Maintaining application integrity
To help maintain internal consistency and application integrity,
Windows Server defines two run levels for applications: standard and administrator.
Windows Server determines whether a user needs elevated privileges to
run a program by supplying most applications and processes with a
security token. If an application has a standard token,
or an application cannot be identified as an administrator
application, elevated privileges are not required to run the
application, and Windows Server starts it as a standard application by
default. If an application has an administrator token, elevated
privileges are required to run the application, and Windows Server
prompts the user for permission or confirmation prior to running the
application.
Application access tokens
Applications are said to be either compliant or legacy. Any application written specifically for
Windows Server 2008 or later is considered to be a compliant application. Any application written for an
earlier version of Microsoft Windows or not certified as compliant
is considered to be a legacy application.
Distinguishing between compliant and legacy applications is important because
of the architecture changes required to support UAC. Compliant applications use UAC to reduce the
attack surface of the operating system. They do this by preventing
unauthorized programs from installing or running without the user’s
consent and by restricting the default privileges granted to
applications. This, in turn, makes it harder for malicious programs
to take over a computer.
The Application Information service facilitates the
running of interactive applications with an
“administrator” access token. By default, this service is stopped and
configured for manual start up. When this service is stopped, you
will be unable to start interactive applications with the additional
administrator privileges you might require to perform
tasks.
Applications derive their security context from the current user’s access token.
By default, the Local Security Authority (LSA) turns all users into standard users even if they
are members of the Administrators group. When a member of an
administrator group logs on to a computer where UAC is enabled, the
LSA creates two access tokens for two different logon sessions: one
with administrator rights and one with administrator rights filtered
out. The filtered access token is used to start the user’s desktop.
The other logon session runs as an administrator and is accessed
when tasks are elevated. Thus, if an administrator user has
consented to the use of her administrator privileges, the unfiltered
access token (which contains all of the user’s privileges) is used
to start the application or process rather than the user’s standard
access token. Also note that the access tokens contain separate
logon IDs because they are related to different logon
sessions.
Most applications can run using a standard user access
token. Whether applications need to run with standard or
administrator privileges depends on the actions the applications
perform. Applications that require administrator privileges,
referred to as administrator applications,
differ in several ways from user applications that require standard user
privileges, referred to as user
applications.
Administrator applications require elevated privileges
to run and perform core tasks. When started in elevated mode, an application with a user’s administrator access token
can perform tasks that require administrator privileges and also can
write to system locations of the registry and the file system.
Standard user applications do not require elevated privileges
to run and perform core tasks. When started in standard user mode,
an application with a user’s standard access token must request
elevated privileges to perform administration tasks. For all other
tasks, the application should not run using elevated privileges.
Further, the application should write data only to nonsystem
locations of the registry and the file system.
Because of UAC, the processes related to installing and
running applications have also changed. In earlier versions of
Windows, the Power Users group gave users specific administrator
privileges to perform basic system tasks when installing and running
applications. Compliant applications do not require the use of the
Power Users group; this group is maintained only for
legacy-application compatibility.
Windows Server detects application installations and prompts
users for elevation to continue the installation by default. Installation packages for
Windows Server–compliant applications use application manifests that contain run-level designations to help track required
privileges. Application manifests define the application’s desired
privileges as one of the following:
-
RunAsInvoker
Runs the application with the same privileges as
the user. Any user can run the application. For a standard user
or a user who is a member of the Administrators group, the
application runs with a standard access token. The application
runs with higher privileges only if the parent process from
which it is started has an administrator access token. For
example, if you start an elevated Command Prompt window and then
start an application from this window, the application runs with an administrator access
token.
-
RunAsHighest
Runs the application with the highest privileges
of the user. The application can be run by both administrator users and standard
users. The tasks that can be performed by the application depend
on the user’s privileges. For a standard user, the application
runs with a standard access token. For a user who is a member of
a group with additional privileges—such as the Backup Operators,
Server Operators, or Account Operators groups—the application
runs with a partial administrator access token that contains
only the privileges the user has been granted. For a user who is
a member of the Administrators group, the application runs with
a full administrator access token.
-
RunAsAdmin
Runs the application with administrator
privileges. Only administrators can run the application. For a
standard user or a user who is a member of a group with
additional privileges, the application runs only if the user can
be prompted for credentials required to run in elevated mode or
if the application is started from within an elevated process,
such as an elevated Command Prompt window. For a user who is a
member of the Administrators group, the application runs with an
administrator access token.
Windows Server protects application processes by labeling them
with integrity levels ranging from high to low.
Applications that modify system data, such as Disk Management, are
considered “high” integrity, while those performing tasks that could
compromise the operating system, such as Microsoft Internet
Explorer, are considered “low” integrity. Applications with lower
integrity levels cannot modify data in applications with higher
integrity levels.
Windows Server identifies the publisher of any application
that attempts to run with an administrator’s full access token.
Then, depending on that publisher, Windows Server marks the
application as being a compliant application, a publisher verified (signed) application, or a
publisher not verified (unsigned) application. When you are
installing or running an application, the elevation prompt is designed to help identify the
potential security risk of installing or running the application.
First of all, the prompt is color-coded. Second, the elevation
prompt displays a unique message depending on the category to which
the application belongs.
When working with the elevation prompt, keep the following in
mind:
-
Red is a strong warning, representing likely danger. If
the application is from a blocked publisher or is blocked by
Group Policy, the elevation prompt has a red background and
displays the message “The application is blocked from
running.”
-
Yellow is a general warning, indicating potential danger.
If the application is unsigned (or is signed but not yet
trusted), the elevation prompt has a yellow background and red
shield icon and displays the message “An unidentified program
wants access to your computer.”
-
Blue/green is for administrative elevation. If the
application is administrative (such as Server Manager), the
elevation prompt has a blue/green background and displays the
message “Windows needs your permission to continue.”
-
Gray is for general elevation. If the application has been
signed by Authenticode and is trusted by the local computer, the
elevation prompt has a gray background and displays the message
“A program needs your permission to continue.”
Only core Windows processes can access the secure desktop prompt. This serves to further secure
the elevation process by preventing spoofing of the elevation prompt. The secure desktop
is enabled by default in Group Policy.
