When installing software on a standard user account, is it safer to use the UAC pop up to type the admin password into, or switch user to admin then do the install in that user?

  • It should not make a difference. What's provoking the question? – Bill_Stewart Mar 27 '17 at 21:11
  • I'm looking into it for general hardening on Windows 10. Whether the UAC is more vulnerable. – Smiith Mar 28 '17 at 1:29
  • 1
    The UAC prompt appears either way, so your question is not clear. – Bill_Stewart Mar 28 '17 at 12:44

They are both essentially the same, let's think of the possible scenarios.

  • an attacker takes over a single user
  • an attacker has admin or more permissions on the machine

Since Uac runs in a restricted desktop the standard user has no access to that desktop object, meaning that any keylogging, injection or screen logging activity done in this permission set should be blocked, the same as running in a different login session. Assuming the second scenario the attacker has full access, meaning that it doesn't matter.

If we are talking about exploiting the mechanisms both have a pretty big attack surface(assuming an exploit or bypass);

uac has anything from registry or path based side loading, the desktop object not being secure and the entire consent mechanism being broken.

Logins have the registry profile, files on disk, lsass rpc calls, gpo and many other attack vectors for exploitation.

I would go with what is easier for you, just keep your admin password cycling and the account usage to a minimum and you should be safe in that regard.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.