CODEWITHSUNDEEP
windowsuacdesign-patternsprivilege-elevation
lornova
lornova

Reputation: 6943

UAC and elevation prompt pattern

I've read several questions regarding UAC and privilege elevation but I've not found a satisfactory/comprehensive answer.

I have this scenario: on Windows 6 or above, when the user opens a configuration window I have to show the shield (BCM_SETSHIELD) on the OK button only if privilege elevation will be required to complete the task. -- I do know that in the Windows UI the shield is always visualized for "administrative tasks", even if UAC is disabled, but the customer had this specific request.

I have draft this condition in order to show the icon:

  1. The user has not administrative rights
    OR
  2. The current process has TOKEN_ELEVATION_TYPE == TokenElevationTypeLimited

The condition #1 is simple: if the user hasn't administrative rights elevation is always required regardless of UAC. The #2 implies that the user has administrative rights, and any other value of TOKEN_ELEVATION_TYPE means that elevation is not needed.

Is really that simple? I am missing something? And - there's a documented or well-known pattern regarding this topic?

Upvotes: 8

Views: 969

Answers (2)

Elmue
Elmue

Reputation: 8178

I see that there is a lot of confusion about this topic and the answer from Kate here is not correct and incomplete.

Since Vista an Admin may be logged in but his processes do not run elevated automatically. An Admin has a so called "Split Token". This means that there may be processes running for the SAME admin user, and some of them run elevated and other do NOT run elevated. When an Admin runs a not elevated process, some of the privileges of his token have been removed. It is not anymore as in XP where ALL processes run either elevated or not elevated.

Install Process Explorer from www.sysinternals.com and enable the column "Integrity Level". If you see there "Medium" this process does not run elevated. If you see there "High" the process runs elevated. If the process runs with Integrity level "High" no UAC prompt is required to start another process elevated.

When UAC is completely turned off, ALL processes run "High", so no elevation is required never. UAC can be turned off under

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System

setting the key "EnableLUA". Changing this setting requires reboot.

But there is another point that was not yet mentioned here. In Control panel it is possible to configure "Elevate without prompting". And in this case an Admin user can start an elevated process from another not elevated process and NO UAC prompt will show up.

This setting is stored under the same registry path in the key "ConsentPromptBehaviorAdmin" for admin users.

For all non-admin users there is the key "ConsentPromptBehaviorUser" but this changes only the bahavior, but elevation cannot be turned off. Non-admins will always get an UAC prompt. (if UAC is not completely off)

How do you know if your process runs elevated: Call OpenProcess(), then OpenProcessToken(), then GetTokenInformation(TokenElevation).

And to get the Integrity Level call GetTokenInformation(TokenIntegrityLevel) and then GetSidSubAuthority()

So if you want to show your icon only if elevation is really required you must check if your process runs elevated and additionally check these registry keys and you must know if the user is an admin or not. This involes several lines of code and I would consider to show this icon always when elevation may be required to keep it simple.

Please note that the API IsUserAnAdmin() is deprecated. It must not be used anymore since Vista. Checking if a user belongs to the administrators group is much more code now.

Upvotes: 3

Kate Gregory
Kate Gregory

Reputation: 18974

You are right. Most people just put the shield on if the button will be running elevated, but the right thing to do is to put the shield on if the button will cause elevation (ie suppress it if you are already elevated, since everything you launch will remain elevated unless you go to some trouble to launch a non elevated process, and suppress it if UAC is off.)

The good news is that if someone in the Administrators group runs (under UAC) an application non-elevated, you'll get back false when you ask if they are an admin or not. So I think you might be ok with just that one test.

Upvotes: 3

Related Questions