privileged groups such as Administrators, Domain Administrators, etc., or who have sensitive privileges such as
SeTcpPrivilege, etc., will be given restricted tokens in addition to their full token during logon.
Please reference Windows Internals, 6th Ed. Part I Chapter 6 for a full list of exactly which groups and what privileges are checked before a restricted access token is generated.
A quote from the aforementioned book:
If one or more of these groups or privileges are present, LSASS creates a restricted token for the user (also called a filtered admin token), and it creates a logon session for both. The standard user token is attached to the initial process or processes that Winlogon starts (by default, Userinit .exe) .
Note If UAC has been disabled, administrators run with a token that includes their administrator group memberships and privileges.
And also, from Chapter 2 (emphasis is mine):
Upon a successful authentication, LSASS calls a function in the security reference monitor (for example, NtCreateToken) to generate an access token object that contains the user’s security profile. If User Account Control (UAC) is used and the user logging on is a member of the administrators group or has administrator privileges, LSASS will create a second, restricted version of the token . This access token is then used by Winlogon to create the initial process(es) in the user’s session .
You can test this for yourself using
whoami /priv. With UAC on, log on as a user who is a member of the Administrators group. In a non-elevated command prompt, you will see that the list of privileges is much shorter in the non-elevated command prompt, implying the existence of two separate tokens for the same user:
Now turn UAC off (or set to "Never Notify",) reboot the machine, and attempt the same test. You will notice now that there is no difference between a standard and an elevated process. No more restricted access token.