Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was using TeamViewer (a remote desktop client) to log in to a remote computer running Windows 7.

While logged in, the Java updater prompted me for administrator access to run an update check. Out of habit, I pressed AltY (for "Yes") to grant the updater permission. This worked, and the updater ran.

However, doesn't this entirely defeat the purpose of User Account Control? Much like CtrlAltDelete, isn't it supposed to prevent programs from providing input? Why was TeamViewer able to trick UAC into thinking that I was physically at the terminal pressing the keys?

share|improve this question
up vote 5 down vote accepted

When teamviewer is installed it includes a daemon that runs under the system account. The client that is started under the users account only provides instructions to this daemon.

As this service already has elevated rights assigned at the time of installation (the creation of this daemon) it is possible to directly emulate key strokes as coming from the local system.

share|improve this answer
So it wouldn't be possible to install such a daemon without administrator rights? i.e., at some point in the chain of installations, the user actually has to approve it manually? – wchargin May 12 '13 at 18:44
@WChargin - correct – Tim Brigham May 12 '13 at 18:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.