#Process explorer integrity level code#
#Process explorer integrity level windows 7#

Here's a screenshot of Process Explorer on a system with the UAC disabled, after opening a DOCX file that exploits Adobe Flash vulnerability VU#561288: What this means is not only will the Office applications lose the benefit of low integrity, they will also run plugins such as Adobe Flash without prompting the user! Just like disabling the UAC will disable Protected Mode with Internet Explorer, disabling the UAC will also disable Microsoft Office Protected View when Office is launched from Internet Explorer.

#Process explorer integrity level windows 7#

Here is a screenshot of the Process Explorer view of Word 2013 when launched from Internet Explorer on a Windows 7 system: Given the recent vulnerability in Flash, this should help protect users. In addition to running with low integrity, Office Protected View also disables plugins such as Adobe Flash. Protected View may be enabled for a number of reasons, including when the file is downloaded from an internet location. Starting with Office 2010, Microsoft introduced Protected View, which has some similar properties to Internet Explorer's Protected Mode. The following screenshot shows Internet Explorer running on a system with UAC disabled, and subsequently IE Protected Mode disabled:

#Process explorer integrity level code#

If you're logged on as an administrator, then the code will execute with a high integrity, and subsequently administrative privileges. What this means is if a vulnerability is triggered via Internet Explorer, then the resulting code that executes should have the same privileges as the logged-on user. If UAC is disabled, then IE Protected Mode is also disabled. The following screenshot is Process Explorer showing Internet Explorer running in Protected Mode: Protected Mode makes it more difficult for attackers to cause harm to a system. A low-integrity process has fewer privileges than a standard user on Windows, and a high-integrity process has administrative privileges. Protected Mode in Internet Explorer is made possible through the use of Windows integrity levels.

Starting with Windows Vista, Internet Explorer Protected Mode was introduced. It's the unexpected consequences of disabling the UAC that can get people in trouble. The point of the UAC was to steer application developers to accept a world where their users do not have administrative privileges all of the time. I will explain in this blog post why disabling the UAC is a bad idea.įirst introduced with Vista, the UAC was annoying to many, which caused some folks to disable it as shown in the screenshot below. For these or other reasons, some folks may have disabled the UAC on their Windows systems. Microsoft has published documents that indicate that the UAC is not a security boundary. While investigating a few of the exploits associated with the recent HackingTeam compromise, I realized an aspect of the Windows User Account Control (UAC) that might not be widely known.