Microsoft has tremendously increased the security of Windows 8.1 but i found a technique to bypass UAC remotely

  1. I know that if User belongs to local group Administrators he is not given full Admin Token on the box nether locally or remotely

  2. He is given filtered token and when he needs to perform admin related tasks he needs to pass UAC

  3. This boundary keeps Malware from escalating on the Box

  4. I found a way a remote user is given full admin Token and he is full Administrator on the box and in this he bypasses UAC

  5. Though The user belongs to local group Administrators not default administrator he bypasses uac Can this be regarded Privilege Escalation

  6. I know about Tokens Primary Token, Filtered Token, Impersonation Token Etc I did full experiment with this and it works, why doesn't Microsoft care

The Technique

Enable print and file sharing on target computer set LocalAccountTokenFilterpolicy to 1 in registry on target computer ( i was only forced to change registry in some windows 7 professional machine) in in windows 8.1 0r Ultimate i did not touched registry.so changing Registry is not Mandatory

suppose the ip of target computer is use this command for the hack \\\Admin$\system32\Services.msc hit enter or ok in the run prompt when service app loads from remote machine use this command go to Help > Print Topic > Print > Find printer and then use this command in the explorer bar \\\Admin$\system32\cmd.exe hit enter you will get CMD as Administrator without UAC Here service app already loads with elevated Token and i.e is why cmd loads as administrator, Please first Understand the importance of remote UAC bypass and then comment

  • 4
    let me see if I got this right: you disabled UAC restrictions for remote logins by changing the registry key "LocalAccountTokenFilterpolicy" and then you're complaining that process token elevation is no longer enforced ? – Stephane Dec 11 '14 at 10:29
  • @Stephane don't get too excited the use of registry is not mandatory in my case as 8.1 and windows 7 ultimate did not use "LocalAccountTokenFilterpolicy" and in case my attack machine was XP it was even more easier, however some windows 7 professional versions forced me to change registry and you should test this yourself – raven Dec 11 '14 at 11:27
  • 1
    @raven for the record (relating to your comments elsewhere) it is not "the mods" downvoting your questions, it is the community as a whole - because they were not good questions. Likewise, if your questions get closed, it is not because we don't like your SUPERHACK, again it is because it is not a good question, that fits well on our site. Please take a few minutes to take the tour, and peruse the help center. – AviD Dec 11 '14 at 11:44
  • Inconsistency in the need for Registry alterations sounds like bad change management and testing procedures to me. Re-build a box fresh, jack UAC up to full power, and try again. Chances are, you'll figure out that you'd already disabled UAC on one of your earlier test systems and just forgotten about it. – Iszi Dec 11 '14 at 21:24
  • 1
    Or, equally likely, didnt realize that he already approved the UAC prompt when he opened MMC.exe in the first place. – AviD Dec 11 '14 at 21:55

To answer your question, Microsoft does not care because you followed their directions to disable UAC in order to 'bypass' their UAC.

To disable UAC remote restrictions, follow these steps:
1.Click Start, click Run, type regedit, and then press ENTER.
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

3. If the LocalAccountTokenFilterPolicy registry entry does not exist, follow these steps:
a. On the Edit menu, point to New, and then click DWORD Value.
b. Type LocalAccountTokenFilterPolicy, and then press ENTER.

4. Right-click LocalAccountTokenFilterPolicy, and then click Modify.
5. In the Value data box, type 1, and then click OK.

6. Exit Registry Editor.


  • ya you can diable UAC but while disabling the UAC you have to pass UAC i.e you have to say yes to a UAC prompt wile when i bypass it i don't encounter UAC, I straightaway get full Admin Token – raven Dec 11 '14 at 9:23
  • I'm just saying if Microsoft already said it's not a vulnerability, then I don't see why the mods would consider it one. – cremefraiche Dec 11 '14 at 9:39
  • Changing Registry is not Mandotory and setting LocalAccountTokenFilterPolicy in registry does not IN ANYWAY allows us to bypass uac, you will still get UAC prompts for Admin related Tasks,please UNderstand it First,please test it first – raven Dec 11 '14 at 13:00
  • When you start the registry by regedit or any other means, does it prompt from UAC? – void_in Dec 12 '14 at 5:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.