From 37a2825c255e6f81356960e3419ee1be01d41214 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 25 May 2023 11:30:42 -0400 Subject: [PATCH] updates --- .../how-user-account-control-works.md | 139 ++++++++++-------- .../images/uacconsentprompt.png | Bin 666721 -> 0 bytes .../images/uacconsentpromptadmin.png | Bin 0 -> 384116 bytes .../images/uaccredentialprompt.png | Bin 50273 -> 316960 bytes .../images/uaccredentialpromptsigned.png | Bin 0 -> 312977 bytes .../images/uaccredentialpromptunsigned.png | Bin 0 -> 306206 bytes .../images/uacshieldicon.png | Bin 106556 -> 74341 bytes .../user-account-control/index.md | 6 +- windows/security/docfx.json | 2 + windows/security/identity-protection/toc.yml | 12 +- 10 files changed, 85 insertions(+), 74 deletions(-) delete mode 100644 windows/security/application-security/application-control/user-account-control/images/uacconsentprompt.png create mode 100644 windows/security/application-security/application-control/user-account-control/images/uacconsentpromptadmin.png create mode 100644 windows/security/application-security/application-control/user-account-control/images/uaccredentialpromptsigned.png create mode 100644 windows/security/application-security/application-control/user-account-control/images/uaccredentialpromptunsigned.png diff --git a/windows/security/application-security/application-control/user-account-control/how-user-account-control-works.md b/windows/security/application-security/application-control/user-account-control/how-user-account-control-works.md index ab2815ab5a..42ac23120e 100644 --- a/windows/security/application-security/application-control/user-account-control/how-user-account-control-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-user-account-control-works.md @@ -1,6 +1,6 @@ --- title: How User Account Control works -description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. +description: Learn about User Account Control (UAC) components and how it interacts with the end users. ms.collection: - highpri - tier2 @@ -10,48 +10,49 @@ ms.date: 05/24/2023 # How User Account Control works +User Account Control (UAC) is a key part of Windows security. UAC reduces the risk of malware by limiting the ability of malicious code to execute with administrator privileges. This article describes how UAC works and how it interacts with the end-users. + ## UAC process and interactions -Each application that requires the *administrator access token* must prompt for consent. The only exception is the relationship that exists between parent and child processes. Child processes inherit the user's access token from the parent process. Both the parent and child processes, however, must have the same *integrity level*. +With UAC, each application that requires the *administrator access token* must prompt the end user for consent. The only exception is the relationship that exists between parent and child processes. Child processes inherit the user's access token from the parent process. Both the parent and child processes, however, must have the same *integrity level*. Windows protects processes by marking their integrity levels. Integrity levels are measurements of trust: - A *high integrity application* is one that performs tasks that modify system data, such as a disk partitioning application - A *low integrity application* is one that performs tasks that could potentially compromise the operating system, like as a Web brows -Applications with lower integrity levels cannot modify data in applications with higher integrity levels. When a standard user attempts to run an app that requires an administrator access token, UAC requires that the user provide valid administrator credentials. +Applications with lower integrity levels can't modify data in applications with higher integrity levels. When a standard user attempts to run an app that requires an administrator access token, UAC requires that the user provides valid administrator credentials. -To better understand how this process works, let's take a closer look at the Windows logon process. +To better understand how this process works, let's take a closer look at the Windows sign in process. -### Logon process +## Sign in process -The following shows how the logon process for an administrator differs from the logon process for a standard user. +The following diagram shows how the sign in process for an administrator differs from the sign in process for a standard user. ![uac windows logon process.](images/uacwindowslogonprocess.gif) -By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. +By default, both standard and administrator users access resources and execute apps in the security context of a standard user.\ +When a user signs in, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. -When an administrator logs on, two separate access tokens are created for the user: a standard user access token and an administrator access token. The standard user access token contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed. The standard user access token is used to start apps that do not perform administrative tasks (standard user apps). The standard user access token is then used to display the desktop (explorer.exe). Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token. +When an administrator logs on, two separate access tokens are created for the user: a *standard user access token* and an *administrator access token*. The standard user access token: -A user that is a member of the Administrators group can log on, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows automatically prompts the user for approval. This prompt is called an elevation prompt, and its behavior can be configured by using the Local Security Policy snap-in (Secpol.msc) or Group Policy. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). +- Contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed +- It's used to start applications that don't perform administrative tasks (standard user apps) +- It's used to display the desktop by executing the process *explorer.exe*. Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token -### The UAC User Experience +A user that is a member of the Administrators group can sign in, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows automatically prompts the user for approval. This prompt is called an *elevation prompt*, and its behavior can be configured via policy or registry. For more information, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). -When UAC is enabled, the user experience for standard users is different from that of administrators in Admin Approval Mode. The recommended and more secure method of running Windows, is to make your primary user account a standard user account. Running as a standard user helps to maximize security for a managed environment. With the built-in UAC elevation component, standard users can easily perform an administrative task by entering valid credentials for a local administrator account. The default, built-in UAC elevation component for standard users is the credential prompt. +## The UAC user experience -The alternative to running as a standard user is to run as an administrator in Admin Approval Mode. With the built-in UAC elevation component, members of the local Administrators group can easily perform an administrative task by providing approval. The default, built-in UAC elevation component for an administrator account in Admin Approval Mode is called the consent prompt. +When UAC is enabled, the user experience for standard users is different from administrator users. The recommended and more secure method of running Windows, is to ensure your primary user account is a standard user. Running as a standard user helps to maximize security for a managed environment. With the built-in UAC elevation component, standard users can easily perform an administrative task by entering valid credentials for a local administrator account. -**The consent and credential prompts** +The default, built-in UAC elevation component for standard users is the *credential prompt*. -With UAC enabled, Windows prompts for consent or prompts for credentials of a valid local administrator account before starting a program or task that requires a full administrator access token. This prompt ensures that no malicious software can be silently installed. +The alternative to running as a standard user is to run as an administrator in *Admin Approval Mode*. With the built-in UAC elevation component, members of the local Administrators group can easily perform an administrative task by providing approval. -**The consent prompt** +The default, built-in UAC elevation component for an administrator account in Admin Approval Mode is called the *consent prompt*. -The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. - -:::image type="content" source="images/uacconsentprompt.png" alt-text="UAC consent prompt."::: - -**The credential prompt** +### The credential prompt The credential prompt is presented when a standard user attempts to perform a task that requires a user's administrative access token. Administrators can also be required to provide their credentials by setting the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting value to **Prompt for credentials**. @@ -59,34 +60,44 @@ The following is an example of the UAC credential prompt. :::image type="content" source="images/uaccredentialprompt.png" alt-text="UAC credential prompt."::: -**UAC elevation prompts** +### The consent prompt -The UAC elevation prompts are color-coded to be app-specific, enabling for immediate identification of an application's potential security risk. When an app attempts to run with an administrator's full access token, Windows first analyzes the executable file to determine its publisher. Apps are first separated into three categories based on the file's publisher: Windows 10 or Windows 11, publisher verified (signed), and publisher not verified (unsigned). The following diagram illustrates how Windows determines which color elevation prompt to present to the user. +The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. + + :::image type="content" source="images/uacconsentpromptadmin.png" alt-text="UAC consent prompt."::: + +### UAC elevation prompts + +The UAC elevation prompts are color-coded to be app-specific, enabling for easier identification of an application's potential security risk. When an app attempts to run with an administrator's full access token, Windows first analyzes the executable file to determine its publisher. Apps are first separated into three categories based on the file's publisher: + +- Windows +- Publisher verified (signed) +- Publisher not verified (unsigned) The elevation prompt color-coding is as follows: -- Red background with a red shield icon: The app is blocked by Group Policy or is from a publisher that is blocked. -- Blue background with a blue and gold shield icon: The application is a Windows 10 and Windows 11 administrative app, such as a Control Panel item. -- Blue background with a blue shield icon: The application is signed by using Authenticode and is trusted by the local computer. -- Yellow background with a yellow shield icon: The application is unsigned or signed but is not yet trusted by the local computer. +- Gray background: The application is a Windows administrative app, such as a Control Panel item, or an application signed by a verified publisher + :::image type="content" source="images/uaccredentialpromptsigned.png" alt-text="UAC consent prompt."::: +- Yellow background: the application is unsigned or signed but isn't trusted by the device + :::image type="content" source="images/uaccredentialpromptunsigned.png" alt-text="UAC consent prompt."::: -**Shield icon** +### Shield icon -Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screenshot of the **Date and Time Properties** Control Panel item. +Some Control Panel items, such as **Date and Time**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screenshot of the **Date and Time** Control Panel item. -:::image type="content" source="images/uacshieldicon.png" alt-text="UAC Shield Icon in Date and Time Properties"::: +:::image type="content" source="images/uacshieldicon.png" alt-text="UAC Shield Icon in Date and Time Properties" border="false"::: -The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. +The shield icon on the **Change date and time...** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. -**Securing the elevation prompt** +## Securing the elevation prompt -The elevation process is further secured by directing the prompt to the secure desktop. The consent and credential prompts are displayed on the secure desktop by default in Windows 10 and Windows 11. Only Windows processes can access the secure desktop. For higher levels of security, we recommend keeping the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting enabled. +The elevation process is further secured by directing the prompt to the *secure desktop*. The consent and credential prompts are displayed on the secure desktop by default. Only Windows processes can access the secure desktop. For higher levels of security, we recommend keeping the **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting enabled. -When an executable file requests elevation, the interactive desktop, also called the user desktop, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user clicks **Yes** or **No**, the desktop switches back to the user desktop. +When an executable file requests elevation, the *interactive desktop*, also called the *user desktop*, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user selects **Yes** or **No**, the desktop switches back to the user desktop. -Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware does not gain elevation if the user clicks **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware does not gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. +Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt may be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. -While malware could present an imitation of the secure desktop, this issue cannot occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token cannot silently install when UAC is enabled, the user must explicitly provide consent by clicking **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon Group Policy. +While malware could present an imitation of the secure desktop, this issue can't occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token can't silently install when UAC is enabled, the user must explicitly provide consent by selecting **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon security policies. ## UAC Architecture @@ -109,10 +120,10 @@ To better understand each component, review the table below: |Component|Description| |--- |--- | |

Application Information service|

A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.| -|

Elevating an ActiveX install|

If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| -|

Check UAC slider level|

UAC has a slider to select from four levels of notification.